+
+ <varlistentry>
+ <term><command>bind</command> <replaceable>NAME</replaceable> <replaceable>PATH</replaceable> [<replaceable>PATH</replaceable>]</term>
+
+ <listitem><para>Bind mounts a
+ directory from the host into the
+ specified container. The first
+ directory argument is the source
+ directory on the host, the second
+ directory argument the source
+ directory on the host. When the latter
+ is omitted the destination path in the
+ container is the same as the source
+ path on the host. When combined with
+ the <option>--read-only</option>
+ switch a ready-only bind mount is
+ created. When combined with the
+ <option>--mkdir</option> switch the
+ destination path is first created
+ before the mount is applied. Note that
+ this option is currently only
+ supported for
+ <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+ containers.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>copy-to</command> <replaceable>NAME</replaceable> <replaceable>PATH</replaceable> [<replaceable>PATH</replaceable>]</term>
+
+ <listitem><para>Copies files or
+ directories from the host system into
+ a running container. Takes a container
+ name, followed by the source path on
+ the host and the destination path in
+ the container. If the destination path
+ is omitted the same as the source path
+ is used.</para></listitem>
+ </varlistentry>
+
+
+ <varlistentry>
+ <term><command>copy-from</command> <replaceable>NAME</replaceable> <replaceable>PATH</replaceable> [<replaceable>PATH</replaceable>]</term>
+
+ <listitem><para>Copies files or
+ directories from a container into the
+ host system. Takes a container name,
+ followed by the source path in the
+ container the destination path on the
+ host. If the destination path is
+ omitted the same as the source path is
+ used.</para></listitem>
+ </varlistentry>
+ </variablelist></refsect2>
+
+ <refsect2><title>Image Commands</title><variablelist>
+
+ <varlistentry>
+ <term><command>list-images</command></term>
+
+ <listitem><para>Show a list of locally
+ installed container and VM
+ images. This enumerates all raw disk
+ images and container directories and
+ subvolumes in
+ <filename>/var/lib/machines/</filename> (and other search paths, see below). Use
+ <command>start</command> (see above)
+ to run a container off one of the
+ listed images. Note that by default
+ containers whose name begins with a
+ dot (<literal>.</literal>) are not
+ shown. To show these too, specify
+ <option>--all</option>. Note that a
+ special image <literal>.host</literal>
+ always implicitly exists and refers to
+ the image the host itself is booted
+ from.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>image-status</command> <replaceable>NAME</replaceable>...</term>
+
+ <listitem><para>Show terse status
+ information about one or more
+ container or VM images. This function
+ is intended to generate human-readable
+ output. Use
+ <command>show-image</command> (see
+ below) to generate computer-parsable
+ output instead.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>show-image</command> <replaceable>NAME</replaceable>...</term>
+
+ <listitem><para>Show properties of one
+ or more registered virtual machine or
+ container images, or the manager
+ itself. If no argument is specified,
+ properties of the manager will be
+ shown. If an NAME is specified,
+ properties of this virtual machine or
+ container image are shown. By default,
+ empty properties are suppressed. Use
+ <option>--all</option> to show those
+ too. To select specific properties to
+ show, use
+ <option>--property=</option>. This
+ command is intended to be used
+ whenever computer-parsable output is
+ required. Use
+ <command>image-status</command> if you
+ are looking for formatted
+ human-readable
+ output.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>clone</command> <replaceable>NAME</replaceable> <replaceable>NAME</replaceable></term>
+
+ <listitem><para>Clones a container or
+ disk image. The arguments specify the
+ name of the image to clone and the
+ name of the newly cloned image. Note
+ that plain directory container images
+ are cloned into subvolume images with
+ this command. Note that cloning a
+ container or VM image is optimized for
+ btrfs file systems, and might not be
+ efficient on others, due to file
+ system limitations.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>rename</command> <replaceable>NAME</replaceable> <replaceable>NAME</replaceable></term>
+
+ <listitem><para>Renames a container or
+ disk image. The arguments specify the
+ name of the image to rename and the
+ new name of the
+ image.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>read-only</command> <replaceable>NAME</replaceable> [<replaceable>BOOL</replaceable>]</term>
+
+ <listitem><para>Marks or (unmarks) a
+ container or disk image
+ read-only. Takes a VM or container
+ image name, followed by a boolean as
+ arguments. If the boolean is omitted,
+ positive is implied, i.e. the image is
+ marked read-only.</para></listitem>
+ </varlistentry>
+
+
+ <varlistentry>
+ <term><command>remove</command> <replaceable>NAME</replaceable>...</term>
+
+ <listitem><para>Removes one or more
+ container or disk images. The special
+ image <literal>.host</literal>, which
+ refers to the host's own directory
+ tree may not be
+ removed.</para></listitem>
+ </varlistentry>
+
+ </variablelist></refsect2>
+
+ <refsect2><title>Image Transfer Commands</title><variablelist>
+
+ <varlistentry>
+ <term><command>pull-tar</command> <replaceable>URL</replaceable> [<replaceable>NAME</replaceable>]</term>
+
+ <listitem><para>Downloads a
+ <filename>.tar</filename> container
+ image from the specified URL, and
+ makes it available under the specified
+ local machine name. The URL must be of
+ type <literal>http://</literal> or
+ <literal>https://</literal>, and must
+ refer to a <filename>.tar</filename>,
+ <filename>.tar.gz</filename>,
+ <filename>.tar.xz</filename> or
+ <filename>.tar.bz2</filename> archive
+ file. If the local machine name is
+ omitted the name it is automatically
+ derived from the last component of the
+ URL, with its suffix removed.</para>
+
+ <para>The image is verified before it
+ is made available, unless
+ <option>--verify=no</option> is
+ specified. Verification is done via
+ SHA256SUMS and SHA256SUMS.gpg files,
+ that need to be made available on the
+ same web server, under the same URL as
+ the <filename>.tar</filename> file,
+ but with the last component (the
+ filename) of the URL replaced. With
+ <option>--verify=checksum</option>
+ only the SHA256 checksum for the file
+ is verified, based on the
+ <filename>SHA256SUMS</filename>
+ file. With
+ <option>--verify=signature</option>
+ the SHA256SUMS file is first verified
+ with detached GPG signature file
+ <filename>SHA256SUMS.gpg</filename>. The
+ public key for this verification step
+ needs to be available in
+ <filename>/usr/lib/systemd/import-pubring.gpg</filename>
+ or
+ <filename>/etc/systemd/import-pubring.gpg</filename>.</para>
+
+ <para>The container image will be
+ downloaded and stored in a read-only
+ subvolume in
+ <filename>/var/lib/machines/</filename>,
+ that is named after the specified URL
+ and its HTTP etag. A writable snapshot
+ is then taken from this subvolume, and
+ named after the specified local
+ name. This behaviour ensures that
+ creating multiple container instances
+ of the same URL is efficient, as
+ multiple downloads are not
+ necessary. In order to create only the
+ read-only image, and avoid creating
+ its writable snapshot, specify
+ <literal>-</literal> as local machine
+ name.</para>
+
+ <para>Note that the read-only
+ subvolume is prefixed with
+ <filename>.tar-</filename>, and
+ is thus now shown by
+ <command>list-images</command>, unless
+ <option>--all</option> is passed.</para>
+
+ <para>Note that pressing C-c during
+ execution of this command will not
+ abort the download. Use
+ <command>cancel-transfer</command>,
+ described below.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>pull-raw</command> <replaceable>URL</replaceable> [<replaceable>NAME</replaceable>]</term>
+
+ <listitem><para>Downloads a
+ <filename>.raw</filename> container or
+ VM disk image from the specified URL,
+ and makes it available under the
+ specified local machine name. The URL
+ must be of type
+ <literal>http://</literal> or
+ <literal>https://</literal>. The
+ container image must either be a
+ <filename>.qcow2</filename> or raw
+ disk image, optionally compressed as
+ <filename>.gz</filename>,
+ <filename>.xz</filename>, or
+ <filename>.bz2</filename>. If the
+ local machine name is omitted the name
+ it is automatically derived from the
+ last component of the URL, with its
+ suffix removed.</para>
+
+ <para>Image verification is identical
+ for raw and tar images (see above).</para>
+
+ <para>If the the downloaded image is
+ in <filename>.qcow2</filename> format
+ it es converted into a raw image file
+ before it is made available.</para>
+
+ <para>Downloaded images of this type
+ will be placed as read-only
+ <filename>.raw</filename> file in
+ <filename>/var/lib/machines/</filename>. A
+ local, writable (reflinked) copy is
+ then made under the specified local
+ machine name. To omit creation of the
+ local, writable copy pass
+ <literal>-</literal> as local machine
+ name.</para>
+
+ <para>Similar to the behaviour of
+ <command>pull-tar</command>, the
+ read-only image is prefixed with
+ <filename>.raw-</filename>, and thus
+ now shown by
+ <command>list-images</command>, unless
+ <option>--all</option> is
+ passed.</para>
+
+ <para>Note that pressing C-c during
+ execution of this command will not
+ abort the download. Use
+ <command>cancel-transfer</command>,
+ described below.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>pull-dkr</command> <replaceable>REMOTE</replaceable> [<replaceable>NAME</replaceable>]</term>
+
+ <listitem><para>Downloads a
+ <literal>dkr</literal> container image
+ and makes it available locally. The
+ remote name refers to a
+ <literal>dkr</literal> container
+ name. If omitted, the local machine
+ name is derived from the
+ <literal>dkr</literal> container
+ name.</para>
+
+ <para>Image verification is not
+ available for <literal>dkr</literal>
+ containers, and thus
+ <option>--verify=no</option> must
+ always be specified with this
+ command.</para>
+
+ <para>This command downloads all
+ (missing) layers for the specified
+ container and places them in read-only
+ subvolumes in
+ <filename>/var/lib/machines/</filename>. A
+ writable snapshot of the newest layer
+ is then created under the specified
+ local machine name. To omit creation
+ of this writable snapshot, pass
+ <literal>-</literal> as local machine
+ name.</para>
+
+ <para>The read-only layer subvolumes
+ are prefixed with
+ <filename>.dkr-</filename>, and thus
+ now shown by
+ <command>list-images</command>, unless
+ <option>--all</option> is
+ passed.</para>
+
+ <para>To specify the
+ <literal>dkr</literal> index server to
+ use for looking up the specified
+ container, use
+ <option>--dkr-index-url=</option>.</para>
+
+ <para>Note that pressing C-c during
+ execution of this command will not
+ abort the download. Use
+ <command>cancel-transfer</command>,
+ described below.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>list-transfers</command></term>
+
+ <listitem><para>Shows a list of
+ container or VM image downloads that
+ are currently in
+ progress.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><command>cancel-transfers</command> <replaceable>ID</replaceable>...</term>
+
+ <listitem><para>Aborts download of the
+ container or VM image with the
+ specified ID. To list ongoing
+ transfers and their IDs, use
+ <command>list-transfers</command>.
+ </para></listitem>
+ </varlistentry>
+
+ </variablelist></refsect2>