I have been using systemd-nspawn recently through NixOS containers[1].
The combination feels quite powerful if you are in the ecosystem.
Though it is slightly ironic that I find Nix more approachable with the help of LLMs and then Nix has become one of the ways I manage the environments for the LLMs.
Docker shares the host kernel + networking stack, so container traffic goes through the host's iptables. So if you're running into some weirdness because of that, happy to help if you can share your setup details.
disclosure: dealt with container weirdness for last 5 years, nothing to sell.
I have been using systemd-nspawn recently through NixOS containers[1].
The combination feels quite powerful if you are in the ecosystem.
Though it is slightly ironic that I find Nix more approachable with the help of LLMs and then Nix has become one of the ways I manage the environments for the LLMs.
[1] https://wiki.nixos.org/wiki/NixOS_Containers
Eleven years ago, I wrote an introduction to nspawn from a busybox perspective.
https://www.linuxjournal.com/content/infinite-busybox-system...
I used that for a number of designs before my retirement.
The quality of my writing certainly did improve after that was finished.
I found a bug with nspawn that it can't bind mount while being in the mode which lets you delegate namespaces or whatever
Aka
If you have some kind of mount that matters like NVIDIA, you can't also create containers from containers.
So I just switched to LXC but I guess I should submit a slop PR as well. But yeah I guess Id just caution anyone who was going to use it lol
Nspawn has a lot of issues with bind mounts in general. They've never been fixed because pottery doesn't see the point. See for example: https://github.com/systemd/systemd/issues/26897
(2025)
Per the other blog post on docker. Docker Iptable bs has been annoying me for the last 48, hours. It actually makes no sense.
What are you trying to do?
Docker shares the host kernel + networking stack, so container traffic goes through the host's iptables. So if you're running into some weirdness because of that, happy to help if you can share your setup details.
disclosure: dealt with container weirdness for last 5 years, nothing to sell.