Alexandre Fiori
Twenty-plus years in systems engineering and infrastructure.
Currently an engineering manager at Meta; sdme is a personal project,
built on weekends and evenings. Lifelong Linux user, occasional contributor
across the stack. Lives in London, UK.
Session
sdme is a single static binary that boots systemd-nspawn containers using
overlayfs copy-on-write layers, with OCI registry pulling and Kubernetes Pod
YAML support. No daemon, no runtime dependency beyond the systemd you already
run.
Why I built it. Every container runtime reinvents what systemd already
does well: process supervision, logging, cgroups, service ordering, socket
activation. sdme makes the opposite bet. systemd-nspawn already boots a full
system in isolation; overlayfs already gives it a cheap copy-on-write root. Put
a thin, daemonless CLI over the two and you get container workflows (clone,
import, pull, run) without a new runtime to install or a daemon to keep alive.
It began as a one-command clone of the running host, but the bet is bigger than
that: lean on the init system instead of rebuilding it.
What you get. Proper machine-like containers: each one runs a full systemd
init with journald, D-Bus, and systemctl, not a single foreground process.
Each container is highly configurable through native systemd surfaces, with
per-container resource limits, networking, and drop-in config. Clone your
running host into a throwaway container in one command; run a Docker Hub image
(nginx, redis, postgres) as a managed systemd service instead of a foreground
process; deploy a multi-container pod from Kubernetes Pod YAML with health
probes, secrets, and configmaps. A rootfs can also come from any distro, an OCI
registry, a tarball, or a QCOW2 image, and you can build your own from a
Dockerfile-like config.
How it works. One overlayfs mount (host / as the lower layer, a fresh
upper) and one systemd-nspawn invocation give you a fully booted system. The
binary does two jobs: it manages the overlayfs layering that makes each
container a cheap copy-on-write root, and it drives systemd over D-Bus to
start, stop, and supervise containers. Everything else (init, journald,
cgroups, service ordering) is systemd doing what it already does, with no
daemon in the middle.