X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=4b7ec1d39116a8c73be70a5aec64ee00ece9ffc2;hb=63c372cb9df3bee01e3bf8cd7f96f336bddda846;hp=1ad8e6ec056fb2ed9a33ca689d5808783776b704;hpb=dca348bcbb462305864526c587495a14a76bfcde;p=elogind.git
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 1ad8e6ec0..4b7ec1d39 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -70,7 +70,7 @@
systemd-nspawn may be used to
run a command or OS in a light-weight namespace
container. In many ways it is similar to
- chroot1,
+ chroot1,
but more powerful since it fully virtualizes the file
system hierarchy, as well as the process tree, the
various IPC subsystems and the host and domain
@@ -98,15 +98,16 @@
involved with boot and systems management.In contrast to
- chroot1Â systemd-nspawn
+ chroot1Â systemd-nspawn
may be used to boot full Linux-based operating systems
in a container.Use a tool like
- yum8,
- debootstrap8,
+ dnf8,
+ yum8,
+ debootstrap8,
or
- pacman8
+ pacman8
to set up an OS directory tree suitable as file system
hierarchy for systemd-nspawn
containers.
@@ -136,8 +137,9 @@
As a safety check
systemd-nspawn will verify the
- existence of /etc/os-release in
- the container tree before starting the container (see
+ existence of /usr/lib/os-release
+ or /etc/os-release in the
+ container tree before starting the container (see
os-release5). It
might be necessary to add this file to the container
tree manually if the OS of the container is too old to
@@ -164,14 +166,80 @@
Directory to use as
- file system root for the container. If
- neither
- nor are
+ file system root for the container.
+
+ If neither
+ , nor
+ is specified
+ the directory is determined as
+ /var/lib/machines/
+ suffixed by the machine name as
+ specified with
+ . If
+ neither ,
+ , nor
+ are
specified, the current directory will
- be used. May not be specified together with
+ be used. May not be specified together
+ with
.
+
+
+
+ Directory or
+ btrfs subvolume to
+ use as template for the container's
+ root directory. If this is specified
+ and the container's root directory (as
+ configured by
+ ) does
+ not yet exist it is created as
+ btrfs subvolume and
+ populated from this template
+ tree. Ideally, the specified template
+ path refers to the root of a
+ btrfs subvolume, in
+ which case a simple copy-on-write
+ snapshot is taken, and populating the
+ root directory is instant. If the
+ specified template path does not refer
+ to the root of a
+ btrfs subvolume (or
+ not even to a btrfs
+ file system at all), the tree is
+ copied, which can be substantially
+ more time-consuming. Note that if this
+ option is used the container's root
+ directory (in contrast to the template
+ directory!) must be located on a
+ btrfs file system,
+ so that the btrfs
+ subvolume may be created. May not be
+ specified together with
+ or
+ .
+
+
+
+
+
+
+ If specified, the
+ container is run with a temporary
+ btrfs snapshot of
+ its root directory (as configured with
+ ), that
+ is removed immediately when the
+ container terminates. This option is
+ only supported if the root file system
+ is btrfs. May not
+ be specified together with
+ or
+ .
+
+
@@ -180,23 +248,45 @@
the root directory for the container
from. Takes a path to a regular file
or to a block device node. The file or
- block device must contain a GUID
- Partition Table with a root partition
- which is mounted as the root directory
- of the container. Optionally, it may
- contain a home and/or a server data
- partition which are mounted to the
- appropriate places in the
- container. All these partitions must
- be identified by the partition types
- defined by the Discoverable
- Partitions Specification. Any
- other partitions, such as foreign
- partitions, swap partitions or EFI
- system partitions are not mounted. May
- not be specified together with
- .
+ block device must contain either:
+
+
+ An MBR
+ partition table with a single
+ partition of type 0x83 that is
+ marked
+ bootable.
+
+ A GUID
+ partition table (GPT) with a single
+ partition of type
+ 0fc63daf-8483-4772-8e79-3d69d8477de4.
+
+ A GUID
+ partition table (GPT) with a
+ marked root partition which is
+ mounted as the root directory
+ of the container. Optionally,
+ GPT images may contain a home
+ and/or a server data partition
+ which are mounted to the
+ appropriate places in the
+ container. All these
+ partitions must be identified
+ by the partition types defined
+ by the Discoverable
+ Partitions
+ Specification.
+
+
+ Any other partitions, such as
+ foreign partitions, swap partitions or
+ EFI system partitions are not
+ mounted. May not be specified together
+ with ,
+ or
+ .
@@ -236,13 +326,22 @@
Sets the machine name
for this container. This name may be
- used to identify this container on the
- host, and is used to initialize the
- container's hostname (which the
- container can choose to override,
- however). If not specified, the last
- component of the root directory of the
- container is used.
+ used to identify this container during
+ its runtime (for example in tools like
+ machinectl1
+ and similar), and is used to
+ initialize the container's hostname
+ (which the container can choose to
+ override, however). If not specified,
+ the last component of the root
+ directory path of the container is
+ used, possibly suffixed with a random
+ identifier in case
+ mode is
+ selected. If the root directory
+ selected is the host's root directory
+ the host's hostname is used as default
+ instead.
@@ -329,6 +428,31 @@
+
+
+ Create an
+ ipvlan interface
+ of the specified Ethernet network
+ interface and add it to the
+ container. An
+ ipvlan interface
+ is a virtual interface, similar to a
+ macvlan interface, which
+ uses the same MAC address as the underlying
+ interface. The interface
+ in the container will be named after
+ the interface on the host, prefixed
+ with iv-. Note that
+
+ implies
+ . This
+ option may be used more than once to
+ add multiple network interfaces to the
+ container.
+
+
+
+ Create a virtual
@@ -358,12 +482,38 @@
implies
. If
- this option is used the host side of
+ this option is used, the host side of
the Ethernet link will use the
vb- prefix instead
of ve-.
+
+
+
+
+ If private networking
+ is enabled, maps an IP port on the
+ host onto an IP port on the
+ container. Takes a protocol specifier
+ (either tcp or
+ udp), separated by
+ a colon from a host port number in the
+ range 1 to 65535, separated by a colon
+ from a container port number in the
+ range from 1 to 65535. The protocol
+ specifier and its separating colon may
+ be omitted, in which case
+ tcp is assumed.
+ The container port number and its
+ colon may be ommitted, in which case
+ the same port as the host port is
+ implied. This option is only supported
+ if private networking is used, such as
+ or
+ .
+
+
@@ -392,7 +542,7 @@
additional capabilities to grant the
container. Takes a comma-separated
list of capability names, see
- capabilities7
+ capabilities7
for more information. Note that the
following capabilities will be granted
in any way: CAP_CHOWN,
@@ -438,7 +588,9 @@
versa). Takes one of
no,
host,
+ try-host,
guest,
+ try-guest,
auto. If
no, the journal is
not linked. If host,
@@ -452,8 +604,11 @@
guest file system (beneath
/var/log/journal/machine-id)
and the subdirectory is symlinked into the host
- at the same location. If
- auto (the default),
+ at the same location. try-host
+ and try-guest do the same
+ but do not fail if the host does not have
+ persistent journalling enabled.
+ If auto (the default),
and the right subdirectory of
/var/log/journal
exists, it will be bind mounted
@@ -472,7 +627,7 @@
Equivalent to
- .
+ .
@@ -503,6 +658,30 @@
mounts.
+
+
+
+ Mount a tmpfs file
+ system into the container. Takes a
+ single absolute path argument that
+ specifies where to mount the tmpfs
+ instance to (in which case the
+ directory access mode will be chosen
+ as 0755, owned by root/root), or
+ optionally a colon-separated pair of
+ path and mount option string, that is
+ used for mounting (in which case the
+ kernel default for access mode and
+ owner will be chosen, unless otherwise
+ specified). This option is
+ particularly useful for mounting
+ directories such as
+ /var as tmpfs, to
+ allow state-less systems, in
+ particular when combined with
+ .
+
+
@@ -556,7 +735,7 @@
accessible via
machinectl1
and shown by tools such as
- ps1. If
+ ps1. If
the container does not run an init
system, it is recommended to set this
option to no. Note
@@ -601,7 +780,7 @@
x86-64 are
supported. This is useful when running
a 32-bit container on a 64-bit
- host. If this setting is not used
+ host. If this setting is not used,
the personality reported in the
container is the same as the one
reported on the
@@ -619,6 +798,49 @@
of the container OS itself.
+
+ =MODE
+
+ Boots the container in
+ volatile mode. When no mode parameter
+ is passed or when mode is specified as
+ yes full volatile
+ mode is enabled. This means the root
+ directory is mounted as mostly
+ unpopulated tmpfs
+ instance, and
+ /usr from the OS
+ tree is mounted into it, read-only
+ (the system thus starts up with
+ read-only OS resources, but pristine
+ state and configuration, any changes
+ to the either are lost on
+ shutdown). When the mode parameter is
+ specified as state
+ the OS tree is mounted read-only, but
+ /var is mounted
+ as tmpfs instance
+ into it (the system thus starts up
+ with read-only OS resources and
+ configuration, but pristine state, any
+ changes to the latter are lost on
+ shutdown). When the mode parameter is
+ specified as no
+ (the default) the whole OS tree is
+ made available writable.
+
+ Note that setting this to
+ yes or
+ state will only
+ work correctly with operating systems
+ in the container that can boot up with
+ only /usr
+ mounted, and are able to populate
+ /var
+ automatically, as
+ needed.
+
+
@@ -626,69 +848,71 @@
- Example 1
+ Examples
- # yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
-# systemd-nspawn -bD /srv/mycontainer
+
+ Download a Fedora image and start a shell in it
- This installs a minimal Fedora distribution into
- the directory /srv/mycontainer/ and
- then boots an OS in a namespace container in
- it.
-
+ # machinectl pull-raw --verify=no http://ftp.halifax.rwth-aachen.de/fedora/linux/releases/21/Cloud/Images/x86_64/Fedora-Cloud-Base-20141203-21.x86_64.raw.xz
+# systemd-nspawn -M Fedora-Cloud-Base-20141203-21
-
- Example 2
+This downloads an image using machinectl1 and opens a shell in it.
+
- # debootstrap --arch=amd64 unstable ~/debian-tree/
-# systemd-nspawn -D ~/debian-tree/
+
+ Build and boot a minimal Fedora distribution in a container
- This installs a minimal Debian unstable
- distribution into the directory
- ~/debian-tree/ and then spawns a
- shell in a namespace container in it.
-
+ # dnf -y --releasever=21 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd dnf fedora-release vim-minimal
+# systemd-nspawn -bD /srv/mycontainer
-
- Example 3
+ This installs a minimal Fedora distribution into
+ the directory /srv/mycontainer/ and
+ then boots an OS in a namespace container in
+ it.
+
- # pacstrap -c -d ~/arch-tree/ base
-# systemd-nspawn -bD ~/arch-tree/
+
+ Spawn a shell in a container of a minimal Debian unstable distribution
- This installs a mimimal Arch Linux distribution into
- the directory ~/arch-tree/ and then
- boots an OS in a namespace container in it.
-
+ # debootstrap --arch=amd64 unstable ~/debian-tree/
+# systemd-nspawn -D ~/debian-tree/
-
- Example 4
+ This installs a minimal Debian unstable
+ distribution into the directory
+ ~/debian-tree/ and then spawns a
+ shell in a namespace container in it.
+
- # mv ~/arch-tree /var/lib/container/arch
-# systemctl enable systemd-nspawn@arch.service
-# systemctl start systemd-nspawn@arch.service
+
+ Boot a minimal Arch Linux distribution in a container
- This makes the Arch Linux container part of the
- multi-user.target on the host.
-
-
+ # pacstrap -c -d ~/arch-tree/ base
+# systemd-nspawn -bD ~/arch-tree/
-
- Example 5
+ This installs a mimimal Arch Linux distribution into
+ the directory ~/arch-tree/ and then
+ boots an OS in a namespace container in it.
+
- # btrfs subvolume snapshot / /.tmp
-# systemd-nspawn --private-network -D /.tmp -b
+
+ Boot into an ephemeral btrfs snapshot of the host system
- This runs a copy of the host system in a
- btrfs snapshot.
-
+ # systemd-nspawn -D / -xb
-
- Example 6
+ This runs a copy of the host system in a
+ btrfs snapshot which is
+ removed immediately when the container
+ exits. All file system changes made during
+ runtime will be lost on shutdown,
+ hence.
+
- # chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
-# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
+
+ Run a container with SELinux sandbox security contexts
- This runs a container with SELinux sandbox security contexts.
+ # chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
+
@@ -702,12 +926,14 @@
See Alsosystemd1,
- chroot1,
- yum8,
- debootstrap8,
- pacman8,
+ chroot1,
+ dnf8,
+ yum8,
+ debootstrap8,
+ pacman8,
systemd.slice5,
- machinectl1
+ machinectl1,
+ btrfs8