systemd-nspawn 容器技术详解教程发布

一篇关于 systemd-nspawn 容器技术的详细使用指南于 2025 年 5 月 19 日发布 1。该教程介绍了 systemd-nspawn 作为轻量级 Linux 命名空间容器技术的特点，其使用可写根文件系统的方式更接近虚拟机的运行模式 1。教程涵盖了从创建 chroot、多个 Linux 发行版安装、容器启动、网络配置、文件挂载到 GPU 共享等多个配置与使用方面的内容 1。

容器镜像大小差异明显：Debian 容器为 338MB，Fedora 容器为 507MB，而 Alpine 容器仅需 16MB 1。systemd-nspawn 的基础命令参数包括用 -D 指定根文件系统目录、用 -M 指定机器名、用 --private-users=pick 启用 UID/GID 隔离、用 --private-users-ownership=chown 改变根文件系统所有权 1。隔离环境中的 UID 范围从 524288 到 18789826563 之间的 2 的 16 次方倍数开始分配，每次分配 65536 个 UID 和 GID 1。

通过 machinectl 命令可以管理容器的生命周期，包括 start 启动、login 登录、shell 获取直接 shell、enable 设置开机启动、stop 停止、disable 禁用开机启动等操作 1。教程还提供了资源限制的配置示例：CPU 限制中 CPUQuota=200% 表示允许两个完整核心 1；内存和 I/O 限制则可分别通过 MemoryMax=1G、MemorySwapMax=512M、IOReadBandwidthMax=100M、IOWriteBandwidthMax=100M 等参数设置 1。该教程新增了更安全的 Alpine 容器创建说明 1。

A comprehensive technical guide to systemd-nspawn containers has been published, offering detailed instructions for leveraging this lightweight Linux namespace containerization technology 1. The guide presents systemd-nspawn as an alternative to Docker, emphasizing its use of writable root filesystems in a manner more akin to virtual machines 1.

The tutorial covers container creation across multiple Linux distributions, with documented image sizes of 16M for Alpine, 338M for Debian, and 507M for Fedora 1. Key configuration parameters are detailed, including the -D flag for specifying the rootfs directory, -M for machine naming, --private-users=pick for enabling UID/GID isolation, and --private-users-ownership=chown for modifying rootfs ownership 1. User namespace allocation begins from multiples of 2^16 within the range of 524,288 to 18,789,826,563, assigning 65,536 UIDs and GIDs per container 1.

The guide explains essential machinectl commands for container management, including start for launching containers, login for interactive access, shell for direct command execution, and enable/disable for configuring boot-time startup 1. Resource constraints are addressed through practical examples: CPU quotas such as CPUQuota=200% to allocate two full processor cores, and memory controls including MemoryMax=1G, MemorySwapMax=512M, IOReadBandwidthMax=100M, and IOWriteBandwidthMax=100M 1. The material was updated on May 19, 2025, to include more secure Alpine container creation procedures 1.