Containers systemd-nspawn

From ALT Linux Wiki

Installation

The first step is to install the package indicated in the heading of the virtualization system: 

# apt-get update && apt-get install systemd-container -y

Second — you will need a minimal system image suitable for container-type virtual environments (LXC, Docker, etc.), which can be taken from the repository. At the time of writing, this one looked more attractive than the others.

Deploy a previously downloaded tarball into a container (let's say the first one is called spawn-1): 

# machinectl import-tar alt-p9-rootfs-systemd-x86_64.tar.xz spawn-1
 
Enqueued transfer job 1. Press C-c to continue download in background.
Importing '/var/lib/machines/alt-p9-rootfs-systemd-x86_64.tar.xz', saving as 'spawn-1'.
Imported 0%.
...
Imported 99%.
Operation completed successfully.
Exiting.

Or you can deploy directly from the Internet without downloading: 

# machinectl pull-tar http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.tar.xz spawn-1 --verify=no
 
Enqueued transfer job 1. Press C-c to continue download in background.
Pulling 'http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.tar.xz', saving as 'spawn-1'.
Downloading 169B for http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.nspawn.
HTTP request to http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.nspawn failed with code 404.
Settings file could not be retrieved, proceeding without.
Downloading 43.9M for http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.tar.xz.
Got 1% of http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.tar.xz.
...
Got 88% of http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.tar.xz. 604ms left at 8.4M/s.
Download of http://ftp.altlinux.ru/pub/distributions/ALTLinux/p9/images/cloud/alt-p9-rootfs-systemd-x86_64.tar.xz complete.
Created new local image 'spawn-1'.
Operation completed successfully.
Exiting.

Launch

Advice: If you need to set some additional parameters to the container, it makes sense to create a file /etc/systemd/nspawn/<name>.nspawn and add them there(see more man systemd.nspawn).


For example, for a container for the Hasher — content /etc/systemd/nspawn/spawn-1.nspawn: 

[Exec]
Capability = CAP_SYS_ADMIN

[Network]
VirtualEthernet = on

Let's start a new container, at the same time enabling it to run every time the computer boots: 

# systemctl enable --now systemd-nspawn@spawn-1
Created symlink /etc/systemd/system/machines.target.wants/systemd-nspawn@spawn-1.service → /lib/systemd/system/systemd-nspawn@.service.

Let's check if everything worked: 

# systemctl status systemd-nspawn@spawn-1
● systemd-nspawn@spawn-1.service - Container spawn-1
   Loaded: loaded (/lib/systemd/system/systemd-nspawn@.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2020-10-01 21:38:31 +08; 8s ago
     Docs: man:systemd-nspawn(1)
...

Works. Let's go local: 

# machinectl shell spawn-1
Connected to machine spawn-1. Press ^] three times within 1s to exit session.
[root@spawn-1 ~]#
Memo: To enter the container locally not only by machinectl shell <name>, but also by machinectl login <name>, you need to command inside the container: 
# sed -i 's|tty|pts/|' /etc/securetty


Network

Note: The following is up to you. By default, systemd-networkd configures ve interfaces via DHCP, see files /lib/systemd/network/80-container-host0.network, /lib/systemd/network/80-container-ve.network.


Note: Haven't tried doing it further with etcnet because I've been using systemd-networkd for a long time, which is the same in all modern distributions and integrates a lot of tools that you otherwise need to install.

Build a bridge from the host ve-<имя контейнера> in a file /etc/systemd/network/ve-spawn-1.network (choose the address and network at your discretion, as long as it does not intersect with those already available in the system): 

[Match]
Name = ve-spawn-1

[Network]
DHCPServer = yes
Address = 192.168.222.254/24
IPMasquerade = yes

And from the side of the container we will accept it on the interface host0 as a file /etc/systemd/network/host0.network: 

[Match]
Name = host0

[Network]
DHCP = ipv4

Restarting systemd-networkd first on the host, and then in the container, we will see on the host: 

# networkctl 
IDX LINK       TYPE     OPERATIONAL SETUP     
  1 lo         loopback carrier     unmanaged 
  2 lan        ether    routable    configured
  3 ve-spawn-1 ether    routable    configured

3 links listed.

# ip -o a s ve-spawn-1 | awk '!/inet6/{print $2,$4}'
ve-spawn-1 192.168.222.254/24

And in a container: 

[root@spawn-1 ~]# networkctl 
IDX LINK  TYPE     OPERATIONAL SETUP     
  1 lo    loopback carrier     unmanaged 
  2 host0 ether    routable    configured

2 links listed.

[root@spawn-1 ~]# ip -o a s host0 | awk '!/inet6/{print $2,$4}'
 host0 192.168.222.146/24
Advice: If everything worked, then it makes sense to configure the container via ssh, install the necessary packages and configure the required services.


Trouble Shooting

Виртуализация