X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=c95a7c0e9a5148600a1adf3e0a2340190b142a42;hb=49888ca9ef9cac69bfc9b6e30e4f8e3376dcae03;hp=e55933d069d9b341dacf4ba8e48370e701cb18c0;hpb=04ac799283f517672a5424e7c5bf066cfa4ca020;p=elogind.git

diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index e55933d06..c95a7c0e9 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -123,10 +123,10 @@
                 see each other. The PID namespace separation of the
                 two containers is complete and the containers will
                 share very few runtime objects except for the
-                underlying file system. It is however possible to
-                enter an existing container, see
-                <link linkend='example-nsenter'>Example 4</link> below.
-                </para>
+                underlying file system. Use
+                <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
+                <command>login</command> command to request an
+                additional login prompt in a running container.</para>
 
                 <para><command>systemd-nspawn</command> implements the
                 <ulink
@@ -151,7 +151,7 @@
                 containers. We hence recommend turning it off entirely
                 by booting with <literal>audit=0</literal> on the
                 kernel command line, or by turning it off at kernel
-                build time. If auditing is enabled in the kernel
+                build time. If auditing is enabled in the kernel,
                 operating systems booted in an nspawn container might
                 refuse log-in attempts.</para>
         </refsect1>
@@ -192,7 +192,7 @@
 
                                 <listitem><para>Directory to use as
                                 file system root for the namespace
-                                container. If omitted the current
+                                container. If omitted, the current
                                 directory will be
                                 used.</para></listitem>
                         </varlistentry>
@@ -233,7 +233,7 @@
                                 host, and is used to initialize the
                                 container's hostname (which the
                                 container can choose to override,
-                                however). If not specified the last
+                                however). If not specified, the last
                                 component of the root directory of the
                                 container is used.</para></listitem>
                         </varlistentry>
@@ -248,6 +248,27 @@
                                 </listitem>
                         </varlistentry>
 
+                        <varlistentry>
+                                <term><option>-L</option></term>
+                                <term><option>--apifs-label=</option></term>
+
+                                <listitem><para>Sets the mandatory
+                                access control (MAC/SELinux) file
+                                label to be used by virtual API file
+                                systems in the container.</para>
+                                </listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><option>-Z</option></term>
+                                <term><option>--process-label=</option></term>
+
+                                <listitem><para>Sets the mandatory
+                                access control (MAC/SELinux) label to be used by
+                                processes in the container.</para>
+                                </listitem>
+                        </varlistentry>
+
                         <varlistentry>
                                 <term><option>--uuid=</option></term>
 
@@ -303,12 +324,22 @@
                                 CAP_AUDIT_CONTROL.</para></listitem>
                         </varlistentry>
 
+                        <varlistentry>
+                                <term><option>--drop-capability=</option></term>
+
+                                <listitem><para>Specify one or more
+                                additional capabilities to drop for
+                                the container. This allows running the
+                                container with fewer capabilities than
+                                the default (see above).</para></listitem>
+                        </varlistentry>
+
                         <varlistentry>
                                 <term><option>--link-journal=</option></term>
 
                                 <listitem><para>Control whether the
                                 container's journal shall be made
-                                visible to the host system. If enabled
+                                visible to the host system. If enabled,
                                 allows viewing the container's journal
                                 files from the host (but not vice
                                 versa). Takes one of
@@ -334,7 +365,7 @@
                                 <filename>/var/log/journal</filename>
                                 exists, it will be bind mounted
                                 into the container. If the
-                                subdirectory doesn't exist, no
+                                subdirectory does not exist, no
                                 linking is performed. Effectively,
                                 booting a container once with
                                 <literal>guest</literal> or
@@ -370,6 +401,33 @@
                                 creates read-only bind
                                 mount.</para></listitem>
                         </varlistentry>
+
+                        <varlistentry>
+                                <term><option>--setenv=</option></term>
+
+                                <listitem><para>Specifies an
+                                environment variable assignment to
+                                pass to the init process in the
+                                container, in the format
+                                <literal>NAME=VALUE</literal>. This
+                                may be used to override the default
+                                variables or to set additional
+                                variables. This parameter may be used
+                                more than once.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><option>-q</option></term>
+                                <term><option>--quiet</option></term>
+
+                                <listitem><para>Turns off any status
+                                output by the tool itself. When this
+                                switch is used, then the only output
+                                by nspawn will be the console output
+                                of the container OS
+                                itself.</para></listitem>
+                        </varlistentry>
+
                 </variablelist>
 
         </refsect1>
@@ -409,22 +467,35 @@
                 boots an OS in a namespace container in it.</para>
         </refsect1>
 
-        <refsect1 id='example-nsenter'>
+        <refsect1>
                 <title>Example 4</title>
 
-                <para>To enter the container, PID of one of the
-                processes sharing the new namespaces must be used.
-                <command>systemd-nspawn</command> prints the PID
-                (as viewed from the outside) of the launched process,
-                and it can be used to enter the container.</para>
+                <programlisting># mv ~/arch-tree /var/lib/container/arch
+# systemctl enable systemd-nspawn@arch.service
+# systemctl start systemd-nspawn@arch.service</programlisting>
+
+                <para>This makes the Arch Linux container part of the
+                <filename>multi-user.target</filename> on the host.
+                </para>
+        </refsect1>
+
+        <refsect1>
+                <title>Example 5</title>
+
+                <programlisting># btrfs subvolume snapshot / /.tmp
+# systemd-nspawn --private-network -D /.tmp -b</programlisting>
+
+                <para>This runs a copy of the host system in a
+                btrfs snapshot.</para>
+        </refsect1>
+
+        <refsect1>
+                <title>Example 6</title>
 
-                <programlisting># nsenter -m -u -i -n -p -t $PID</programlisting>
+                <programlisting># chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh</programlisting>
 
-                <para><citerefentry><refentrytitle>nsenter</refentrytitle><manvolnum>1</manvolnum></citerefentry>
-                is part of
-                <ulink url="https://github.com/karelzak/util-linux">util-linux</ulink>.
-                Kernel support for entering namespaces was added in
-                Linux 3.8.</para>
+                <para>This runs a container with SELinux sandbox labels.</para>
         </refsect1>
 
         <refsect1>
@@ -439,11 +510,11 @@
                 <para>
                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-                        <citerefentry><refentrytitle>unshare</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-                        <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+                        <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+                        <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
                 </para>
         </refsect1>