chiark / gitweb /
~ianmdlvl / elogind.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
man/shutdown: /etc/nologin is called /run/nologin now
[elogind.git] / man / systemd-nspawn.xml
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 66d2c6b69a749ed422c68456a16287f4c0ce3ecf..8adcd946b0438e6da634576eefc780a99ada068a 100644 (file)
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -49,7 +49,17 @@
 
         <refsynopsisdiv>
                 <cmdsynopsis>
 
         <refsynopsisdiv>
                 <cmdsynopsis>
-                        <command>systemd-nspawn <arg choice="opt" rep="repeat">OPTIONS</arg> <arg choice="opt">COMMAND</arg> <arg choice="opt" rep="repeat">ARGS</arg></command>
+                        <command>systemd-nspawn</command>
+                        <arg choice="opt" rep="repeat">OPTIONS</arg>
+                        <arg choice="opt"><replaceable>COMMAND</replaceable>
+                        <arg choice="opt" rep="repeat">ARGS</arg>
+                        </arg>
+                </cmdsynopsis>
+                <cmdsynopsis>
+                        <command>systemd-nspawn</command>
+                        <arg choice="plain">-b</arg>
+                        <arg choice="opt" rep="repeat">OPTIONS</arg>
+                        <arg choice="opt" rep="repeat">ARGS</arg>
                 </cmdsynopsis>
         </refsynopsisdiv>
 
                 </cmdsynopsis>
         </refsynopsisdiv>
 
@@ -93,9 +103,10 @@
                 container.</para>
 
                 <para>Use a tool like
                 container.</para>
 
                 <para>Use a tool like
-                <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-                or
+                <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                 <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                 <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+                or
+                <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                 to set up an OS directory tree suitable as file system
                 hierarchy for <command>systemd-nspawn</command>
                 containers.</para>
                 to set up an OS directory tree suitable as file system
                 hierarchy for <command>systemd-nspawn</command>
                 containers.</para>
@@ -113,7 +124,10 @@
                 see each other. The PID namespace separation of the
                 two containers is complete and the containers will
                 share very few runtime objects except for the
                 see each other. The PID namespace separation of the
                 two containers is complete and the containers will
                 share very few runtime objects except for the
-                underlying file system.</para>
+                underlying file system. It is however possible to
+                enter an existing container, see
+                <link linkend='example-nsenter'>Example 4</link> below.
+                </para>
 
                 <para><command>systemd-nspawn</command> implements the
                 <ulink
 
                 <para><command>systemd-nspawn</command> implements the
                 <ulink
@@ -124,23 +138,36 @@
         <refsect1>
                 <title>Options</title>
 
         <refsect1>
                 <title>Options</title>
 
-                <para>If no arguments are passed the container is set
-                up and a shell started in it, otherwise the passed
-                command and arguments are executed in it. The
-                following options are understood:</para>
+                <para>If option <option>-b</option> is specified, the
+                arguments are used as arguments for the init
+                binary. Otherwise, <replaceable>COMMAND</replaceable>
+                specifies the program to launch in the container, and
+                the remaining arguments are used as arguments for this
+                program. If <option>-b</option> is not used and no
+                arguments are specifed, a shell is launched in the
+                container.</para>
+
+                <para>The following options are understood:</para>
 
                 <variablelist>
                         <varlistentry>
 
                 <variablelist>
                         <varlistentry>
-                                <term><option>--help</option></term>
                                 <term><option>-h</option></term>
                                 <term><option>-h</option></term>
+                                <term><option>--help</option></term>
 
                                 <listitem><para>Prints a short help
                                 text and exits.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
 
                                 <listitem><para>Prints a short help
                                 text and exits.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
-                                <term><option>--directory=</option></term>
+                                <term><option>--version</option></term>
+
+                                <listitem><para>Prints a version string
+                                and exits.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
                                 <term><option>-D</option></term>
                                 <term><option>-D</option></term>
+                                <term><option>--directory=</option></term>
 
                                 <listitem><para>Directory to use as
                                 file system root for the namespace
 
                                 <listitem><para>Directory to use as
                                 file system root for the namespace
@@ -150,18 +177,21 @@
                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>
-                                <term><option>--boot</option></term>
                                 <term><option>-b</option></term>
                                 <term><option>-b</option></term>
+                                <term><option>--boot</option></term>
 
                                 <listitem><para>Automatically search
                                 for an init binary and invoke it
                                 instead of a shell or a user supplied
 
                                 <listitem><para>Automatically search
                                 for an init binary and invoke it
                                 instead of a shell or a user supplied
-                                program.</para></listitem>
+                                program. If this option is used, arguments
+                                specified on the command line are used
+                                as arguments for the init binary.
+                                </para></listitem>
                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>
-                                <term><option>--user=</option></term>
                                 <term><option>-u</option></term>
                                 <term><option>-u</option></term>
+                                <term><option>--user=</option></term>
 
                                 <listitem><para>Run the command
                                 under specified user, create home
 
                                 <listitem><para>Run the command
                                 under specified user, create home
@@ -184,8 +214,8 @@
                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>
-                                <term><option>--controllers=</option></term>
                                 <term><option>-C</option></term>
                                 <term><option>-C</option></term>
+                                <term><option>--controllers=</option></term>
 
                                 <listitem><para>Makes the container appear in
                                 other hierarchies than the name=systemd:/ one.
 
                                 <listitem><para>Makes the container appear in
                                 other hierarchies than the name=systemd:/ one.
@@ -220,8 +250,8 @@
                                 list of capability names, see
                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
                                 for more information. Note that the
                                 list of capability names, see
                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
                                 for more information. Note that the
-                                the following capabilities will be
-                                granted in any way: CAP_CHOWN,
+                                following capabilities will be granted
+                                in any way: CAP_CHOWN,
                                 CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
                                 CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
                                 CAP_KILL, CAP_LEASE,
                                 CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
                                 CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
                                 CAP_KILL, CAP_LEASE,
@@ -232,7 +262,9 @@
                                 CAP_SETUID, CAP_SYS_ADMIN,
                                 CAP_SYS_CHROOT, CAP_SYS_NICE,
                                 CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
                                 CAP_SETUID, CAP_SYS_ADMIN,
                                 CAP_SYS_CHROOT, CAP_SYS_NICE,
                                 CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
-                                CAP_SYS_RESOURCE, CAP_SYS_BOOT.</para></listitem>
+                                CAP_SYS_RESOURCE, CAP_SYS_BOOT,
+                                CAP_AUDIT_WRITE,
+                                CAP_AUDIT_CONTROL.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>
@@ -248,31 +280,30 @@
                                 <literal>host</literal>,
                                 <literal>guest</literal>,
                                 <literal>auto</literal>. If
                                 <literal>host</literal>,
                                 <literal>guest</literal>,
                                 <literal>auto</literal>. If
-                                <literal>no</literal> the journal is
-                                not linked. If <literal>host</literal>
+                                <literal>no</literal>, the journal is
+                                not linked. If <literal>host</literal>,
                                 the journal files are stored on the
                                 the journal files are stored on the
-                                host file system (beneath the host's
-                                <filename>/var/log/journal</filename>)
-                                and a per-machine subdirectory of this
-                                directory is created and bind mounted
+                                host file system (beneath
+                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
+                                and the subdirectory is bind-mounted
                                 into the container at the same
                                 into the container at the same
-                                location. If <literal>guest</literal>
+                                location. If <literal>guest</literal>,
                                 the journal files are stored on the
                                 the journal files are stored on the
-                                guest file system (beneath the guest's
-                                <filename>/var/log/journal</filename>)
-                                and a per-machine subdirectory of this
-                                directory is symlinked into the host
+                                guest file system (beneath
+                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
+                                and the subdirectory is symlinked into the host
                                 at the same location. If
                                 at the same location. If
-                                <literal>auto</literal> (the default)
-                                and the subdirectory of
+                                <literal>auto</literal> (the default),
+                                and the right subdirectory of
                                 <filename>/var/log/journal</filename>
                                 <filename>/var/log/journal</filename>
-                                exists as directory it is bind mounted
-                                into the container, but nothing is
-                                done otherwise. Effectively, booting a
-                                container once with
+                                exists, it will be bind mounted
+                                into the container. If the
+                                subdirectory doesn't exist, no
+                                linking is performed. Effectively,
+                                booting a container once with
                                 <literal>guest</literal> or
                                 <literal>host</literal> will link the
                                 <literal>guest</literal> or
                                 <literal>host</literal> will link the
-                                journal persistantly if further one
+                                journal persistently if further on
                                 the default of <literal>auto</literal>
                                 is used.</para></listitem>
                         </varlistentry>
                                 the default of <literal>auto</literal>
                                 is used.</para></listitem>
                         </varlistentry>
@@ -283,6 +314,26 @@
                                 <listitem><para>Equivalent to
                                 <option>--link-journal=guest</option>.</para></listitem>
                         </varlistentry>
                                 <listitem><para>Equivalent to
                                 <option>--link-journal=guest</option>.</para></listitem>
                         </varlistentry>
+
+                        <varlistentry>
+                                <term><option>--bind=</option></term>
+                                <term><option>--bind-ro=</option></term>
+
+                                <listitem><para>Bind mount a file or
+                                directory from the host into the
+                                container. Either takes a path
+                                argument -- in which case the
+                                specified path will be mounted from
+                                the host to the same path in the
+                                container --, or a colon-separated
+                                pair of paths -- in which case the
+                                first specified path is the source in
+                                the host, and the second path is the
+                                destination in the container. The
+                                <option>--bind-ro=</option> option
+                                creates read-only bind
+                                mount.</para></listitem>
+                        </varlistentry>
                 </variablelist>
 
         </refsect1>
                 </variablelist>
 
         </refsect1>
@@ -290,13 +341,13 @@
         <refsect1>
                 <title>Example 1</title>
 
         <refsect1>
                 <title>Example 1</title>
 
-                <programlisting># yum --releasever=17 --nogpgcheck --installroot ~/fedora-tree/ install yum passwd vim-minimal rootfiles systemd
-# systemd-nspawn -D ~/fedora-tree /usr/lib/systemd/systemd</programlisting>
+                <programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
+# systemd-nspawn -bD /srv/mycontainer</programlisting>
 
                 <para>This installs a minimal Fedora distribution into
 
                 <para>This installs a minimal Fedora distribution into
-                the directory <filename>~/fedora-tree/</filename>
-                and then boots an OS in a namespace container in it,
-                with systemd as init system.</para>
+                the directory <filename>/srv/mycontainer/</filename> and
+                then boots an OS in a namespace container in
+                it.</para>
         </refsect1>
 
         <refsect1>
         </refsect1>
 
         <refsect1>
@@ -309,7 +360,35 @@
                 distribution into the directory
                 <filename>~/debian-tree/</filename> and then spawns a
                 shell in a namespace container in it.</para>
                 distribution into the directory
                 <filename>~/debian-tree/</filename> and then spawns a
                 shell in a namespace container in it.</para>
+        </refsect1>
+
+        <refsect1>
+                <title>Example 3</title>
+
+                <programlisting># pacstrap -c -d ~/arch-tree/ base
+# systemd-nspawn -bD ~/arch-tree/</programlisting>
+
+                <para>This installs a mimimal Arch Linux distribution into
+                the directory <filename>~/arch-tree/</filename> and then
+                boots an OS in a namespace container in it.</para>
+        </refsect1>
+
+        <refsect1 id='example-nsenter'>
+                <title>Example 4</title>
+
+                <para>To enter the container, PID of one of the
+                processes sharing the new namespaces must be used.
+                <command>systemd-nspawn</command> prints the PID
+                (as viewed from the outside) of the launched process,
+                and it can be used to enter the container.</para>
+
+                <programlisting># nsenter -muinpt $PID</programlisting>
 
 
+                <para><citerefentry><refentrytitle>nsenter</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+                is part of
+                <ulink url="https://github.com/karelzak/util-linux">util-linux</ulink>.
+                Kernel support for entering namespaces was added in
+                Linux 3.8.</para>
         </refsect1>
 
         <refsect1>
         </refsect1>
 
         <refsect1>
@@ -324,8 +403,10 @@
                 <para>
                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                 <para>
                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+                        <citerefentry><refentrytitle>unshare</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                         <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
-                        <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+                        <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+                        <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                 </para>
         </refsect1>
 
                 </para>
         </refsect1>
 
Unnamed repository; edit this file 'description' to name the repository.