Hacker News Reader

Comment by tkiolp4 | Hacker News Reader

Talking about containers: is there an easy way to run “system” containers? This is, containers that run systemd and everything else you would expect to be running on a normal Linux OS. I rely heavily on VMs to simulate cloud environments, but I would love to use lightweight containers instead. Also, these “system” containers should be able to run containers inside them as well (docker in docker?).

I saw something on github the other day that may work (can’t remember the name, something about “box”), but it wasn’t available for Macos.

View on HN

You are probably referring to Sysbox (https://github.com/nestybox/sysbox), which I believe will meet your requirements (systemd, inner containers, security, etc).

Btw, Sysbox is already supported in Docker-Desktop (business tier only), so you can easily do what you want with this instruction:

$ docker run -it --rm -e SYSBOX_SYSCONT_MODE=TRUE ghcr.io/nestybox/ubuntu-focal-systemd-docker:latest bash

Disclaimer: I'm Sysbox's co-creator and currently working for Docker.

Sysbox works great! Amazing job.

But OP is looking for something that works for macos I believe.

Appreciate your comment lmarcos!

Yes, the above instruction runs on macos too as long as you have docker-desktop installed.

Not entirely sure about the usecase, but podman itself integrates well with systemd, like creating services. But it feels like you want a full systemd OS in a container instead of a VM. Not the best practice. VM might better for this, though Podman can run systemd based services. And Podman in docker or podman in podman is not an issue.

https://blog.while-true-do.io/podman-systemd-in-containers/

Podman machine starts a VM that is just a Fedora distro, with systemd and you can create multiple instances. This way you can run these system containers easily.

systemd-nspawn, LXC, and podman should all be able to do that (though doing recursive containers can be kind of weird). In theory https://github.com/firecracker-microvm/firecracker should as well, it runs very lightweight VMs.

kind (kubernetes inside docker) does this by building a specialized container that includes and uses systemd as the entrypoint:

https://github.com/kubernetes-sigs/kind/blob/main/images/bas...

You could run this as a standalone container

      docker run --rm -d --name my-node --volume=/lib/modules:/lib/modules:ro --volume=/var --volume=/kind  --privileged docker.io/kindest/node:v1.25.3

then exec in and use it like a vm. it comes with containerd installed and running but you could also install docker

      docker exec -it my-node bash

Proxmox allows you to launch LXC containers via a UI. I use it at home and I'm able to run Docker in both a privileged LXC and an unprivileged LXC.

LXC/LXD are probably the closest to that on Linux, although I'm not sure about nesting containers.

It works. Used it just 1 hour ago last time.

lxc launch ubuntu:22.04 docktest -c security.nest

More on https://bobcares.com/blog/lxd-and-docker-containers-nesting/

"these “system” containers should be able to run containers inside them as well (docker in docker?)."

I think you can run podman in podman. But your comment actually makes me wonder how easy it would be to run docker/podman in chroot

One more vote for LXD/LXC. Very neat and quick

Reply on news.ycombinator.com