diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index c780abf96a2..92c2462f6f2 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -1922,6 +1922,22 @@ After=sys-subsystem-net-devices-ens1.device
--pivot-root=/ostree/deploy/$OS/deploy/$CHECKSUM:/sysroot \
--bind=+/sysroot/ostree/deploy/$OS/var:/var
+
+
+ Run a container within a container
+
+ We're assuming that the outer container is in ./outer and
+ the inner container in ./outer/inner. The inner
+ systemd-nspawn will not be able to reach D-Bus, so we are passing flags to disable
+ some of its functionality.
+
+ # systemd-nspawn \
+ --directory outer --ephemeral --console interactive -- \
+ systemd-nspawn \
+ --directory inner --ephemeral --console interactive \
+ --register false --keep-unit --link-journal no -- \
+ echo OK
+
diff --git a/mkosi.conf b/mkosi.conf
index f2389b7f012..ee074c548cf 100644
--- a/mkosi.conf
+++ b/mkosi.conf
@@ -6,6 +6,7 @@ Dependencies=
exitrd
initrd
minimal-base
+ minimal-systemd
minimal-0
minimal-1
@@ -48,6 +49,7 @@ ExtraTrees=
%O/minimal-1.root-%a-verity.raw:/usr/share/minimal_1.verity
%O/minimal-1.root-%a-verity-sig.raw:/usr/share/minimal_1.verity.sig
%O/minimal-base:/usr/share/TEST-13-NSPAWN-container-template
+ %O/minimal-systemd:/usr/share/TEST-13-NSPAWN-container-systemd-template
%O/exitrd:/exitrd
Initrds=%O/initrd
diff --git a/mkosi.images/minimal-systemd/mkosi.conf b/mkosi.images/minimal-systemd/mkosi.conf
new file mode 100644
index 00000000000..dc82f0effee
--- /dev/null
+++ b/mkosi.images/minimal-systemd/mkosi.conf
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Config]
+Dependencies=minimal-base
+
+[Output]
+Format=directory
+
+[Content]
+BaseTrees=%O/minimal-base
+Bootable=no
+
+VolatilePackages=
+ systemd
+ systemd-boot
+ systemd-container
+ systemd-devel
+ systemd-journal-remote
+ systemd-libs
+ systemd-networkd
+ systemd-networkd-defaults
+ systemd-oomd-defaults
+ systemd-pam
+ systemd-resolved
+ systemd-tests
+ systemd-udev
+ systemd-ukify
diff --git a/test/TEST-13-NSPAWN/test.sh b/test/TEST-13-NSPAWN/test.sh
index b1d9fb6c53a..e00223e8e33 100755
--- a/test/TEST-13-NSPAWN/test.sh
+++ b/test/TEST-13-NSPAWN/test.sh
@@ -11,9 +11,8 @@ TEST_FORCE_NEWIMAGE=1
# shellcheck source=test/test-functions
. "${TEST_BASE_DIR:?}/test-functions"
-test_append_files() {
- local workspace="${1:?}"
- local container="$workspace/usr/share/TEST-13-NSPAWN-container-template"
+_install_base_container() {
+ local container="${1:?}"
# For virtual wlan interface.
instmods mac80211_hwsim
@@ -55,4 +54,14 @@ EOF
chmod +x "$container/sbin/init"
}
+test_append_files() {
+ local workspace="${1:?}"
+ local container="$workspace/usr/share/TEST-13-NSPAWN-container-template"
+ local container_systemd="$workspace/usr/share/TEST-13-NSPAWN-container-systemd-template"
+
+ _install_base_container "$container"
+ _install_base_container "$container_systemd"
+ initdir="$container_systemd" install_systemd
+}
+
do_test "$@"
diff --git a/test/units/TEST-13-NSPAWN.nspawn.sh b/test/units/TEST-13-NSPAWN.nspawn.sh
index ae6088a00eb..5f1752da405 100755
--- a/test/units/TEST-13-NSPAWN.nspawn.sh
+++ b/test/units/TEST-13-NSPAWN.nspawn.sh
@@ -1214,4 +1214,21 @@ testcase_unpriv_fuse() {
bash -c 'cat <>/dev/fuse' 2>&1)" == *'cat: -: Operation not permitted' ]]
}
+testcase_nested_nspawn() {
+ local root
+ root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.nested_nspawn.XXX)"
+ create_dummy_container "$root" /usr/share/TEST-13-NSPAWN-container-systemd-template
+ mkdir "$root/inner"
+ create_dummy_container "$root/inner"
+
+ systemd-nspawn \
+ --directory="$root" --ephemeral --pipe -- \
+ systemd-nspawn \
+ --directory=/inner --ephemeral --pipe \
+ --register=false --keep-unit --link-journal=no -- \
+ echo OK
+
+ rm -fr "$root"
+}
+
run_testcases
diff --git a/test/units/util.sh b/test/units/util.sh
index 51e0ad1ec0e..21c8dfafe70 100755
--- a/test/units/util.sh
+++ b/test/units/util.sh
@@ -175,14 +175,15 @@ coverage_create_nspawn_dropin() {
create_dummy_container() {
local root="${1:?}"
+ local source="${2:-/usr/share/TEST-13-NSPAWN-container-template}"
- if [[ ! -d /usr/share/TEST-13-NSPAWN-container-template ]]; then
+ if [[ ! -d "$source" ]]; then
echo >&2 "Missing container template, probably not running in TEST-13-NSPAWN?"
exit 1
fi
mkdir -p "$root"
- cp -a /usr/share/TEST-13-NSPAWN-container-template/* "$root"
+ cp -a "$source"/* "$root"
coverage_create_nspawn_dropin "$root"
}