Post #1539621
2026-02-27 18:45 UTC
This is hooked up into nspawn via a new --private-users-delegate= switch to delegate N uid ranges into the nspawn container. With this we're very close to making nested nspawn work but this requires a few more changes to nspawn which will come in 261. I'm also hooking this up to mkosi so we can finally boot VMs and containers from directories unprivileged and without /etc/subuid. vmspawn also learned to boot from a directory using nsresourced in v260.
Replies (1)
-
@xogium@tech.lgbt 2026-02-27 20:03
@daandemeyer Wow that looks dead useful. Would that allow to run other container system like podman / docker in there long term? I'm asking because I wanted to run ci/cd for a git I'm hosting, but everything being hosted inside nspawn containers, well. Yikes, I guess. And I absolutely refuse to polute the host with a mess as horrible as docker. No way no how.