Run a systemd unit in a specified network namespace

Question

I would like to instruct systemd to 'run a unit' in a specified, pre-existing network namespace, in particular to start the unit's process(es) in the namespace.

Solution 1

Looks like it's now possible to do this in systemd 242 via the NetworkNamespacePath option: announcement.

Check out the docs for use it here.

Solution 2

systemd is not fully compatible with network namespace as the issues https://github.com/systemd/systemd/issues/2741, may add some other key words like ExecStart to add network namespace switch into namespace before running service.

Comments

[Michael Hampton]

You can do this very easily with JoinsNamespaceOf= if systemd created the namespace for the other process.

[A__A__0]

Yeah I spotted that, but systemd did not create the namespace. (There is no other process involved). Is the approach to create a unit to encapsulate the creation of the namespace, and then refer to that unit name in JoinsNamespaceOf?

[Michael Hampton]

You're probably at the level of complexity where you should just start using containers via some existing technology, rather than trying to roll them yourself.

[A__A__0]

I see. Unfortunately I'm simply trying to do this to debug a problem. I will start the process outside of systemd for the purpose of debugging.