Norm (ノーム) :CastoriceBlushing: (@norm)

Don't think I've seen much people actually use systemd-nspawn instead of docker/podman or an lxc based solution

@norm I like nspawn, it's nice
not using it in production yet, but working on it

@norm i like nspawn, and i would be actively using it in prod if my distro packaged it properly. i want to do rootless containers and had some unavoidable issues with Docker/Podman that didn't exist with nspawn, but nixos doesn't support rootless nspawn yet so currently, i use Podman instead. rootfully, of course.

@sodiboo @norm i use podman too

@sodiboo @norm imo rootless containers don't make much sense anyway, among other things because it's impossible to do sane networking without CAP_NET_ADMIN (or at least, not without the assistance of a privileged service, which podman lacks)
rootless container runtimes force you into either host networking (no isolation at all) or limited solutions (pasta/slirp4netns, which make containers impossible to address externally)
the important part is correctly dropping privileges inside of the container, and that's a nightmare with OCI

I personally purged podman from my systems because its defaults are highly insecure (doesn't use userns by default!!! and turning it on alone isn't enough, because it defaults to the identity mapping for UIDs, so UID 0 in the container is whatever podman is running as, which is root in rootful mode), and the documentation—official or otherwise—is incredibly unclear so you have to divine the correct settings yourself
add to that the fact that I will not touch any pre-made OCI images anyway, and that it's way more effort to make my own than sticking nixos wholesale inside of a container, and I've lost interest entirely because the pain outweighs the non-existent benefits

@novenary @sodiboo really all I want is a VM but without the overhead of another kernel and just using the host disk caches instead of the guest running their own

@norm @sodiboo yeah and that's what nspawn gets you, but you can also have minimal images in your containers

@norm Those three are great, but they make too many assumptions for certain uses to be viable.

I use systemd-nspawn as a better substitute for chroot stuff that's practically a VM, which docker doesn't really work with. (For workloads that I'd normally put in a full VM, rather than a minimalistic docker container)

@becomethewaifu I've been using LXC for those sorts of workloads. What makes sytemd-nspawn better for that use case?

@norm In that case it's entirely because I learned about nspawn first. I barely even know LXC exists, so haven't tried to replace my existing stack with it.

I don't exactly like systemd, but given that it's what debian ships with, might as well use the features it offers... (It's also unironically the best DHCPv6-PD client I've used outside of "appliance OSes" like openwrt, since every other solution seems to involve brittle shell script 'glue' to delegate the assigned prefix to radvd, that aren't packaged by most distros I know, so you have to copy-paste-debug them from archwiki or similar)

@norm what youre referring to as linux, is in fact, the systemd operating system, or as ive recently taken to calling it, systemd/linux

@laru @norm systemd/linux is so much more accurate than gnu/linux

@novenary @laru especially with systemd now supporting musl