At work we maintain embedded-linux computers with a custom distro but the actual graphical interface is a separate artifact developed by another team. Moreover they have to use an SDK that only works on a specific distro (semi-closed source).

Our solution is shipping it with its own glibc and running the executable with the LD inside this separate glibc. Basically the entire userspace. It is almost like a container but the containerization is provided by systemd and there is scoped access to limited system services via mount and network namespaces.

We cannot use static programs. Our systems have limited memory so the GUI load relevant parts of the program as shared library plugins.

This is the only reliable way to distribute closed source / independently packaged Linux software. You ship it with an entire userspace. Docker and Flatpak are just that; an admittance that distributing independent software reliably on Linux is practically impossible.

▲

inigyou 6 hours ago | parent [-]

Have you considered running Docker on the embedded device?

▲

jasomill 4 hours ago | parent | next [-]

That sounds like a heavier-weight wrapper over the same system services they're using through systemd today.

It could be useful if updating is a pain point.

In this case, they may also consider Podman, as it has excellent systemd integration[1] including rudimentary container orchestration and the ability to auto-update containers and Kubernetes-style pods installed as systemd units. I've run Pihole under Fedora CoreOS this way for several years without touching a single thing to update the OS or Pihole.

[1] https://docs.podman.io/en/latest/markdown/podman-systemd.uni...

	▲	okanat 2 hours ago \| parent [-]
		See https://news.ycombinator.com/item?id=49275165 TL; DR you're right. We are aware options like Podman and systemd-nspawn (check it out if you don't know). They are just overkill.

▲

okanat 2 hours ago | parent | prev [-]

No we don't need / shouldn't use Docker. As jasomill guessed the disk size and memory usage that Docker needs is just unnecessary overhead. These devices have only 8 GiB disk space. systemd provides every single thing that we need; one can obtain equivalent isolation just with a systemd unit file.

If you don't need the layers of Docker and server pull-push, it is just overhead. We just fetch a single cryptographically signed squashfs file and execute the program in it with limited FS and separate namespaces.