At Meta, we've been looking to revamp our internal container runtime (Twine). Instead of maintaining all the low level container runtime code ourselves, we'd much prefer having more of this managed by systemd. This talk will go over what we did to make systemd transient units a suitable environment for running system containers (pid namespace support, cgroup namespace support, namespace delegation, ...), and why we went this route instead of reusing systemd-nspawn.

Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/

about this event: https://cfp.all-systems-go.io/all-systems-go-2025/talk/BBTJSF/