I ran into the same problem testing my Ansible playbooks which require systemd. And as you said, docker seems like the best approach here as it is much easier to bring up and down a container rather than a virtual machine.
First of all base/archlinux image is deprecated - you should use archlinux/base instead.
Then, to run systemd totally unprivileged, number of things should be done:
- provide a
container=
variable, so systemd won't try to do number of things it usually does booting a hardware machine
- systemd actively uses cgroups, so bind mount
/sys/fs/cgroup
file system from a host
- bind mounting
/sys/fs/fuse
is not required but helps to avoid issues with fuse-dependent software
- systemd thinks that using
tmpfs
everywhere is a good approach, but running unprivileged makes it impossible for it to mount tmpfs
where ever it wants, so pre-mount tmpfs
to /tmp
, /run
and /run/lock
- as the last bit you need to specify
sysinit.target
as default unit to boot instead of multi-user.target
or whatever, as you really do not want to start graphical things inside a container
The resulting command line is
docker run \
--entrypoint=/usr/lib/systemd/systemd \
--env container=docker \
--mount type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup \
--mount type=bind,source=/sys/fs/fuse,target=/sys/fs/fuse \
--mount type=tmpfs,destination=/tmp \
--mount type=tmpfs,destination=/run \
--mount type=tmpfs,destination=/run/lock \
archlinux/base --log-level=info --unit=sysinit.target
If we are talking about running particular service there like ntpd from your example you will need to add
--cap-add=SYS_TIME
otherwise ntpd
will fail with permission deny as nobody wants a container to set system time by default.
P.s I spent quite a while learning how systemd behaves and managed to get it working on number of operating system images. I described my experience in an article Running systemd in docker container. It is in Russian but I believe google translate should work in your browser. Thanks
ENTRYPOINT
systemd doesn't factor into it. If you're looking for some sort of container integration with systemd you can look into creating an nspawn service – Bratchley Aug 23 '16 at 21:30ENTRYPOINT
. – l0b0 Aug 24 '16 at 11:56