Containers systemd-nspawn

From ALT Linux Wiki
Revision as of 14:03, 27 April 2022 by Mari (talk | contribs) (translation from ru page)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)


The first step is to install the package indicated in the heading of the virtualization system:

# apt-get update && apt-get install systemd-container -y

Second — you will need a minimal system image suitable for container-type virtual environments (LXC, Docker, etc.), which can be taken from the repository. At the time of writing, this one looked more attractive than the others.

Deploy a previously downloaded tarball into a container (let's say the first one is called spawn-1):

# machinectl import-tar alt-p9-rootfs-systemd-x86_64.tar.xz spawn-1
Enqueued transfer job 1. Press C-c to continue download in background.
Importing '/var/lib/machines/alt-p9-rootfs-systemd-x86_64.tar.xz', saving as 'spawn-1'.
Imported 0%.
Imported 99%.
Operation completed successfully.

Or you can deploy directly from the Internet without downloading:

# machinectl pull-tar spawn-1 --verify=no
Enqueued transfer job 1. Press C-c to continue download in background.
Pulling '', saving as 'spawn-1'.
Downloading 169B for
HTTP request to failed with code 404.
Settings file could not be retrieved, proceeding without.
Downloading 43.9M for
Got 1% of
Got 88% of 604ms left at 8.4M/s.
Download of complete.
Created new local image 'spawn-1'.
Operation completed successfully.


Advice: If you need to set some additional parameters to the container, it makes sense to create a file /etc/systemd/nspawn/<name>.nspawn and add them there(see more man systemd.nspawn).

For example, for a container for the Hasher — content /etc/systemd/nspawn/spawn-1.nspawn:

Capability = CAP_SYS_ADMIN

VirtualEthernet = on

Let's start a new container, at the same time enabling it to run every time the computer boots:

# systemctl enable --now systemd-nspawn@spawn-1
Created symlink /etc/systemd/system/ → /lib/systemd/system/systemd-nspawn@.service.

Let's check if everything worked:

# systemctl status systemd-nspawn@spawn-1
● systemd-nspawn@spawn-1.service - Container spawn-1
   Loaded: loaded (/lib/systemd/system/systemd-nspawn@.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2020-10-01 21:38:31 +08; 8s ago
     Docs: man:systemd-nspawn(1)

Works. Let's go local:

# machinectl shell spawn-1
Connected to machine spawn-1. Press ^] three times within 1s to exit session.
[root@spawn-1 ~]#
Memo: To enter the container locally not only by machinectl shell <name>, but also by machinectl login <name>, you need to command inside the container:
# sed -i 's|tty|pts/|' /etc/securetty


Note: The following is up to you. By default, systemd-networkd configures ve interfaces via DHCP, see files /lib/systemd/network/, /lib/systemd/network/

Note: Haven't tried doing it further with etcnet because I've been using systemd-networkd for a long time, which is the same in all modern distributions and integrates a lot of tools that you otherwise need to install.

Build a bridge from the host ve-<имя контейнера> in a file /etc/systemd/network/ (choose the address and network at your discretion, as long as it does not intersect with those already available in the system):

Name = ve-spawn-1

DHCPServer = yes
Address =
IPMasquerade = yes

And from the side of the container we will accept it on the interface host0 as a file /etc/systemd/network/

Name = host0

DHCP = ipv4

Restarting systemd-networkd first on the host, and then in the container, we will see on the host:

# networkctl 
  1 lo         loopback carrier     unmanaged 
  2 lan        ether    routable    configured
  3 ve-spawn-1 ether    routable    configured

3 links listed.

# ip -o a s ve-spawn-1 | awk '!/inet6/{print $2,$4}'

And in a container:

[root@spawn-1 ~]# networkctl 
  1 lo    loopback carrier     unmanaged 
  2 host0 ether    routable    configured

2 links listed.

[root@spawn-1 ~]# ip -o a s host0 | awk '!/inet6/{print $2,$4}'
Advice: If everything worked, then it makes sense to configure the container via ssh, install the necessary packages and configure the required services.

Trouble Shooting

Template:Category navigation