Debian systemd-nspawn server - Revision history

T1t0 at 23:02, 23 September 2025

2025-09-23T23:02:16Z

← Older revision		Revision as of 23:02, 23 September 2025
Line 20:		Line 20:

	export BASE_PATH=/srv		export BASE_PATH=/srv
	export DEST_DIR=~~DEBIAN_buster_amd64~~		export DEST_DIR=DEBIAN_bookworm_amd64
	export CONTAINER_NAME=DEBIANGUEST # note, no dashes or hyphens allowed in the container name,		export CONTAINER_NAME=DEBIANGUEST # note, no dashes or hyphens allowed in the container name,

Line 26:		Line 26:
	systemctl enable machines.target		systemctl enable machines.target

	# Create a ~~new boot systemd service~~		# Create a link of your root folder in the machinectl container folder
	~~systemctl enable systemd~~-~~nspawn@~~${CONTAINER_NAME}~~.service~~		ln -s ${BASE_PATH}/${DEST_DIR} /var/lib/machines/${CONTAINER_NAME}

	# Customize the container startup		# Enable the new machine to boot at host startup
			machinectl enable debian ${CONTAINER_NAME}

			# Customize the container config startup
	# note, the first empty ExecStart= is required		# note, the first empty ExecStart= is required
	mkdir -p /etc/systemd/system/systemd-nspawn@~~${CONTAINER_NAME}~~.service.d/		mkdir -p /etc/systemd/system/systemd-nspawn@debian.service.d/
	cat > /etc/systemd/system/systemd-nspawn@~~${CONTAINER_NAME}~~.service.d/override.conf << EOF		cat > /etc/systemd/system/systemd-nspawn@debian.service.d/override.conf << EOF
	[Service]		[Service]
	ExecStart=		ExecStart=
	ExecStart=~~/usr/bin/~~systemd-nspawn --keep-unit --boot --link-journal=try-guest --~~directory~~=~~${BASE_PATH}~~/~~${DEST_DIR}~~ --machine ~~${CONTAINER_NAME}~~		ExecStart=systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest -U --bind-ro=/boot --bind-ro=/usr/lib/modules --settings=override --machine=%i
	EOF		EOF
			# note, make sure that mount folder exists
	~~systemctl daemon~~-~~reload~~		mkdir -p ${BASE_PATH}/${DEST_DIR}/boot ${BASE_PATH}/${DEST_DIR}/usr/lib/modules

	# start now		# start now
	~~systemctl~~ start ~~systemd-nspawn@~~${CONTAINER_NAME}~~.service~~		machinectl start ${CONTAINER_NAME}
	~~systemctl status systemd-nspawn@${CONTAINER_NAME}.service~~

	# enter		# enter

T1t0 at 09:15, 9 August 2023

2023-08-09T09:15:23Z

← Older revision		Revision as of 09:15, 9 August 2023
Line 171:		Line 171:
	[[Category:linux]]		[[Category:linux]]
	[[Category:debian]]		[[Category:debian]]
	[[Category:~~daemon~~]]		[[Category:service]]
			[[Category:container]]
	[[Category:systemd-nspawn]]		[[Category:systemd-nspawn]]
	~~[[Category:container]]~~
	[[Category:debootstrap]]		[[Category:debootstrap]]

T1t0 at 09:09, 9 August 2023

2023-08-09T09:09:27Z

← Older revision		Revision as of 09:09, 9 August 2023
Line 171:		Line 171:
	[[Category:linux]]		[[Category:linux]]
	[[Category:debian]]		[[Category:debian]]
			[[Category:daemon]]
	[[Category:systemd-nspawn]]		[[Category:systemd-nspawn]]
	[[Category:container]]		[[Category:container]]
	[[Category:debootstrap]]		[[Category:debootstrap]]

T1t0 at 06:29, 7 November 2020

2020-11-07T06:29:18Z

@@ Line 78: / Line 78: @@
 systemctl start iptables_SSHlimit.service
 systemctl status iptables_SSHlimit.service
 </pre>

T1t0: /* Add a custom services in the 'guest' system */

2020-11-07T06:15:45Z

Add a custom services in the 'guest' system

← Older revision		Revision as of 06:15, 7 November 2020
Line 64:		Line 64:

	[Service]		[Service]
			Type=simple
			RemainAfterExit=yes
	ExecStart=/etc/init.d/iptables_SSHlimit.sh start		ExecStart=/etc/init.d/iptables_SSHlimit.sh start
	ExecStop=/etc/init.d/iptables_SSHlimit.sh stop		ExecStop=/etc/init.d/iptables_SSHlimit.sh stop
Line 72:		Line 74:
	EOF		EOF

			systemctl daemon-reload
	systemctl enable iptables_SSHlimit.service		systemctl enable iptables_SSHlimit.service
	systemctl start iptables_SSHlimit.service		systemctl start iptables_SSHlimit.service

T1t0: Created page with "= Debian systemd-nspawn server = This page shows how to configure an independent 'guest' Debian server inside whatever gnu/linux host system running. The only requisite is th..."

2020-11-07T05:53:44Z

Created page with "= Debian systemd-nspawn server = This page shows how to configure an independent 'guest' Debian server inside whatever gnu/linux host system running. The only requisite is th..."

New page

= Debian systemd-nspawn server =

This page shows how to configure an independent 'guest' Debian server inside whatever gnu/linux host system running. The only requisite is that the host machine must run a gnu/linux with the same arch (for instance amd64) of the guest system.

Nowadays, a easy and well documented way to do such thing using an official Debian [https://www.docker.com/ docker] image and installing the docker daemon service in the host machine. However, a solution that provides a minor overhead for disk space and memory consumption is the use of the native systemd system. Such solution is the scope of this article. Note that a more crude solution is the use of the old good friend [https://en.wikipedia.org/wiki/Chroot chroot] command that still perform a good job but just for filesystem isolation. A tutorial using chroot is avaliable [http://www.campisano.org/wiki/en/Debian_chrooted_server here].

== Prerequisites ==

To start, we need to create a minimal Debian system root folder. This can be done following the [[debootstrap|Debootstrap]] tutorial that generates a Debian root folder compressed in a tar.gz file. In the same tutorial there are instruction to extract and configure the Debian system root folder in the host machine.

So, move the compressed tar.gz file in the host machine and configure it following the [[debootstrap|Debootstrap]] tutorial itself.

== Configure the 'guest' system to start at the 'host' bootstrap ==

Now we need to configure our host system to boot the Debian guest system at startup:

<pre>
########################################
#### Configure container to start at host bootstrap

export BASE_PATH=/srv
export DEST_DIR=DEBIAN_buster_amd64
export CONTAINER_NAME=DEBIANGUEST # note, no dashes or hyphens allowed in the container name,

# Enable the "machines" target so all of the containers we create are able to be started at boot via a service call. While the services may be started and enabled, if this target is not added the nspawn containers will not auto-boot.
systemctl enable machines.target

# Create a new boot systemd service
systemctl enable systemd-nspawn@${CONTAINER_NAME}.service

# Customize the container startup
# note, the first empty ExecStart= is required
mkdir -p /etc/systemd/system/systemd-nspawn@${CONTAINER_NAME}.service.d/
cat > /etc/systemd/system/systemd-nspawn@${CONTAINER_NAME}.service.d/override.conf << EOF
[Service]
ExecStart=
ExecStart=/usr/bin/systemd-nspawn --keep-unit --boot --link-journal=try-guest --directory=${BASE_PATH}/${DEST_DIR} --machine ${CONTAINER_NAME}
EOF

systemctl daemon-reload

# start now
systemctl start systemd-nspawn@${CONTAINER_NAME}.service
systemctl status systemd-nspawn@${CONTAINER_NAME}.service

# enter
machinectl list # to see the container name
machinectl login ${CONTAINER_NAME}
</pre>

== Add a custom services in the 'guest' system ==

* script to limit requests to sshd service [[script_iptables_SSHlimit.sh|iptables_SSHlimit.sh]]

Save it and put it to work!

<pre>
chmod 0750 iptables_SSHlimit.sh
mv iptables_SSHlimit.sh /etc/init.d

cat > /etc/systemd/system/iptables_SSHlimit.service << EOF
[Unit]
Description=Firewall rules to limit ssh incoming connections

[Service]
ExecStart=/etc/init.d/iptables_SSHlimit.sh start
ExecStop=/etc/init.d/iptables_SSHlimit.sh stop

[Install]
# Installs a hook to use this unit file when the system boots or shuts down
WantedBy=multi-user.target
EOF

systemctl enable iptables_SSHlimit.service
systemctl start iptables_SSHlimit.service
systemctl status iptables_SSHlimit.service
</pre>

== References ==

* https://wiki.debian.org/nspawn
* https://lwn.net/Articles/572957/
* https://wiki.archlinux.org/index.php/systemd-nspawn#Enable_container_on_boot
* https://cloudnull.io/2017/04/rocket-past-the-white-whale-and-spawn-a-container/

[[Category:unix]]
[[Category:linux]]
[[Category:debian]]
[[Category:systemd-nspawn]]
[[Category:container]]
[[Category:debootstrap]]