man/systemd-nspawn.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2010 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="systemd-nspawn">
  25
  26         <refentryinfo>
  27                 <title>systemd-nspawn</title>
  28                 <productname>systemd</productname>
  29
  30                 <authorgroup>
  31                         <author>
  32                                 <contrib>Developer</contrib>
  33                                 <firstname>Lennart</firstname>
  34                                 <surname>Poettering</surname>
  35                                 <email>lennart@poettering.net</email>
  36                         </author>
  37                 </authorgroup>
  38         </refentryinfo>
  39
  40         <refmeta>
  41                 <refentrytitle>systemd-nspawn</refentrytitle>
  42                 <manvolnum>1</manvolnum>
  43         </refmeta>
  44
  45         <refnamediv>
  46                 <refname>systemd-nspawn</refname>
  47                 <refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
  48         </refnamediv>
  49
  50         <refsynopsisdiv>
  51                 <cmdsynopsis>
  52                         <command>systemd-nspawn</command>
  53                         <arg choice="opt" rep="repeat">OPTIONS</arg>
  54                         <arg choice="opt"><replaceable>COMMAND</replaceable>
  55                         <arg choice="opt" rep="repeat">ARGS</arg>
  56                         </arg>
  57                 </cmdsynopsis>
  58                 <cmdsynopsis>
  59                         <command>systemd-nspawn</command>
  60                         <arg choice="plain">-b</arg>
  61                         <arg choice="opt" rep="repeat">OPTIONS</arg>
  62                         <arg choice="opt" rep="repeat">ARGS</arg>
  63                 </cmdsynopsis>
  64         </refsynopsisdiv>
  65
  66         <refsect1>
  67                 <title>Description</title>
  68
  69                 <para><command>systemd-nspawn</command> may be used to
  70                 run a command or OS in a light-weight namespace
  71                 container. In many ways it is similar to
  72                 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
  73                 but more powerful since it fully virtualizes the file
  74                 system hierarchy, as well as the process tree, the
  75                 various IPC subsystems and the host and domain
  76                 name.</para>
  77
  78                 <para><command>systemd-nspawn</command> limits access
  79                 to various kernel interfaces in the container to
  80                 read-only, such as <filename>/sys</filename>,
  81                 <filename>/proc/sys</filename> or
  82                 <filename>/sys/fs/selinux</filename>. Network
  83                 interfaces and the system clock may not be changed
  84                 from within the container. Device nodes may not be
  85                 created. The host system cannot be rebooted and kernel
  86                 modules may not be loaded from within the
  87                 container.</para>
  88
  89                 <para>Note that even though these security precautions
  90                 are taken <command>systemd-nspawn</command> is not
  91                 suitable for secure container setups. Many of the
  92                 security features may be circumvented and are hence
  93                 primarily useful to avoid accidental changes to the
  94                 host system from the container. The intended use of
  95                 this program is debugging and testing as well as
  96                 building of packages, distributions and software
  97                 involved with boot and systems management.</para>
  98
  99                 <para>In contrast to
 100                 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry> <command>systemd-nspawn</command>
 101                 may be used to boot full Linux-based operating systems
 102                 in a container.</para>
 103
 104                 <para>Use a tool like
 105                 <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 106                 <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 107                 or
 108                 <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 109                 to set up an OS directory tree suitable as file system
 110                 hierarchy for <command>systemd-nspawn</command>
 111                 containers.</para>
 112
 113                 <para>Note that <command>systemd-nspawn</command> will
 114                 mount file systems private to the container to
 115                 <filename>/dev</filename>,
 116                 <filename>/run</filename> and similar. These will
 117                 not be visible outside of the container, and their
 118                 contents will be lost when the container exits.</para>
 119
 120                 <para>Note that running two
 121                 <command>systemd-nspawn</command> containers from the
 122                 same directory tree will not make processes in them
 123                 see each other. The PID namespace separation of the
 124                 two containers is complete and the containers will
 125                 share very few runtime objects except for the
 126                 underlying file system. Use
 127                 <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
 128                 <command>login</command> command to request an
 129                 additional login prompt in a running container.</para>
 130
 131                 <para><command>systemd-nspawn</command> implements the
 132                 <ulink
 133                 url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
 134                 Interface</ulink> specification.</para>
 135
 136                 <para>As a safety check
 137                 <command>systemd-nspawn</command> will verify the
 138                 existence of <filename>/etc/os-release</filename> in
 139                 the container tree before starting the container (see
 140                 <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>). It
 141                 might be necessary to add this file to the container
 142                 tree manually if the OS of the container is too old to
 143                 contain this file out-of-the-box.</para>
 144         </refsect1>
 145
 146         <refsect1>
 147                 <title>Options</title>
 148
 149                 <para>If option <option>-b</option> is specified, the
 150                 arguments are used as arguments for the init
 151                 binary. Otherwise, <replaceable>COMMAND</replaceable>
 152                 specifies the program to launch in the container, and
 153                 the remaining arguments are used as arguments for this
 154                 program. If <option>-b</option> is not used and no
 155                 arguments are specifed, a shell is launched in the
 156                 container.</para>
 157
 158                 <para>The following options are understood:</para>
 159
 160                 <variablelist>
 161                         <varlistentry>
 162                                 <term><option>-h</option></term>
 163                                 <term><option>--help</option></term>
 164
 165                                 <listitem><para>Prints a short help
 166                                 text and exits.</para></listitem>
 167                         </varlistentry>
 168
 169                         <varlistentry>
 170                                 <term><option>--version</option></term>
 171
 172                                 <listitem><para>Prints a version string
 173                                 and exits.</para></listitem>
 174                         </varlistentry>
 175
 176                         <varlistentry>
 177                                 <term><option>-q</option></term>
 178                                 <term><option>--quiet</option></term>
 179
 180                                 <listitem><para>Turns off any status
 181                                 output by the tool itself. When this
 182                                 switch is used, the only output
 183                                 from nspawn will be the console output
 184                                 of the container OS itself.</para></listitem>
 185                         </varlistentry>
 186
 187                         <varlistentry>
 188                                 <term><option>-D</option></term>
 189                                 <term><option>--directory=</option></term>
 190
 191                                 <listitem><para>Directory to use as
 192                                 file system root for the namespace
 193                                 container. If omitted, the current
 194                                 directory will be
 195                                 used.</para></listitem>
 196                         </varlistentry>
 197
 198                         <varlistentry>
 199                                 <term><option>-b</option></term>
 200                                 <term><option>--boot</option></term>
 201
 202                                 <listitem><para>Automatically search
 203                                 for an init binary and invoke it
 204                                 instead of a shell or a user supplied
 205                                 program. If this option is used,
 206                                 arguments specified on the command
 207                                 line are used as arguments for the
 208                                 init binary. This option may not be
 209                                 combined with
 210                                 <option>--share-system</option>.
 211                                 </para></listitem>
 212                         </varlistentry>
 213
 214                         <varlistentry>
 215                                 <term><option>-u</option></term>
 216                                 <term><option>--user=</option></term>
 217
 218                                 <listitem><para>Run the command
 219                                 under specified user, create home
 220                                 directory and cd into it. As rest
 221                                 of systemd-nspawn, this is not
 222                                 the security feature and limits
 223                                 against accidental changes only.
 224                                 </para></listitem>
 225                         </varlistentry>
 226
 227                         <varlistentry>
 228                                 <term><option>-M</option></term>
 229                                 <term><option>--machine=</option></term>
 230
 231                                 <listitem><para>Sets the machine name
 232                                 for this container. This name may be
 233                                 used to identify this container on the
 234                                 host, and is used to initialize the
 235                                 container's hostname (which the
 236                                 container can choose to override,
 237                                 however). If not specified, the last
 238                                 component of the root directory of the
 239                                 container is used.</para></listitem>
 240                         </varlistentry>
 241
 242                         <varlistentry>
 243                                 <term><option>--uuid=</option></term>
 244
 245                                 <listitem><para>Set the specified UUID
 246                                 for the container. The init system
 247                                 will initialize
 248                                 <filename>/etc/machine-id</filename>
 249                                 from this if this file is not set yet.
 250                                 </para></listitem>
 251                         </varlistentry>
 252
 253                         <varlistentry>
 254                                 <term><option>--slice=</option></term>
 255
 256                                 <listitem><para>Make the container
 257                                 part of the specified slice, instead
 258                                 of the default
 259                                 <filename>machine.slice</filename>.</para>
 260                                 </listitem>
 261                         </varlistentry>
 262
 263                         <varlistentry>
 264                                 <term><option>--private-network</option></term>
 265
 266                                 <listitem><para>Disconnect networking
 267                                 of the container from the host. This
 268                                 makes all network interfaces
 269                                 unavailable in the container, with the
 270                                 exception of the loopback device and
 271                                 those specified with
 272                                 <option>--network-interface=</option>
 273                                 and configured with
 274                                 <option>--network-veth</option>. If
 275                                 this option is specified, the
 276                                 CAP_NET_ADMIN capability will be added
 277                                 to the set of capabilities the
 278                                 container retains. The latter may be
 279                                 disabled by using
 280                                 <option>--drop-capability=</option>.</para></listitem>
 281                         </varlistentry>
 282
 283                         <varlistentry>
 284                                 <term><option>--network-interface=</option></term>
 285
 286                                 <listitem><para>Assign the specified
 287                                 network interface to the
 288                                 container. This will move the
 289                                 specified interface from the calling
 290                                 namespace and place it in the
 291                                 container. When the container
 292                                 terminates, it is moved back to the
 293                                 host namespace. Note that
 294                                 <option>--network-interface=</option>
 295                                 implies
 296                                 <option>--private-network</option>. This
 297                                 option may be used more than once to
 298                                 add multiple network interfaces to the
 299                                 container.</para></listitem>
 300                         </varlistentry>
 301
 302                         <varlistentry>
 303                                 <term><option>--network-veth</option></term>
 304
 305                                 <listitem><para>Create a virtual
 306                                 Ethernet link between host and
 307                                 container. The host side of the
 308                                 Ethernet link will be available as a
 309                                 network interface named after the
 310                                 container's name (as specified with
 311                                 <option>--machine=</option>), prefixed
 312                                 with <literal>ve-</literal>. The
 313                                 container side of the the Ethernet
 314                                 link will be named
 315                                 <literal>host0</literal>. Note that
 316                                 <option>--network-veth</option>
 317                                 implies
 318                                 <option>--private-network</option>.</para></listitem>
 319                         </varlistentry>
 320
 321                         <varlistentry>
 322                                 <term><option>--network-bridge=</option></term>
 323
 324                                 <listitem><para>Adds the host side of
 325                                 the Ethernet link created with
 326                                 <option>--network-veth</option> to the
 327                                 specified bridge. Note that
 328                                 <option>--network-bridge=</option>
 329                                 implies
 330                                 <option>--network-veth</option>. If
 331                                 this option is used the host side of
 332                                 the Ethernet link will use the
 333                                 <literal>vb-</literal> prefix instead
 334                                 of <literal>ve-</literal>.</para></listitem>
 335                         </varlistentry>
 336
 337                         <varlistentry>
 338                                 <term><option>-Z</option></term>
 339                                 <term><option>--selinux-context=</option></term>
 340
 341                                 <listitem><para>Sets the SELinux
 342                                 security context to be used to label
 343                                 processes in the container.</para>
 344                                 </listitem>
 345                         </varlistentry>
 346
 347                         <varlistentry>
 348                                 <term><option>-L</option></term>
 349                                 <term><option>--selinux-apifs-context=</option></term>
 350
 351                                 <listitem><para>Sets the SELinux security
 352                                 context to be used to label files in
 353                                 the virtual API file systems in the
 354                                 container.</para>
 355                                 </listitem>
 356                         </varlistentry>
 357
 358                         <varlistentry>
 359                                 <term><option>--capability=</option></term>
 360
 361                                 <listitem><para>List one or more
 362                                 additional capabilities to grant the
 363                                 container. Takes a comma-separated
 364                                 list of capability names, see
 365                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 366                                 for more information. Note that the
 367                                 following capabilities will be granted
 368                                 in any way: CAP_CHOWN,
 369                                 CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
 370                                 CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
 371                                 CAP_KILL, CAP_LEASE,
 372                                 CAP_LINUX_IMMUTABLE,
 373                                 CAP_NET_BIND_SERVICE,
 374                                 CAP_NET_BROADCAST, CAP_NET_RAW,
 375                                 CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
 376                                 CAP_SETUID, CAP_SYS_ADMIN,
 377                                 CAP_SYS_CHROOT, CAP_SYS_NICE,
 378                                 CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
 379                                 CAP_SYS_RESOURCE, CAP_SYS_BOOT,
 380                                 CAP_AUDIT_WRITE,
 381                                 CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN
 382                                 is retained if
 383                                 <option>--private-network</option> is
 384                                 specified. If the special value
 385                                 <literal>all</literal> is passed, all
 386                                 capabilities are
 387                                 retained.</para></listitem>
 388                         </varlistentry>
 389
 390                         <varlistentry>
 391                                 <term><option>--drop-capability=</option></term>
 392
 393                                 <listitem><para>Specify one or more
 394                                 additional capabilities to drop for
 395                                 the container. This allows running the
 396                                 container with fewer capabilities than
 397                                 the default (see above).</para></listitem>
 398                         </varlistentry>
 399
 400                         <varlistentry>
 401                                 <term><option>--link-journal=</option></term>
 402
 403                                 <listitem><para>Control whether the
 404                                 container's journal shall be made
 405                                 visible to the host system. If enabled,
 406                                 allows viewing the container's journal
 407                                 files from the host (but not vice
 408                                 versa). Takes one of
 409                                 <literal>no</literal>,
 410                                 <literal>host</literal>,
 411                                 <literal>guest</literal>,
 412                                 <literal>auto</literal>. If
 413                                 <literal>no</literal>, the journal is
 414                                 not linked. If <literal>host</literal>,
 415                                 the journal files are stored on the
 416                                 host file system (beneath
 417                                 <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
 418                                 and the subdirectory is bind-mounted
 419                                 into the container at the same
 420                                 location. If <literal>guest</literal>,
 421                                 the journal files are stored on the
 422                                 guest file system (beneath
 423                                 <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
 424                                 and the subdirectory is symlinked into the host
 425                                 at the same location. If
 426                                 <literal>auto</literal> (the default),
 427                                 and the right subdirectory of
 428                                 <filename>/var/log/journal</filename>
 429                                 exists, it will be bind mounted
 430                                 into the container. If the
 431                                 subdirectory does not exist, no
 432                                 linking is performed. Effectively,
 433                                 booting a container once with
 434                                 <literal>guest</literal> or
 435                                 <literal>host</literal> will link the
 436                                 journal persistently if further on
 437                                 the default of <literal>auto</literal>
 438                                 is used.</para></listitem>
 439                         </varlistentry>
 440
 441                         <varlistentry>
 442                                 <term><option>-j</option></term>
 443
 444                                 <listitem><para>Equivalent to
 445                                 <option>--link-journal=guest</option>.</para></listitem>
 446                         </varlistentry>
 447
 448                         <varlistentry>
 449                                 <term><option>--read-only</option></term>
 450
 451                                 <listitem><para>Mount the root file
 452                                 system read-only for the
 453                                 container.</para></listitem>
 454                         </varlistentry>
 455
 456                         <varlistentry>
 457                                 <term><option>--bind=</option></term>
 458                                 <term><option>--bind-ro=</option></term>
 459
 460                                 <listitem><para>Bind mount a file or
 461                                 directory from the host into the
 462                                 container. Either takes a path
 463                                 argument -- in which case the
 464                                 specified path will be mounted from
 465                                 the host to the same path in the
 466                                 container --, or a colon-separated
 467                                 pair of paths -- in which case the
 468                                 first specified path is the source in
 469                                 the host, and the second path is the
 470                                 destination in the container. The
 471                                 <option>--bind-ro=</option> option
 472                                 creates read-only bind
 473                                 mounts.</para></listitem>
 474                         </varlistentry>
 475
 476                         <varlistentry>
 477                                 <term><option>--setenv=</option></term>
 478
 479                                 <listitem><para>Specifies an
 480                                 environment variable assignment to
 481                                 pass to the init process in the
 482                                 container, in the format
 483                                 <literal>NAME=VALUE</literal>. This
 484                                 may be used to override the default
 485                                 variables or to set additional
 486                                 variables. This parameter may be used
 487                                 more than once.</para></listitem>
 488                         </varlistentry>
 489
 490                         <varlistentry>
 491                                 <term><option>--share-system</option></term>
 492
 493                                 <listitem><para>Allows the container
 494                                 to share certain system facilities
 495                                 with the host. More specifically, this
 496                                 turns off PID namespacing, UTS
 497                                 namespacing and IPC namespacing, and
 498                                 thus allows the guest to see and
 499                                 interact more easily with processes
 500                                 outside of the container. Note that
 501                                 using this option makes it impossible
 502                                 to start up a full Operating System in
 503                                 the container, as an init system
 504                                 cannot operate in this mode. It is
 505                                 only useful to run specific programs
 506                                 or applications this way, without
 507                                 involving an init system in the
 508                                 container. This option implies
 509                                 <option>--register=no</option>. This
 510                                 option may not be combined with
 511                                 <option>--boot</option>.</para></listitem>
 512                         </varlistentry>
 513
 514                         <varlistentry>
 515                                 <term><option>--register=</option></term>
 516
 517                                 <listitem><para>Controls whether the
 518                                 container is registered with
 519                                 <citerefentry><refentrytitle>systemd-machined</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Takes
 520                                 a boolean argument, defaults to
 521                                 <literal>yes</literal>. This option
 522                                 should be enabled when the container
 523                                 runs a full Operating System (more
 524                                 specifically: an init system), and is
 525                                 useful to ensure that the container is
 526                                 accessible via
 527                                 <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 528                                 and shown by tools such as
 529                                 <citerefentry><refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum></citerefentry>. If
 530                                 the container does not run an init
 531                                 system, it is recommended to set this
 532                                 option to <literal>no</literal>. Note
 533                                 that <option>--share-system</option>
 534                                 implies
 535                                 <option>--register=no</option>.
 536                                 </para></listitem>
 537                         </varlistentry>
 538
 539                         <varlistentry>
 540                                 <term><option>--keep-unit</option></term>
 541
 542                                 <listitem><para>Instead of creating a
 543                                 transient scope unit to run the
 544                                 container in, simply register the
 545                                 service or scope unit
 546                                 <command>systemd-nspawn</command> has
 547                                 been invoked in with
 548                                 <citerefentry><refentrytitle>systemd-machined</refentrytitle><manvolnum>8</manvolnum></citerefentry>. This
 549                                 has no effect if
 550                                 <option>--register=no</option> is
 551                                 used. This switch should be used if
 552                                 <command>systemd-nspawn</command> is
 553                                 invoked from within a service unit,
 554                                 and the service unit's sole purpose
 555                                 is to run a single
 556                                 <command>systemd-nspawn</command>
 557                                 container. This option is not
 558                                 available if run from a user
 559                                 session.</para></listitem>
 560                         </varlistentry>
 561
 562                         <varlistentry>
 563                                 <term><option>--personality=</option></term>
 564
 565                                 <listitem><para>Control the
 566                                 architecture ("personality") reported
 567                                 by
 568                                 <citerefentry><refentrytitle>uname</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 569                                 in the container. Currently, only
 570                                 <literal>x86</literal> and
 571                                 <literal>x86-64</literal> are
 572                                 supported. This is useful when running
 573                                 a 32bit container on a 64bit
 574                                 host. If this setting is not used
 575                                 the personality reported in the
 576                                 container is the same as the one
 577                                 reported on the
 578                                 host.</para></listitem>
 579                         </varlistentry>
 580                 </variablelist>
 581
 582         </refsect1>
 583
 584         <refsect1>
 585                 <title>Example 1</title>
 586
 587                 <programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
 588 # systemd-nspawn -bD /srv/mycontainer</programlisting>
 589
 590                 <para>This installs a minimal Fedora distribution into
 591                 the directory <filename noindex='true'>/srv/mycontainer/</filename> and
 592                 then boots an OS in a namespace container in
 593                 it.</para>
 594         </refsect1>
 595
 596         <refsect1>
 597                 <title>Example 2</title>
 598
 599                 <programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
 600 # systemd-nspawn -D ~/debian-tree/</programlisting>
 601
 602                 <para>This installs a minimal Debian unstable
 603                 distribution into the directory
 604                 <filename>~/debian-tree/</filename> and then spawns a
 605                 shell in a namespace container in it.</para>
 606         </refsect1>
 607
 608         <refsect1>
 609                 <title>Example 3</title>
 610
 611                 <programlisting># pacstrap -c -d ~/arch-tree/ base
 612 # systemd-nspawn -bD ~/arch-tree/</programlisting>
 613
 614                 <para>This installs a mimimal Arch Linux distribution into
 615                 the directory <filename>~/arch-tree/</filename> and then
 616                 boots an OS in a namespace container in it.</para>
 617         </refsect1>
 618
 619         <refsect1>
 620                 <title>Example 4</title>
 621
 622                 <programlisting># mv ~/arch-tree /var/lib/container/arch
 623 # systemctl enable systemd-nspawn@arch.service
 624 # systemctl start systemd-nspawn@arch.service</programlisting>
 625
 626                 <para>This makes the Arch Linux container part of the
 627                 <filename>multi-user.target</filename> on the host.
 628                 </para>
 629         </refsect1>
 630
 631         <refsect1>
 632                 <title>Example 5</title>
 633
 634                 <programlisting># btrfs subvolume snapshot / /.tmp
 635 # systemd-nspawn --private-network -D /.tmp -b</programlisting>
 636
 637                 <para>This runs a copy of the host system in a
 638                 btrfs snapshot.</para>
 639         </refsect1>
 640
 641         <refsect1>
 642                 <title>Example 6</title>
 643
 644                 <programlisting># chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
 645 # systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh</programlisting>
 646
 647                 <para>This runs a container with SELinux sandbox security contexts.</para>
 648         </refsect1>
 649
 650         <refsect1>
 651                 <title>Exit status</title>
 652
 653                 <para>The exit code of the program executed in the
 654                 container is returned.</para>
 655         </refsect1>
 656
 657         <refsect1>
 658                 <title>See Also</title>
 659                 <para>
 660                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 661                         <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 662                         <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 663                         <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 664                         <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 665                         <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 666                         <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 667                 </para>
 668         </refsect1>
 669
 670 </refentry>