This seems to be almost exactly like systemd-nspawn other than the ability to write seccomp policies in kafel.
Are there any other notable differences?
Are there any other notable differences?
- ability to use config files (in nsjail in protobuf format)
- 3 operational modes: one of them allows to listen on a TCP port and run processes on-demand (inetd-style)
- support for cgroups (pid and mem limiting), here rlimits are not enough
- more expressive seccomp-bpf rules
systemd-nspawn supports ".nspawn" files (see --settings=true mode)
> socket activation
systemd can start up an nspawn thing in reaction to a systemd socket-activation request I think?
> cgroups
I guess for that you'd use 'systemd-run --scope -p MemoryLimit=10M -p CPUShares=100 -- systemd-nspawn ...'
> more expressive seccomp-bpf rules
Absolutely!