X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=a4f222c3495a6a14d17a6df538bc9074bf17e65b;hb=79fbcd8869f5d2d0236f7272bf45ba6b3d4abbea;hp=47c3183eee1e3000fe2232026b720f572c44b108;hpb=eb91eb187b7491e05fb95215b77cb62061f41d08;p=elogind.git diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 47c3183ee..a4f222c34 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -21,7 +21,8 @@ along with systemd; If not, see . --> - + systemd-nspawn @@ -143,19 +144,6 @@ contain this file out-of-the-box. - - Incompatibility with Auditing - - Note that the kernel auditing subsystem is - currently broken when used together with - containers. We hence recommend turning it off entirely - by booting with audit=0 on the - kernel command line, or by turning it off at kernel - build time. If auditing is enabled in the kernel, - operating systems booted in an nspawn container might - refuse log-in attempts. - - Options @@ -171,21 +159,6 @@ The following options are understood: - - - - - Prints a short help - text and exits. - - - - - - Prints a version string - and exits. - - @@ -241,16 +214,125 @@ container is used. + + + + Set the specified UUID + for the container. The init system + will initialize + /etc/machine-id + from this if this file is not set yet. + + + Make the container part of the specified slice, instead - of the + of the default machine.slice. + + + + Disconnect networking + of the container from the host. This + makes all network interfaces + unavailable in the container, with the + exception of the loopback device and + those specified with + + and configured with + . If + this option is specified, the + CAP_NET_ADMIN capability will be added + to the set of capabilities the + container retains. The latter may be + disabled by using + . + + + + + + Assign the specified + network interface to the + container. This will remove the + specified interface from the calling + namespace and place it in the + container. When the container + terminates, it is moved back to the + host namespace. Note that + + implies + . This + option may be used more than once to + add multiple network interfaces to the + container. + + + + + + Create a + macvlan interface + of the specified Ethernet network + interface and add it to the + container. A + macvlan interface + is a virtual interface that adds a + second MAC address to an existing + physical Ethernet link. The interface + in the container will be named after + the interface on the host, prefixed + with mv-. Note that + + implies + . This + option may be used more than once to + add multiple network interfaces to the + container. + + + + + + Create a virtual + Ethernet link + (veth) between host + and container. The host side of the + Ethernet link will be available as a + network interface named after the + container's name (as specified with + ), prefixed + with ve-. The + container side of the the Ethernet + link will be named + host0. Note that + + implies + . + + + + + + Adds the host side of + the Ethernet link created with + to the + specified bridge. Note that + + implies + . If + this option is used the host side of + the Ethernet link will use the + vb- prefix instead + of ve-. + + @@ -272,35 +354,6 @@ - - - - Set the specified UUID - for the container. The init system - will initialize - /etc/machine-id - from this if this file is not set yet. - - - - - - - Turn off networking in - the container. This makes all network - interfaces unavailable in the - container, with the exception of the - loopback device. - - - - - - Mount the root file - system read-only for the - container. - - @@ -324,7 +377,13 @@ CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_SYS_RESOURCE, CAP_SYS_BOOT, CAP_AUDIT_WRITE, - CAP_AUDIT_CONTROL. + CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN + is retained if + is + specified. If the special value + all is passed, all + capabilities are + retained. @@ -385,6 +444,14 @@ . + + + + Mount the root file + system read-only for the + container. + + @@ -402,7 +469,7 @@ destination in the container. The option creates read-only bind - mount. + mounts. @@ -419,17 +486,6 @@ more than once. - - - - - Turns off any status - output by the tool itself. When this - switch is used, then the only output - by nspawn will be the console output - of the container OS itself. - - @@ -465,19 +521,75 @@ should be enabled when the container runs a full Operating System (more specifically: an init system), and is - useful to ensure the container is - accesible via + useful to ensure that the container is + accessible via machinectl1 and shown by tools such as ps1. If the container does not run an init - system it is recommended to set this + system, it is recommended to set this option to no. Note that implies . + + + + + Instead of creating a + transient scope unit to run the + container in, simply register the + service or scope unit + systemd-nspawn has + been invoked in with + systemd-machined8. This + has no effect if + is + used. This switch should be used if + systemd-nspawn is + invoked from within a service unit, + and the service unit's sole purpose + is to run a single + systemd-nspawn + container. This option is not + available if run from a user + session. + + + + + + Control the + architecture ("personality") reported + by + uname2 + in the container. Currently, only + x86 and + x86-64 are + supported. This is useful when running + a 32bit container on a 64bit + host. If this setting is not used + the personality reported in the + container is the same as the one + reported on the + host. + + + + + + + Turns off any status + output by the tool itself. When this + switch is used, the only output + from nspawn will be the console output + of the container OS itself. + + + +