systemd & rsyslog in container

test.sh

if [[ -z "${DOCKER}" ]]; then
  cat > Dockerfile <<- EOM
    FROM debian:trixie
    WORKDIR /app
    RUN apt update -y --fix-missing && apt upgrade -y
    RUN apt install -y rsyslog build-essential libsystemd-dev systemd
    COPY test.sh .
    ENV DOCKER 1
    ENTRYPOINT ["bash", "test.sh"]
EOM
  podman build -t temp9823 .
  podman run -it --rm temp9823
  exit 0
fi

cat > jt.c <<- EOM
  #include <systemd/sd-journal.h>
  #include <stdio.h>
  #include <unistd.h>

  int main(int arcg, char** args) {
    char buffer [50];

    sprintf (buffer, "%lu", (unsigned long)getpid());
    printf("writing to journal\n");
    sd_journal_print(LOG_WARNING, "%s", "a little journal test message");
    sd_journal_send("MESSAGE=%s", "there should be a text", "SYSLOG_PID=%s", buffer, "PRIORITY=%i", LOG_ERR, "DOCUMENTATION=%s", "any doc link", "MESSAGE_ID=%s", "e5e4132e441541f89bca0cc3e7be3381", "MEAS_VAL=%d", 1394, NULL);

    return 0;
  }
EOM

cat > /etc/rsyslog.d/jt.conf <<- EOM
  module(load="imjournal")
  module(load="mmjsonparse")
  action(type="mmjsonparse")

  if \$programname == 'jt' and \$syslogseverity == 3 then
    action(type="omfile" file="/var/log/jt_err.log" template="RSYSLOG_DebugFormat")
EOM

# apparmor issues when run outside of container:
#   mcedit /etc/apparmor.d/usr.sbin.rsyslogd
#   apparmor_parser -r /etc/apparmor.d/usr.sbin.rsyslogd

gcc jt.c -lsystemd -o jt
/usr/lib/systemd/systemd-journald &
sleep 1
rsyslogd -dn &
sleep 2
./jt
sleep 1
journalctl --no-pager
cat /var/log/jt_err.log