[leephillips]

I’ve found systemd-nspawn useful. Use debootstrap to install a minimal Debian system inside your system, then boot it with this command. It isolates the filesystem while sharing the network interface, and is convenient for most things that I guess people use Docker for. I wonder why it’s not mentioned more often.

[dijit]

I know it sounds like I want to be spoonfed, but do you have a walkthrough of this flow?

I'd be interested in trying it out but I don't want to spend some hours reading documentation trying to get it working.

[leephillips]

Well, that’s OK, because it did take me a while to track down the pieces of the documentation and find a procedure that worked for me. There is some less-than-optimal advice out there about this.

Become root.

Install debootstrap, which is in the Debian and Ubuntu repositories, at least.

Make a directory to contain your embedded system. It can be anywhere. Let's use /var/lib/machine/machinename.

This command will install a new, minimal Debian system in that directory:

debootstrap --include=systemd-container stable /var/lib/machines/machinename http://deb.debian.org/debian

It will download everything and, if I recall correctly, works unattended (doesn’t ask questions).

Enter the container with

systemd-nspawn -D /var/lib/machines/machinename/

and set the root container password with passwd.

Then do

echo 'pts/0' >> /etc/securetty

so the guest OS will let you log in after it's booted up. You may have to add other pts/x entries. I'm not sure about this part; it may be that if there is no /etc/securetty file that there is no problem.

Now log out of the container.

To boot up the guest OS, use

systemd-nspawn -b -D /var/lib/machines/machinename

You will see the familiar console messages.

You will find advice on the web to include the -U flag here, which causes files in the guest OS to only use UIDs known to the guest OS when determining ownership and permissions. This leads to headaches, because you have to set the ownership of any file you copy in from the host system. Leave it out, and you can have parallel users on the host and guest OSs, which is more convenient. But you may have to change the UIDs of the users on the guest OS so that they match.

Now, on the host OS, you can use the `machinectl` command to control all your guest OSs. `machinectl list` shows you what’s running, `machinectl login` lets you log in to them, and there are several commands for killing them with various levels of violence.

If you want your machine to be a long-running service, just `nohup` the spawn command, and direct output as desired.

If you want to be able to communicate with your machine from the internet, opening sockets from within the guest OS works, as they share the network interface. For a public-facing web service, you can install (for example) Apache and pick a port number to listen on, then set up a reverse proxy on the host OS, using a dedicated domain or a subdomain, so the users don’t have to use the custom port number. I’ve found that certificates for HTTPS need to be installed on both the host and guest OSs.

Good luck!

More information: https://wiki.debian.org/nspawn