X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=9d8db83e81ba9e845c0fe41f919e58c869b365de;hp=8396def003e59b3b61f793938ec6a7ab0108804b;hb=89f7c8465cd1ab37347dd0c15920bce31e8225df;hpb=cb96a2c69a312fb089fef4501650f4fc40a1420b
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 8396def00..9d8db83e8 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -51,7 +51,14 @@
systemd-nspawnOPTIONS
- COMMAND
+ COMMAND
+ ARGS
+
+
+
+ systemd-nspawn
+ -b
+ OPTIONSARGS
@@ -90,14 +97,13 @@
involved with boot and systems management.
In contrast to
- chroot1
- systemd-nspawn may be used to boot
- full Linux-based operating systems in a
- container.
+ chroot1Â systemd-nspawn
+ may be used to boot full Linux-based operating systems
+ in a container.
Use a tool like
yum8,
- debootstrap8
+ debootstrap8,
or
pacman8
to set up an OS directory tree suitable as file system
@@ -117,24 +123,52 @@
see each other. The PID namespace separation of the
two containers is complete and the containers will
share very few runtime objects except for the
- underlying file system. It is however possible to
- enter an existing container, see
- Example 4 below.
-
+ underlying file system. Use
+ machinectl1's
+ login command to request an
+ additional login prompt in a running container.
systemd-nspawn implements the
Container
Interface specification.
+
+ As a safety check
+ systemd-nspawn will verify the
+ existence of /etc/os-release in
+ the container tree before starting the container (see
+ os-release5). It
+ might be necessary to add this file to the container
+ tree manually if the OS of the container is too old to
+ contain this file out-of-the-box.
+
+
+
+ Incompatibility with Auditing
+
+ Note that the kernel auditing subsystem is
+ currently broken when used together with
+ containers. We hence recommend turning it off entirely
+ by booting with audit=0 on the
+ kernel command line, or by turning it off at kernel
+ build time. If auditing is enabled in the kernel,
+ operating systems booted in an nspawn container might
+ refuse log-in attempts.Options
- If no arguments are passed the container is set
- up and a shell started in it, otherwise the passed
- command and arguments are executed in it. The
- following options are understood:
+ If option is specified, the
+ arguments are used as arguments for the init
+ binary. Otherwise, COMMAND
+ specifies the program to launch in the container, and
+ the remaining arguments are used as arguments for this
+ program. If is not used and no
+ arguments are specifed, a shell is launched in the
+ container.
+
+ The following options are understood:
@@ -158,7 +192,7 @@
Directory to use as
file system root for the namespace
- container. If omitted the current
+ container. If omitted, the current
directory will be
used.
@@ -170,8 +204,12 @@
Automatically search
for an init binary and invoke it
instead of a shell or a user supplied
- program. A command to execute cannot
- be specified in this case.
+ program. If this option is used,
+ arguments specified on the command
+ line are used as arguments for the
+ init binary. This option may not be
+ combined with
+ .
@@ -188,10 +226,56 @@
+
+
+
+
+ Sets the machine name
+ for this container. This name may be
+ used to identify this container on the
+ host, and is used to initialize the
+ container's hostname (which the
+ container can choose to override,
+ however). If not specified, the last
+ component of the root directory of the
+ container is used.
+
+
+
+
+
+ Make the container
+ part of the specified slice, instead
+ of the
+ machine.slice.
+
+
+
+
+
+
+
+ Sets the SELinux
+ security context to be used to label
+ processes in the container.
+
+
+
+
+
+
+
+ Sets the SELinux security
+ context to be used to label files in
+ the virtual API file systems in the
+ container.
+
+
+
- Set the specified uuid
+ Set the specified UUID
for the container. The init system
will initialize
/etc/machine-id
@@ -199,16 +283,6 @@
-
-
-
-
- Makes the container appear in
- other hierarchies than the name=systemd:/ one.
- Takes a comma-separated list of controllers.
-
-
-
@@ -223,7 +297,7 @@
Mount the root file
- system read only for the
+ system read-only for the
container.
@@ -232,7 +306,7 @@
List one or more
additional capabilities to grant the
- container. Takes a comma separated
+ container. Takes a comma-separated
list of capability names, see
capabilities7
for more information. Note that the
@@ -253,12 +327,22 @@
CAP_AUDIT_CONTROL.
+
+
+
+ Specify one or more
+ additional capabilities to drop for
+ the container. This allows running the
+ container with fewer capabilities than
+ the default (see above).
+
+
Control whether the
container's journal shall be made
- visible to the host system. If enabled
+ visible to the host system. If enabled,
allows viewing the container's journal
files from the host (but not vice
versa). Takes one of
@@ -284,7 +368,7 @@
/var/log/journal
exists, it will be bind mounted
into the container. If the
- subdirectory doesn't exist, no
+ subdirectory does not exist, no
linking is performed. Effectively,
booting a container once with
guest or
@@ -300,6 +384,124 @@
Equivalent to
.
+
+
+
+
+
+ Bind mount a file or
+ directory from the host into the
+ container. Either takes a path
+ argument -- in which case the
+ specified path will be mounted from
+ the host to the same path in the
+ container --, or a colon-separated
+ pair of paths -- in which case the
+ first specified path is the source in
+ the host, and the second path is the
+ destination in the container. The
+ option
+ creates read-only bind
+ mount.
+
+
+
+
+
+ Specifies an
+ environment variable assignment to
+ pass to the init process in the
+ container, in the format
+ NAME=VALUE. This
+ may be used to override the default
+ variables or to set additional
+ variables. This parameter may be used
+ more than once.
+
+
+
+
+
+
+ Turns off any status
+ output by the tool itself. When this
+ switch is used, then the only output
+ by nspawn will be the console output
+ of the container OS itself.
+
+
+
+
+
+ Allows the container
+ to share certain system facilities
+ with the host. More specifically, this
+ turns off PID namespacing, UTS
+ namespacing and IPC namespacing, and
+ thus allows the guest to see and
+ interact more easily with processes
+ outside of the container. Note that
+ using this option makes it impossible
+ to start up a full Operating System in
+ the container, as an init system
+ cannot operate in this mode. It is
+ only useful to run specific programs
+ or applications this way, without
+ involving an init system in the
+ container. This option implies
+ . This
+ option may not be combined with
+ .
+
+
+
+
+
+ Controls whether the
+ container is registered with
+ systemd-machined8. Takes
+ a boolean argument, defaults to
+ yes. This option
+ should be enabled when the container
+ runs a full Operating System (more
+ specifically: an init system), and is
+ useful to ensure that the container is
+ accessible via
+ machinectl1
+ and shown by tools such as
+ ps1. If
+ the container does not run an init
+ system it is recommended to set this
+ option to no. Note
+ that
+ implies
+ .
+
+
+
+
+
+
+ Instead of creating a
+ transient scope unit to run the
+ container in, simply register the
+ service or scope unit
+ systemd-nspawn has
+ been invoked in in
+ systemd-machined8. This
+ has no effect if
+ is
+ used. This switch should be used if
+ systemd-nspawn is
+ invoked from within an a service unit,
+ and the service unit's sole purpose
+ is to run a single
+ systemd-nspawn
+ container. This option is not
+ available if run from a user
+ session.
+
+
@@ -311,7 +513,7 @@
# systemd-nspawn -bD /srv/mycontainer
This installs a minimal Fedora distribution into
- the directory /srv/mycontainer/ and
+ the directory /srv/mycontainer/ and
then boots an OS in a namespace container in
it.
@@ -339,22 +541,35 @@
boots an OS in a namespace container in it.
-
+ Example 4
- To enter the container, PID of one of the
- processes sharing the new namespaces must be used.
- systemd-nspawn prints the PID
- (as viewed from the outside) of the launched process,
- and it can be used to enter the container.
+ # mv ~/arch-tree /var/lib/container/arch
+# systemctl enable systemd-nspawn@arch.service
+# systemctl start systemd-nspawn@arch.service
+
+ This makes the Arch Linux container part of the
+ multi-user.target on the host.
+
+
+
+
+ Example 5
+
+ # btrfs subvolume snapshot / /.tmp
+# systemd-nspawn --private-network -D /.tmp -b
+
+ This runs a copy of the host system in a
+ btrfs snapshot.
+
+
+
+ Example 6
- # nsenter -muinpt $PID
+ # chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
- nsenter1
- is part of
- util-linux.
- Kernel support for entering namespaces was added in
- Linux 3.8.
+ This runs a container with SELinux sandbox security contexts.
@@ -369,10 +584,11 @@
systemd1,
chroot1,
- unshare1,
yum8,
debootstrap8,
- pacman8
+ pacman8,
+ systemd.slice5,
+ machinectl1