Nspawn 3.0: A Docker-compatible Engine API for systemd-nspawn containers
Comments on “Nspawn 3.0: A Docker-compatible Engine API for systemd-nspawn containers”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Nspawn 3.0 adds a Docker Engine API on the host at /run/nspawn/api.sock, so the docker CLI and tools such as GitLab Runner's docker executor can manage systemd-nspawn machines. Access goes through polkit, and a user with org.nspawn.manage is effectively root. A machine mounting the socket read-write can now create and remove containers, where 2.0.0 was read-only. Image builds, pushes, tags and commits return 501, so docker build does not work. The supported API versions and the GitLab Runner setup are the author's claims and were not independently verified.
Why it ranked
No. 8 of 46 with a score of 0.65. The panel rated it highest on new information (0.91) and technical depth (0.91), lowest on audience breadth (0.48).
- AI judgeJudge 2claude-haiku-5-5
- Major release of a systemd-based container tool adding Docker-compatible API; detailed technical content and practical for infrastructure builders, though niche in audience and largely a release announcement.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, evidence-rich release of a Docker-compatible systemd-container API, with concrete compatibility, security, resource-limit, packaging, CI, and deployment details. It is highly actionable for infrastructure practitioners but primarily relevant to a sizable niche.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.65total under rubric v2.3
- Significance0.54
- Reader interest0.71
- Audience breadth0.48
- Practical relevance0.77
- Substantiated0.79
- Technical depth0.91
- New information0.91
- Counts against: Promotional0.08
- Counts against: Overclaim0.13
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.56 | 0.45 | 0.62 | 0.54 | 0.17 | +0.24 | +0.131 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.60 | 0.70 | 0.82 | 0.71 | 0.22 | +0.26 | +0.184 |
| Audience breadthHow many people who build technology does it concern? | 0.46 | 0.50 | 0.48 | 0.48 | 0.04 | +0.13 | +0.063 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.79 | 0.75 | 0.78 | 0.77 | 0.04 | +0.22 | +0.170 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.72 | 0.70 | 0.96 | 0.79 | 0.26 | +0.05 | +0.040 |
| Technical depthHow technically substantive is it? | 0.98 | 0.80 | 0.94 | 0.91 | 0.18 | +0.05 | +0.045 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.90 | 0.90 | 0.93 | 0.91 | 0.03 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.15 | 0.04 | 0.08 | 0.11 | −0.19 | −0.016 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.16 | 0.20 | 0.03 | 0.13 | 0.17 | −0.11 | −0.014 |
| Sum of contributions | +0.648 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.647 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-09/8/"><img src="https://rubric.hrih.si/badge/2026-11-09/8.svg" alt="Ranked #8 on Rubric, 9 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 4 matches source · 2 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceVersion
nspawn 3.0.0 serves a Docker Engine API with changes on the host, at /run/nspawn/api.sock opened by nspawn-api.socket.
The cited source says the same thing.
The article says “The host’s socket is /run/nspawn/api.sock, opened by nspawn-api.socket”
The source says “The host's socket of the Docker API**, `/run/nspawn/api.sock`, opened by `nspawn-api.socket`, which the packages ship turned off”
Source cited by the article: github.com/nspawn/nspawn/blob/3.0.0/docs/releases/3.0.0.md
Couldn’t checkVersion
nspawn's API answers in the shapes of Docker API 1.51 and of the versions down to 1.24 that clients ask for.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “It answers in the shapes of API 1.51, and of the versions down to 1.24 that clients ask for”
The source says No passage could be compared.
Source cited by the article: github.com/nspawn/nspawn/blob/3.0.0/docs/releases/3.0.0.md
No source givenVersion
Version 2.3.1 provides packages on apt.nspawn.org for Debian 13+ and Ubuntu 24.04+ and on rpm.nspawn.org for Fedora 44+.
The article gives no link or citation for it.
The article says “2.3.1: packages on apt.nspawn.org (Debian 13+, Ubuntu 24.04+) and rpm.nspawn.org (Fedora 44”
The source says No source to compare with.
No source givenGeneralization
GitLab Runner's docker executor can run its jobs on nspawn's machines through the API by pointing its host setting at the socket.
The article gives no link or citation for it.
The article says “GitLab Runner’s docker executor runs its jobs on nspawn’s machines through the API”
The source says No source to compare with.
Matches sourceVersion
In 3.0.0, a machine mounting the Docker or nspawn API socket read-write can create, start, exec in and remove containers, whereas in 2.0.0 the socket inside a machine was read-only.
The cited source says the same thing.
The article says “In 2.0.0 the socket inside a machine was read-only. Now a machine that mounts /var/run/docker.sock, /run/docker.sock or /run/nspawn/api.sock read-write can create, start, exec in and remove containers”
The source says “A machine that mounts `/var/run/docker.sock`, `/run/docker.sock` or `/run/nspawn/api.sock` from the host read-write”
Source cited by the article: github.com/nspawn/nspawn/blob/3.0.0/docs/releases/3.0.0.md
Matches sourceCausal conclusion
journald kept its default rate limit of 10000 lines in 30 seconds because the unit's LogRateLimitIntervalSec=0 never reached journald.
The cited source says the same thing.
The article says “The unit’s LogRateLimitIntervalSec=0 never reached journald, which kept its default of 10000 lines in 30 seconds”
The source says “The unit's `LogRateLimitIntervalSec=0` never reached journald, which kept its defaults (10000 lines in 30 seconds”
Source cited by the article: github.com/nspawn/nspawn/blob/3.0.0/docs/releases/3.0.0.md
Matches sourceNumber
Image builds, loads, imports, tags, pushes and commits, container renames and exports, swarm and plugins answer 501 'not supported' in the API.
The cited source says the same thing.
The article says “Image builds, loads, imports, tags, pushes and commits, container renames and exports, swarm and plugins answer 501 “not supported”
The source says “Image builds, loads, imports, tags, pushes and commits, container renames and exports, swarm and plugins are not served by the API: they answer 501 with "not supported”
Source cited by the article: github.com/nspawn/nspawn/blob/3.0.0/docs/releases/3.0.0.md
Couldn’t checkVersion
nspawn 3.1.0 adds --device-cgroup-rule, and 3.2.0 makes machine and image names read the same way in every command.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “3.1.0 adds --device-cgroup-rule, for devices that come and go while the machine runs”
The source says No passage could be compared.
Source cited by the article: github.com/nspawn/nspawn/releases/tag/3.2.0
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 9 Nov 2026, 05:46 UTC. It played no part in the ranking.