3 ms·

I was looking into systemd-nspawn recently because I wanted some container features (tcp port namespace, so I can have multiple groups of processes run and conn

I was looking into systemd-nspawn recently because I wanted some container features (tcp port namespace, so I can have multiple groups of processes run and connect to an instance of mysqld on the default port, on a ci server). I installed it, ran it, and it immediately complained "not a systemd system" and refused to run. I've not looked into things further, but presumably systemd-nspawn requires that systemd be running, which was a surprise to me since systemd-nspawn calls itself "chroot on steroids", and chroot cares nothing about the init system.

chimeracoder 12y ago
> systemd-nspawn calls itself "chroot on steroids", and chroot cares nothing about the init system. If I remember correctly, systemd-nspawn uses cgroups (hence the "steroids" part of of "chroot on steroids"). On Linux, cgroups require a single manager for all cgroups (in this case systemd). This is not a systemd limitation; it is a requirement set by the Linux kernel[0]. In theory you could bring-your-own cgroup manager, but cgroups are nascent enough that trying to make a userland tool like systemd-nspan work with a completely pluggable cgroup manager would be a nightmare. [0] http://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/ http://www.freedesktop.org/wiki/Software/systemd/ControlGrou...
- pmahoney 12y ago
  Hm, interesting. I'm certainly largely ignorant of how cgroups works, but I was wishing for a tool like "chroot" that could also "ch-network-namespace" or something. I've skimmed over cgroups documentation [1] several times, but never quite gotten a solid mental model of how everything fits together. [1] https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
  - geofft 12y ago
    You're probably looking for the "unshare" command and corresponding system call (or the same flags to the "clone" system call). Specifically, running "sudo unshare -n bash" will get you a shell with no network devices other than lo. You can then find the pid and use "ip link set dev eth0 netns 1234" from outside to move eth0 into the new namespace (more practically, you might make a virtual network device and move one end into the new namespace). http://man7.org/linux/man-pages/man2/unshare.2.html http://man7.org/linux/man-pages/man2/unshare.2.html http://man7.org/linux/man-pages/man2/clone.2.html http://man7.org/linux/man-pages/man2/clone.2.html http://man7.org/linux/man-pages/man1/unshare.1.html http://man7.org/linux/man-pages/man1/unshare.1.html Loosely a "container" (in the LXC or Docker sense) is a combination of making new namespaces, which isolate the process tree from the rest of the system in various ways (filesystem, network, hostname as returned by "uname", etc.), and making a cgroup, which allows for process tracking and resource allocation.
    - pmahoney 12y ago
      Ah, great stuff, thanks! This small piece of the whole set of container features may be exactly what I want.

chimeracoder 12y ago

> systemd-nspawn calls itself "chroot on steroids", and chroot cares nothing about the init system. If I remember correctly, systemd-nspawn uses cgroups (hence the "steroids" part of of "chroot on steroids"). On Linux, cgroups require a single manager for all cgroups (in this case systemd). This is not a systemd limitation; it is a requirement set by the Linux kernel[0]. In theory you could bring-your-own cgroup manager, but cgroups are nascent enough that trying to make a userland tool like systemd-nspan work with a completely pluggable cgroup manager would be a nightmare. [0] http://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/ http://www.freedesktop.org/wiki/Software/systemd/ControlGrou...

pmahoney 12y ago
Hm, interesting. I'm certainly largely ignorant of how cgroups works, but I was wishing for a tool like "chroot" that could also "ch-network-namespace" or something. I've skimmed over cgroups documentation [1] several times, but never quite gotten a solid mental model of how everything fits together. [1] https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
- geofft 12y ago
  You're probably looking for the "unshare" command and corresponding system call (or the same flags to the "clone" system call). Specifically, running "sudo unshare -n bash" will get you a shell with no network devices other than lo. You can then find the pid and use "ip link set dev eth0 netns 1234" from outside to move eth0 into the new namespace (more practically, you might make a virtual network device and move one end into the new namespace). http://man7.org/linux/man-pages/man2/unshare.2.html http://man7.org/linux/man-pages/man2/unshare.2.html http://man7.org/linux/man-pages/man2/clone.2.html http://man7.org/linux/man-pages/man2/clone.2.html http://man7.org/linux/man-pages/man1/unshare.1.html http://man7.org/linux/man-pages/man1/unshare.1.html Loosely a "container" (in the LXC or Docker sense) is a combination of making new namespaces, which isolate the process tree from the rest of the system in various ways (filesystem, network, hostname as returned by "uname", etc.), and making a cgroup, which allows for process tracking and resource allocation.
  - pmahoney 12y ago
    Ah, great stuff, thanks! This small piece of the whole set of container features may be exactly what I want.