A whirlwind tour of systemd-nspawn containers (2025)

45 points by ibobev 11 hours ago on hackernews | 7 comments

(2025)

Per the other blog post on docker. Docker Iptable bs has been annoying me for the last 48, hours. It actually makes no sense.

: binsquare | 8 hours ago
What are you trying to do?
Docker shares the host kernel + networking stack, so container traffic goes through the host's iptables. So if you're running into some weirdness because of that, happy to help if you can share your setup details.
disclosure: dealt with container weirdness for last 5 years, nothing to sell.

chasil | 9 hours ago

Eleven years ago, I wrote an introduction to nspawn from a busybox perspective.

https://www.linuxjournal.com/content/infinite-busybox-system...

I used that for a number of designs before my retirement.

The quality of my writing certainly did improve after that was finished.

ectoloph | 8 hours ago

I have been using systemd-nspawn recently through NixOS containers[1].

The combination feels quite powerful if you are in the ecosystem.

Though it is slightly ironic that I find Nix more approachable with the help of LLMs and then Nix has become one of the ways I manage the environments for the LLMs.

[1] https://wiki.nixos.org/wiki/NixOS_Containers

noopprod | 8 hours ago

I found a bug with nspawn that it can't bind mount while being in the mode which lets you delegate namespaces or whatever

Aka

If you have some kind of mount that matters like NVIDIA, you can't also create containers from containers.

So I just switched to LXC but I guess I should submit a slop PR as well. But yeah I guess Id just caution anyone who was going to use it lol

: tredre3 | 6 hours ago
Nspawn has a lot of issues with bind mounts in general. They've never been fixed because pottery doesn't see the point. See for example: https://github.com/systemd/systemd/issues/26897