systemd-nspawn-ssh-guest-debian-guide

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #typescript #llm #go #golang #android #machine-learning #rust #deep-learning #linux

systemd-nspawn-ssh-guest-debian-guide

★ 9 Open GitHub ↗

guide for a basic systemd-nspawn use case

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Topic
Basically, just a guide for a systemd-nspawn use case: how to create a debian 9 systemd-nspawn container with ssh daemon  (guest) , on a debian 9 (host). Some steps. Tested on Debian 9 aka Stretch.

# Step 1 
Get the package for systemd-nspawn container on the host
```
# apt-get update
# apt-get install systemd-container
```
# Step 2
Enable systemd-networkd on the host
```
# systemctl enable --now systemd-networkd systemd-resolved
```
Share the resolv.conf (or not)
```
# ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf 
```
# Step 3
Create a basic image with debootstrap on the host
```
# cd /var/lib/machines
# debootstrap --include=ssh,locales,dbus,net-tools --components=main,contrib,non-free --arch amd64 stretch stretch.debootstrap http://ftp.de.debian.org/debian
```
# Step 4
Backup the primary image on the host (or not :) )
```
# tar --numeric-owner -jcvf stretch.debootstrap.tar.bz2 stretch.debootstrap
# mv stretch.debootstrap.tar.bz2 /var/tmp
```

# Step 5
Prepare your container on the host
```
# mv stretch.debootstrap stretch.container001
```
# Step 6
Set the root password of the container from the host
```
# systemd-nspawn --machine stretch.container001 
Spawning container stretch.container001 on /var/lib/machines/stretch.container001.
Press ^] three times within 1s to kill container.
root@stretch:~# passwd
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
root@stretch:~# logout
Container stretch.container001 exited successfully.
```
# Interlude 1
At this moment, the hostname of your guest is "stretch"
And if you take a look, 'ip addr show' shows your usual interfaces

# Step 7
Start your container on the host
```
# machinectl start stretch.container001 
```

# Interlude 2
'ip addr show' shows another one interface, probably something like "ve-stretch.con@ifXX" and 'networkctl status' shows 3 IP on this interface (class A,B,C).

# Step 8
Enable systemd-networkd on the guest (host alrealdy done upper) and prepare your ssh first user
```
# machinectl login stretch.container001 
Connected to machine stretch.container001. Press ^] three times within 1s to exit session.

Debian GNU/Linux 9 <HOST-HOSTNAME> pts/0

xxxxx login: root
Password: 
Linux xxxx 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@<HOST-HOSTNAME>:~# systemctl enable --now  systemd-resolved
Created symlink /etc/systemd/system/multi-user.target.wants/systemd-resolved.service → /lib/systemd/system/systemd-resolved.service.
root@<HOST-HOSTNAME>:~# systemctl enable --now systemd-networkd
root@<HOST-HOSTNAME>:~# adduser guest
Adding user `guest' ...
Adding new group `guest' (1000) ...
Adding new user `guest' (1000) with group `guest' ...
Creating home directory `/home/guest' ...
Copying files from `/etc/skel' ...
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully
Changing the user information for guest
Enter the new value, or press ENTER for the default
	Full Name []: Guest
	Room Number []: 001
	Work Phone []: 001
	Home Phone []: 001
	Other []: 
Is the information correct? [Y/n] Y

root@<HOST-HOSTNAME>:~# logout
*Now you can Press ^] three times within 1s to exit session.
```

# Step 9
Connect from host to guest with ssh
```
# ssh guest@stretch.container001
The authenticity of host 'stretch.container001 (xxxxxxxxxxxxxxxxxxxxxx%ve-stretch.con)' can't be established.
ECDSA key fingerprint is SHA256:xxxxxxxxxxxxxxxxxxxxxxxx
Are you sure you want to continue connecting (yes/no)?
guest@stretch.container001's password: 
Linux xxxxx 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
guest@<HOST-HOSTNAME>:~$ exit
logout
Connection to stretch.container001 closed.
```

# Interlude 3
Take a look at nspawn process (host side)
```
# ps auxwww | grep nspawn
root     30302  0.0  0.1  52864  4460 ?        Ss   23:05   0:00 /usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=stretch.container001
```
Or at machinectl
```
#  machinectl --all
MACHINE              CLASS     SERVICE        OS     VERSION ADDRESSES
.host                host      -              debian 9       192.168.1.39...
stretch.container001 container systemd-nspawn debian 9       10.0.0.10...

2 machines listed.

```
Take a look at 'networkctl status --all' (host side and guest side) :
- host side, IP are gateway IP
- guest side, IP is container IP (and the gateway looks ok)

# Furthermore
## Automatically start containers at host startup
```
# systemctl enable machines.target
# systemctl enable systemd-nspawn@stretch.container001.service
Created symlink /etc/systemd/system/machines.target.wants/systemd-nspawn@stretch.container001.service → /lib/systemd/system/systemd-nspawn@.service.
```
## Prevent conflict on hostname 
To avoid 'Hostname conflict, changing published hostname from 'xxxx to 'xxxx3'.Stop the guest then:
```
echo container001 > /var/lib/machines/stretch.container001/etc/hostname
```
Then startup again

## Access to guest in ssh by the host from any device of the host's network (basic way : disabling private networking to use host networking)

Configure guest ssh port to 2222
```
root@container001:~# sed -i.bak 's/^#Port 22/#Port 22\nPort 2222/' /etc/ssh/sshd_config   
```
Change default configuration of the container to use same network as host by overriding inital configuration the the container (you can do this with systemctl edit systemd-nspawn@stretch.container001.service  too) 
```
# mkdir /etc/systemd/system/systemd-nspawn@stretch.container001.service.d
# echo  -e "[Service]\nExecStart=\n\nExecStart=/usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --machine=%I" > /etc/systemd/system/systemd-nspawn@stretch.container001.service.d/override.conf
# systemctl daemon-reload
```
Restart the container
```
# machinectl stop stretch.container001 
# machinectl start stretch.container001
```
Then check from another device of the host's network
```
$ ssh -p 2222 guest@<HOST-IP>
```

systemd-nspawn-ssh-guest-debian-guide

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README