2

Is it possible to use nspawn for a single executable? My goal is just to isolate the process tree of the application, not portability.

Let's say you wrote an application in C, built for your target platform. Today I am able to run this as a systemd service by configuration via a systemd unit file. Is there a way to make a minimal nspawn "container" for my application? All the articles I've read indicate that nspawn requires debianbootstrap, which ends up being almost 300mb worth of files. If I don't care about portability, is there some other way to leverage the process tree isolation features of nspawn?

3

Have you read through the systemd-nspawn man page? Nothing in there says that you require debianbootstrap, and in fact it shows several non-debian examples.

You do a root filesystem, but just like a Docker container (or even a traditional chroot environment) that doesn't require anything more than your executable and any shared libraries or other resources necessary for it to run.

If you just want process tree isolation, maybe instead of systemd-nspawn you want unshare:

# unshare --pid --fork --mount-proc bash
# ps -fe
UID        PID  PPID  C STIME TTY          TIME CMD
root         1     0  4 09:49 pts/0    00:00:00 bash
root        24     1  0 09:49 pts/0    00:00:00 ps -fe
  • Thank you, I'll look into taring up the host OS of the device and try running that via nspawn – Zugdud Oct 14 '16 at 14:21
  • @larsks, do you know if anything similar can help me with this: unix.stackexchange.com/q/440722/8305 – Oxwivi Apr 29 '18 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.