Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It’s not. You you can use systemd-nspawn to create a container that uses your own root filesystem by specifying --directory=/ --volatile=yes. This mounts a tmpfs into the container’s root, and then mounts your /usr into the container’s /usr in read–only mode. This allows the container to run all the software installed on your machine, while redirecting writes to the tmpfs.

Alternatively, instead of --directory=/ you could specify some other directory that contains an OS image (such as --directory=/var/lib/machines/debian-bookworm or --directory=/var/lib/machines/fedora-38). Multiple containers can transparently share the same image, since all the writes go to a per–container tmpfs.

https://0pointer.net/blog/running-an-container-off-the-host-...



That's an interesting way to use systemd-nspawn!

But, if it mounts everything, wouldn't that also make container escapes very easy?


When it is volatile, it really only mounts the /usr inside the specified directory, rather than the directory itself. In particular, /dev and /etc will be empty.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: