I ran into the same problem testing my Ansible playbooks which require systemd. And as you said, docker seems like the best approach here as it is much easier to bring up and down a container rather than a virtual machine.
First of all base/archlinux image is deprecated - you should use archlinux/base instead.
Then, to run systemd totally unprivileged, number of things should be done:
- provide a "conrainer=" variable, so systemd won't try to do number of things it usually does booting a hardware machine
- systemd actively uses cgroups, so bind mount /sys/fs/cgroup file system from a host
- bind mounting /sys/fs/fuse is not required but helps to avoid issues with fuse-dependent software
- systemd thinks that using tmpfs everywhere is a good approach, but running unprivileged makes it impossible for it to mount tmpfs where ever it wants, so pre-mount tmpfs to /tmp, /run and /run/lock
- as the last bit you need to specify sysinit.target as default unit to boot instead of multi-user.target or whatever, as you really do not want to start graphical things inside a container
The resulting command line is
docker run \
--env container=docker \
--mount type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup \
--mount type=bind,source=/sys/fs/fuse,target=/sys/fs/fuse \
--mount type=tmpfs,destination=/tmp \
--mount type=tmpfs,destination=/run \
--mount type=tmpfs,destination=/run/lock \
archlinux/base --log-level=info --unit=sysinit.target
If we are talking about running particular service there like ntpd from your example you will need to add
otherwise ntpd will fail with permission deny as nobody wants a container to set system time by default.
P.s I spent quite a while learning how systemd behaves and managed to get it working on number of operating system images. I described my experience in an article Running systemd in docker container. It is in Russian but I believe google translate should work in your browser. Thanks