Have you considered running Docker on the embedded device?

jasomill 4 hours ago | parent | next [-]

That sounds like a heavier-weight wrapper over the same system services they're using through systemd today.

It could be useful if updating is a pain point.

In this case, they may also consider Podman, as it has excellent systemd integration[1] including rudimentary container orchestration and the ability to auto-update containers and Kubernetes-style pods installed as systemd units. I've run Pihole under Fedora CoreOS this way for several years without touching a single thing to update the OS or Pihole.

[1] https://docs.podman.io/en/latest/markdown/podman-systemd.uni...

	▲	okanat 2 hours ago \| parent [-]
		See https://news.ycombinator.com/item?id=49275165 TL; DR you're right. We are aware options like Podman and systemd-nspawn (check it out if you don't know). They are just overkill.

▲

okanat 2 hours ago | parent | prev [-]

No we don't need / shouldn't use Docker. As jasomill guessed the disk size and memory usage that Docker needs is just unnecessary overhead. These devices have only 8 GiB disk space. systemd provides every single thing that we need; one can obtain equivalent isolation just with a systemd unit file.

If you don't need the layers of Docker and server pull-push, it is just overhead. We just fetch a single cryptographically signed squashfs file and execute the program in it with limited FS and separate namespaces.