Docker, LXC, and systemd-nspawn for Build Environments

Updated

October 30, 2026

Docker, LXC, and systemd-nspawn for Build Environments

Compiling distribution packages directly on a personal workstation is dangerous: files installed during testing can overwrite system libraries, and leftover host build dependencies can inadvertently satisfy recipe requirements without being documented.

Modern distribution engineering mandates hermetic, disposable build environments.

+-----------------------------------------------------------+
|              Build Environment Isolation Spectrum         |
|                                                           |
| Tech               Isolation Level      Overhead  Ideal For|
| --------------------------------------------------------- |
| chroot             Basic mount split    Near-zero LFS Pass 2|
| systemd-nspawn     PID/Net/Mnt/IPC/UTS  Minimal   Arch / Void|
| Docker / Podman    Container runtime    Low       CI Runners|
| QEMU / KVM MicroVM Full Hardware Hyperv Moderate  Kernel QA |
+-----------------------------------------------------------+

systemd-nspawn: The Distro Maintainer’s Secret Weapon

While Docker is designed for long-running microservices, systemd-nspawn is engineered specifically for testing operating system filesystems and bootstrapping chroots:

  • Boots a full operating system container inside a target directory tree.
  • Automatically virtualizes the PID tree, Mount tree, IPC queues, and hostname.
  • Can mount the target rootfs completely ephemeral (--ephemeral / -x): any changes written during the build are discarded automatically when the container exits, leaving the clean base image untouched!

Using systemd-nspawn to Build a Package:

# 1. Bootstrap a clean base target directory using your distro tools:
# mkdir -p /var/lib/machines/byol-buildroot
# byol-pkg --root=/var/lib/machines/byol-buildroot install base-devel

# 2. Spawn an ephemeral, network-isolated container to build a recipe:
# systemd-nspawn \
    --directory=/var/lib/machines/byol-buildroot \
    --ephemeral \
    --bind=/home/builder/recipes/curl:/build \
    --user=builduser \
    --setenv=SOURCE_DATE_EPOCH=1730000000 \
    /bin/sh -c "cd /build && byol-pack"

When the command completes, your newly compiled .byol package is placed into /home/builder/recipes/curl, while the build root is restored to pristine condition in zero milliseconds via Btrfs/OverlayFS snapshots.

Docker and Podman in CI

On hosted continuous integration platforms (GitHub Actions, GitLab CI), rootless podman or docker provides containerized runners that compile individual packages in parallel matrix builds across cloud virtual machines.