3 ms·
It’s not. You you can use systemd-nspawn to create a container that uses your own root filesystem by specifying --directory=/ --volatile=yes. This mounts a tmpf
by db48x 3y ago
It’s not. You you can use systemd-nspawn to create a container that uses your own root filesystem by specifying --directory=/ --volatile=yes. This mounts a tmpfs into the container’s root, and then mounts your /usr into the container’s /usr in read–only mode. This allows the container to run all the software installed on your machine, while redirecting writes to the tmpfs.
Alternatively, instead of --directory=/ you could specify some other directory that contains an OS image (such as --directory=/var/lib/machines/debian-bookworm or --directory=/var/lib/machines/fedora-38). Multiple containers can transparently share the same image, since all the writes go to a per–container tmpfs.
https://0pointer.net/blog/running-an-container-off-the-host-usr.html https://0pointer.net/blog/running-an-container-off-the-host-...
- jeroenhd 3y agoThat's an interesting way to use systemd-nspawn! But, if it mounts everything, wouldn't that also make container escapes very easy?
- db48x 3y agoWhen it is volatile, it really only mounts the /usr inside the specified directory, rather than the directory itself. In particular, /dev and /etc will be empty.