Nspawn 3.0: A Docker-compatible Engine API for systemd-nspawn containers

Nspawn 3.0 introduces a Docker-compatible Engine API for systemd-nspawn containers. The 2.0.0 release offered a read-only Docker API to machines mounting docker's socket, sufficient for tools like Traefik or Dozzle. Nspawn 3.0 extends this API to the host, allowing Docker-compatible tools to manage containers through systemd-nspawn's machines.

The host's socket is now /run/nspawn/api.sock, accessible via the nspawn-api.socket. This API provides compatibility, enabling tools that manage containers through the Docker API to use nspawn's machines instead. The packages ship the socket turned off by default, activating it upon connection with the DOCKER_HOST variable. The API server acts as a client of the bus service, with methods under the org.nspawn namespace for inspections, logs, and changes.

User permissions for the API are straightforward, with root having full access and other users requiring polkit rules. The API maintains a bounded connection limit, preventing any single user from monopolizing resources. Clients connecting to the API can find it in the same shape as Docker API 1.51 and earlier versions. GitLab Runner's docker executor can run jobs on nspawn's machines through this API, with the host pointing to the socket.

Users can now mount the API socket read-write, enabling creation, starting, executing, removing, pulling, and deleting containers, images, and volumes. The socket can be mounted as read-only (:/var/run/docker.sock:ro) for clients only needing to read, similar to the Traefik example provided in the 2.0 release post.