X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=a80cec4e6c62d8c781fa54cdbe88359e15bc3264;hp=db2d417e49f83110d31a25ab741fdedb93668970;hb=f03dc7c0c58c5cddb62dbd809c1f4ccad3c6e2b6;hpb=acbeb42770e1e99955ebc4464a0439cf741b3aeb diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index db2d417e4..a80cec4e6 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -49,7 +49,17 @@ - systemd-nspawn OPTIONS COMMAND ARGS + systemd-nspawn + OPTIONS + COMMAND + ARGS + + + + systemd-nspawn + -b + OPTIONS + ARGS @@ -93,9 +103,10 @@ container. Use a tool like - yum8 - or + yum8, debootstrap8 + or + pacman8 to set up an OS directory tree suitable as file system hierarchy for systemd-nspawn containers. @@ -113,7 +124,10 @@ see each other. The PID namespace separation of the two containers is complete and the containers will share very few runtime objects except for the - underlying file system. + underlying file system. It is however possible to + enter an existing container, see + Example 4 below. + systemd-nspawn implements the Options - If no arguments are passed the container is set - up and a shell started in it, otherwise the passed - command and arguments are executed in it. The - following options are understood: + If option is specified, the + arguments are used as arguments for the init + binary. Otherwise, COMMAND + specifies the program to launch in the container, and + the remaining arguments are used as arguments for this + program. If is not used and no + arguments are specifed, a shell is launched in the + container. + + The following options are understood: - + Prints a short help text and exits. @@ -146,8 +166,8 @@ - + Directory to use as file system root for the namespace @@ -157,18 +177,21 @@ - + Automatically search for an init binary and invoke it instead of a shell or a user supplied - program. + program. If this option is used, arguments + specified on the command line are used + as arguments for the init binary. + - + Run the command under specified user, create home @@ -179,6 +202,21 @@ + + + + + Sets the machine name + for this container. This name may be + used to identify this container on the + host, and is used to initialize the + container's hostname (which the + container can choose to override, + however). If not specified the last + component of the root directory of the + container is used. + + @@ -191,8 +229,8 @@ - + Makes the container appear in other hierarchies than the name=systemd:/ one. @@ -227,8 +265,8 @@ list of capability names, see capabilities7 for more information. Note that the - following capabilities will be - granted in any way: CAP_CHOWN, + following capabilities will be granted + in any way: CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER, CAP_KILL, CAP_LEASE, @@ -239,7 +277,9 @@ CAP_SETUID, CAP_SYS_ADMIN, CAP_SYS_CHROOT, CAP_SYS_NICE, CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, - CAP_SYS_RESOURCE, CAP_SYS_BOOT. + CAP_SYS_RESOURCE, CAP_SYS_BOOT, + CAP_AUDIT_WRITE, + CAP_AUDIT_CONTROL. @@ -259,13 +299,13 @@ not linked. If host, the journal files are stored on the host file system (beneath - /var/log/journal/<machine-id>) + /var/log/journal/machine-id) and the subdirectory is bind-mounted into the container at the same location. If guest, the journal files are stored on the guest file system (beneath - /var/log/journal/<machine-id>) + /var/log/journal/machine-id) and the subdirectory is symlinked into the host at the same location. If auto (the default), @@ -289,6 +329,26 @@ Equivalent to . + + + + + + Bind mount a file or + directory from the host into the + container. Either takes a path + argument -- in which case the + specified path will be mounted from + the host to the same path in the + container --, or a colon-separated + pair of paths -- in which case the + first specified path is the source in + the host, and the second path is the + destination in the container. The + option + creates read-only bind + mount. + @@ -296,13 +356,13 @@ Example 1 - # yum --releasever=17 --nogpgcheck --installroot ~/fedora-tree/ install yum passwd vim-minimal rootfiles systemd -# systemd-nspawn -D ~/fedora-tree /usr/lib/systemd/systemd + # yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal +# systemd-nspawn -bD /srv/mycontainer This installs a minimal Fedora distribution into - the directory ~/fedora-tree/ - and then boots an OS in a namespace container in it, - with systemd as init system. + the directory /srv/mycontainer/ and + then boots an OS in a namespace container in + it. @@ -315,7 +375,35 @@ distribution into the directory ~/debian-tree/ and then spawns a shell in a namespace container in it. + + + + Example 3 + + # pacstrap -c -d ~/arch-tree/ base +# systemd-nspawn -bD ~/arch-tree/ + + This installs a mimimal Arch Linux distribution into + the directory ~/arch-tree/ and then + boots an OS in a namespace container in it. + + + + Example 4 + + To enter the container, PID of one of the + processes sharing the new namespaces must be used. + systemd-nspawn prints the PID + (as viewed from the outside) of the launched process, + and it can be used to enter the container. + + # nsenter -m -u -i -n -p -t $PID + nsenter1 + is part of + util-linux. + Kernel support for entering namespaces was added in + Linux 3.8. @@ -330,8 +418,10 @@ systemd1, chroot1, + unshare1, yum8, - debootstrap8 + debootstrap8, + pacman8