Goal: no more daemons to run 3rd party containers, systemd is good enough by now: resource limits, isolation, chroot, dynamic users, logging, and more.
Low-level tooling is done, I am now building ecosystem around it: easy installation, convert to deb/rpm, systemd units, etc.
I love it. It does everything I need it to, it's fast, decently documented, supports everything Docker does (just not 1:1 in terms of DX) and is present wherever I need it.
I'm considering them for an upcoming project.
As for just using systemd and not nspawn at all, that seems useful for a lot of cases, but not multiplexing of networked services since systemd can't assign UNIX domain hostnames and IP addresses to individual services. At least, I think it can't, can it?
JoinsNamespaceOf can be used to set up network namespaces (albeit in a clunky way).
It is possible, but multiplexing networked services requires significantly more effort with systemd than with others. I do not have a strong use case yet to invest in tooling for it, but it may come.
Also, as good as systemd is (and I've defended it here a few times as better than what was before), it still feels like an organically grown accumulation of edge cases that were patched. I try to keep it's use to the subset of features that are easy to grow for not just myself but those of my team, and systemd is known (in my circles at least) as being somewhat obtuse. For me, that's a good argument for a dedicated application to handle it.
+1000
Can I still get the same networking functionality with undocker/systemd that docker provides? For example, container hostname resolution, private networks, container->localhost port forwarding?
Have a look at these in systemd.exec[1]: PrivateUsers, DynamicUser, ProtectProc, RootDirectory.
There are more, but these are the main ones.
[1]: https://www.freedesktop.org/software/systemd/man/systemd.exe...
https://github.com/b0o/arch-lwc
Not intended for any sort of production. I personally use it to run Firefox inside a container and for testing.
Edit: looking at the docs is that system-nspawn that's actually doing the heavy lifting. For Linux namespaces. I feel like this has great potential!
As far as systemd vs dockerd goes, dockerd provides a bit more isolation by default, but `systemd-analyze security` can guide you so far beyond the Docker defaults. And it is always compatible with system daemons, giving consistent configuration between, say, postgresql from package manager and prometheus from docker container+undocker.
Running them is a different story. I've never tried systemd user services, so can't tell. Curious myself. :)
Isn't that what Firecracker[1] does ?
(Well, ok, not really, but a bit closer to the base system than Docker/Podman)