X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=648a8cd19a3ea712bce210cae8c238edfb4b9765;hp=7a88436bcfd17ae61b5f619994e785b72b702884;hb=5f381b355a95b953654e46ba3ccdc81bdec165ea;hpb=aa28aefe61c5406c5cb631f3e82457b6d1bcc967 diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 7a88436bc..648a8cd19 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -21,7 +21,8 @@ along with systemd; If not, see . --> - + systemd-nspawn @@ -158,30 +159,44 @@ The following options are understood: - - - - - Prints a short help - text and exits. - - - - - - Prints a version string - and exits. - - Directory to use as - file system root for the namespace - container. If omitted, the current - directory will be - used. + file system root for the container. If + neither + nor are + specified, the current directory will + be used. May not be specified together with + . + + + + + + + Disk image to mount + the root directory for the container + from. Takes a path to a regular file + or to a block device node. The file or + block device must contain a GUID + Partition Table with a root partition + which is mounted as the root directory + of the container. Optionally, it may + contain a home and/or a server data + partition which are mounted to the + appropriate places in the + container. All these partitions must + be identified by the partition types + defined by the Discoverable + Partitions Specification. Any + other partitions, such as foreign + partitions, swap partitions or EFI + system partitions are not mounted. May + not be specified together with + . @@ -204,13 +219,15 @@ - Run the command - under specified user, create home - directory and cd into it. As rest - of systemd-nspawn, this is not - the security feature and limits - against accidental changes only. - + After transitioning + into the container, change to the + specified user defined in the + container's user database. Like all + other systemd-nspawn features, this is + not a security feature and provides + protection against accidental + destructive operations + only. @@ -228,77 +245,144 @@ container is used. + + + + Set the specified UUID + for the container. The init system + will initialize + /etc/machine-id + from this if this file is not set yet. + + + Make the container part of the specified slice, instead - of the + of the default machine.slice. - - + - Sets the SELinux - security context to be used to label - processes in the container. - + Disconnect networking + of the container from the host. This + makes all network interfaces + unavailable in the container, with the + exception of the loopback device and + those specified with + + and configured with + . If + this option is specified, the + CAP_NET_ADMIN capability will be added + to the set of capabilities the + container retains. The latter may be + disabled by using + . - - + - Sets the SELinux security - context to be used to label files in - the virtual API file systems in the - container. - + Assign the specified + network interface to the + container. This will remove the + specified interface from the calling + namespace and place it in the + container. When the container + terminates, it is moved back to the + host namespace. Note that + + implies + . This + option may be used more than once to + add multiple network interfaces to the + container. - + + + Create a + macvlan interface + of the specified Ethernet network + interface and add it to the + container. A + macvlan interface + is a virtual interface that adds a + second MAC address to an existing + physical Ethernet link. The interface + in the container will be named after + the interface on the host, prefixed + with mv-. Note that + + implies + . This + option may be used more than once to + add multiple network interfaces to the + container. + - Set the specified UUID - for the container. The init system - will initialize - /etc/machine-id - from this if this file is not set yet. - + + + + Create a virtual + Ethernet link + (veth) between host + and container. The host side of the + Ethernet link will be available as a + network interface named after the + container's name (as specified with + ), prefixed + with ve-. The + container side of the the Ethernet + link will be named + host0. Note that + + implies + . - + - Turn off networking in - the container. This makes all network - interfaces unavailable in the - container, with the exception of the - loopback device. + Adds the host side of + the Ethernet link created with + to the + specified bridge. Note that + + implies + . If + this option is used the host side of + the Ethernet link will use the + vb- prefix instead + of ve-. - + + - Assign the specified - network interface to the - container. This will move the - specified interface from the calling - namespace and place it in the - container. When the container - terminates it is moved back to the - host namespace. + Sets the SELinux + security context to be used to label + processes in the container. + - + + - Mount the root file - system read-only for the - container. + Sets the SELinux security + context to be used to label files in + the virtual API file systems in the + container. + @@ -323,9 +407,12 @@ CAP_SYS_CHROOT, CAP_SYS_NICE, CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_SYS_RESOURCE, CAP_SYS_BOOT, - CAP_AUDIT_WRITE, CAP_AUDIT_CONTROL. If - the special value - all is passed all + CAP_AUDIT_WRITE, + CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN + is retained if + is + specified. If the special value + all is passed, all capabilities are retained. @@ -388,6 +475,14 @@ . + + + + Mount the root file + system read-only for the + container. + + @@ -405,7 +500,7 @@ destination in the container. The option creates read-only bind - mount. + mounts. @@ -422,17 +517,6 @@ more than once. - - - - - Turns off any status - output by the tool itself. When this - switch is used, then the only output - by nspawn will be the console output - of the container OS itself. - - @@ -474,7 +558,7 @@ and shown by tools such as ps1. If the container does not run an init - system it is recommended to set this + system, it is recommended to set this option to no. Note that implies @@ -490,13 +574,13 @@ container in, simply register the service or scope unit systemd-nspawn has - been invoked in in + been invoked in with systemd-machined8. This has no effect if is used. This switch should be used if systemd-nspawn is - invoked from within an a service unit, + invoked from within a service unit, and the service unit's sole purpose is to run a single systemd-nspawn @@ -505,6 +589,38 @@ session. + + + + Control the + architecture ("personality") reported + by + uname2 + in the container. Currently, only + x86 and + x86-64 are + supported. This is useful when running + a 32bit container on a 64bit + host. If this setting is not used + the personality reported in the + container is the same as the one + reported on the + host. + + + + + + + Turns off any status + output by the tool itself. When this + switch is used, the only output + from nspawn will be the console output + of the container OS itself. + + + +