X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=665518dd15ed4adf76b603086bc675bfb072972d;hb=c305c32580a1d7689a401e8cf673ec7936c12bbe;hp=2fa00e80c0c71696cdae51d87db80f132597d4a3;hpb=a7f5bb1eafadbb08c8528baae588bbe773a37e79;p=elogind.git
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 2fa00e80c..665518dd1 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -49,7 +49,17 @@
- systemd-nspawn OPTIONSCOMMANDARGS
+ systemd-nspawn
+ OPTIONS
+ COMMAND
+ ARGS
+
+
+
+ systemd-nspawn
+ -b
+ OPTIONS
+ ARGS
@@ -87,14 +97,13 @@
involved with boot and systems management.
In contrast to
- chroot1
- systemd-nspawn may be used to boot
- full Linux-based operating systems in a
- container.
+ chroot1Â systemd-nspawn
+ may be used to boot full Linux-based operating systems
+ in a container.
Use a tool like
yum8,
- debootstrap8
+ debootstrap8,
or
pacman8
to set up an OS directory tree suitable as file system
@@ -114,21 +123,39 @@
see each other. The PID namespace separation of the
two containers is complete and the containers will
share very few runtime objects except for the
- underlying file system.
+ underlying file system. Use
+ machinectl1's
+ login command to request an
+ additional login prompt in a running container.
systemd-nspawn implements the
Container
Interface specification.
+
+ As a safety check
+ systemd-nspawn will verify the
+ existence of /etc/os-release in
+ the container tree before starting the container (see
+ os-release5). It
+ might be necessary to add this file to the container
+ tree manually if the OS of the container is too old to
+ contain this file out-of-the-box.Options
- If no arguments are passed the container is set
- up and a shell started in it, otherwise the passed
- command and arguments are executed in it. The
- following options are understood:
+ If option is specified, the
+ arguments are used as arguments for the init
+ binary. Otherwise, COMMAND
+ specifies the program to launch in the container, and
+ the remaining arguments are used as arguments for this
+ program. If is not used and no
+ arguments are specifed, a shell is launched in the
+ container.
+
+ The following options are understood:
@@ -146,13 +173,24 @@
and exits.
+
+
+
+
+ Turns off any status
+ output by the tool itself. When this
+ switch is used, then the only output
+ by nspawn will be the console output
+ of the container OS itself.
+
+
Directory to use as
file system root for the namespace
- container. If omitted the current
+ container. If omitted, the current
directory will be
used.
@@ -164,7 +202,13 @@
Automatically search
for an init binary and invoke it
instead of a shell or a user supplied
- program.
+ program. If this option is used,
+ arguments specified on the command
+ line are used as arguments for the
+ init binary. This option may not be
+ combined with
+ .
+
@@ -180,10 +224,25 @@
+
+
+
+
+ Sets the machine name
+ for this container. This name may be
+ used to identify this container on the
+ host, and is used to initialize the
+ container's hostname (which the
+ container can choose to override,
+ however). If not specified, the last
+ component of the root directory of the
+ container is used.
+
+
- Set the specified uuid
+ Set the specified UUID
for the container. The init system
will initialize
/etc/machine-id
@@ -192,39 +251,112 @@
-
-
+
- Makes the container appear in
- other hierarchies than the name=systemd:/ one.
- Takes a comma-separated list of controllers.
-
+ Make the container
+ part of the specified slice, instead
+ of the default
+ machine.slice.
+
- Turn off networking in
- the container. This makes all network
- interfaces unavailable in the
- container, with the exception of the
- loopback device.
+ Disconnect networking
+ of the container from the host. This
+ makes all network interfaces
+ unavailable in the container, with the
+ exception of the loopback device and
+ those specified with
+
+ and configured with
+ . If
+ this option is specified the
+ CAP_NET_ADMIN capability will be added
+ to the set of capabilities the
+ container retains. The latter may be
+ disabled by using
+ .
-
-
- Mount the root file
- system read only for the
+
+
+ Assign the specified
+ network interface to the
+ container. This will move the
+ specified interface from the calling
+ namespace and place it in the
+ container. When the container
+ terminates it is moved back to the
+ host namespace. Note that
+
+ implies
+ . This
+ option may be used more than once to
+ add multiple network interfaces to the
container.
+
+
+
+ Create a virtual
+ ethernet link between host and
+ container. The host side of the
+ ethernet link will be available as
+ network interface named after the
+ container's name (as specified with
+ ), prefixed
+ with ve-. The
+ container side of the the ethernet
+ link will be named
+ host0. Note that
+
+ implies
+ .
+
+
+
+
+
+ Adds the host side of the
+ ethernet link created with
+
+ to the specified bridge. Note that
+
+ implies
+ .
+
+
+
+
+
+
+ Sets the SELinux
+ security context to be used to label
+ processes in the container.
+
+
+
+
+
+
+
+ Sets the SELinux security
+ context to be used to label files in
+ the virtual API file systems in the
+ container.
+
+
+
List one or more
additional capabilities to grant the
- container. Takes a comma separated
+ container. Takes a comma-separated
list of capability names, see
capabilities7
for more information. Note that the
@@ -242,7 +374,23 @@
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
CAP_SYS_RESOURCE, CAP_SYS_BOOT,
CAP_AUDIT_WRITE,
- CAP_AUDIT_CONTROL.
+ CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN
+ is retained if
+ is
+ specified. If the special value
+ all is passed all
+ capabilities are
+ retained.
+
+
+
+
+
+ Specify one or more
+ additional capabilities to drop for
+ the container. This allows running the
+ container with fewer capabilities than
+ the default (see above).
@@ -250,7 +398,7 @@
Control whether the
container's journal shall be made
- visible to the host system. If enabled
+ visible to the host system. If enabled,
allows viewing the container's journal
files from the host (but not vice
versa). Takes one of
@@ -262,13 +410,13 @@
not linked. If host,
the journal files are stored on the
host file system (beneath
- /var/log/journal/<machine-id>)
+ /var/log/journal/machine-id)
and the subdirectory is bind-mounted
into the container at the same
location. If guest,
the journal files are stored on the
guest file system (beneath
- /var/log/journal/<machine-id>)
+ /var/log/journal/machine-id)
and the subdirectory is symlinked into the host
at the same location. If
auto (the default),
@@ -276,7 +424,7 @@
/var/log/journal
exists, it will be bind mounted
into the container. If the
- subdirectory doesn't exist, no
+ subdirectory does not exist, no
linking is performed. Effectively,
booting a container once with
guest or
@@ -292,6 +440,121 @@
Equivalent to
.
+
+
+
+
+ Mount the root file
+ system read-only for the
+ container.
+
+
+
+
+
+
+ Bind mount a file or
+ directory from the host into the
+ container. Either takes a path
+ argument -- in which case the
+ specified path will be mounted from
+ the host to the same path in the
+ container --, or a colon-separated
+ pair of paths -- in which case the
+ first specified path is the source in
+ the host, and the second path is the
+ destination in the container. The
+ option
+ creates read-only bind
+ mount.
+
+
+
+
+
+ Specifies an
+ environment variable assignment to
+ pass to the init process in the
+ container, in the format
+ NAME=VALUE. This
+ may be used to override the default
+ variables or to set additional
+ variables. This parameter may be used
+ more than once.
+
+
+
+
+
+ Allows the container
+ to share certain system facilities
+ with the host. More specifically, this
+ turns off PID namespacing, UTS
+ namespacing and IPC namespacing, and
+ thus allows the guest to see and
+ interact more easily with processes
+ outside of the container. Note that
+ using this option makes it impossible
+ to start up a full Operating System in
+ the container, as an init system
+ cannot operate in this mode. It is
+ only useful to run specific programs
+ or applications this way, without
+ involving an init system in the
+ container. This option implies
+ . This
+ option may not be combined with
+ .
+
+
+
+
+
+ Controls whether the
+ container is registered with
+ systemd-machined8. Takes
+ a boolean argument, defaults to
+ yes. This option
+ should be enabled when the container
+ runs a full Operating System (more
+ specifically: an init system), and is
+ useful to ensure that the container is
+ accessible via
+ machinectl1
+ and shown by tools such as
+ ps1. If
+ the container does not run an init
+ system it is recommended to set this
+ option to no. Note
+ that
+ implies
+ .
+
+
+
+
+
+
+ Instead of creating a
+ transient scope unit to run the
+ container in, simply register the
+ service or scope unit
+ systemd-nspawn has
+ been invoked in in
+ systemd-machined8. This
+ has no effect if
+ is
+ used. This switch should be used if
+ systemd-nspawn is
+ invoked from within an a service unit,
+ and the service unit's sole purpose
+ is to run a single
+ systemd-nspawn
+ container. This option is not
+ available if run from a user
+ session.
+
+
@@ -303,7 +566,7 @@
# systemd-nspawn -bD /srv/mycontainer
This installs a minimal Fedora distribution into
- the directory /srv/mycontainer/ and
+ the directory /srv/mycontainer/ and
then boots an OS in a namespace container in
it.
@@ -318,7 +581,6 @@
distribution into the directory
~/debian-tree/ and then spawns a
shell in a namespace container in it.
-
@@ -332,6 +594,37 @@
boots an OS in a namespace container in it.
+
+ Example 4
+
+ # mv ~/arch-tree /var/lib/container/arch
+# systemctl enable systemd-nspawn@arch.service
+# systemctl start systemd-nspawn@arch.service
+
+ This makes the Arch Linux container part of the
+ multi-user.target on the host.
+
+
+
+
+ Example 5
+
+ # btrfs subvolume snapshot / /.tmp
+# systemd-nspawn --private-network -D /.tmp -b
+
+ This runs a copy of the host system in a
+ btrfs snapshot.
+
+
+
+ Example 6
+
+ # chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
+
+ This runs a container with SELinux sandbox security contexts.
+
+
Exit status
@@ -346,7 +639,9 @@
chroot1,
yum8,
debootstrap8,
- pacman8
+ pacman8,
+ systemd.slice5,
+ machinectl1