X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=ccd3436d424869b0b4d7cd610a0d0d19b15184ea;hb=590b6b9188e75ba46c42995984a1c2fa06adb6d6;hp=df318d7a43c02c6ac33bc181728b9aae00603dbe;hpb=284c0b917697fb0271381f331ffee28403278e72;p=elogind.git
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index df318d7a4..ccd3436d4 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -21,7 +21,8 @@
along with systemd; If not, see .
-->
-
+systemd-nspawn
@@ -143,19 +144,6 @@
contain this file out-of-the-box.
-
- Incompatibility with Auditing
-
- Note that the kernel auditing subsystem is
- currently broken when used together with
- containers. We hence recommend turning it off entirely
- by booting with audit=0 on the
- kernel command line, or by turning it off at kernel
- build time. If auditing is enabled in the kernel,
- operating systems booted in an nspawn container might
- refuse log-in attempts.
-
-
Options
@@ -171,30 +159,44 @@
The following options are understood:
-
-
-
-
- Prints a short help
- text and exits.
-
-
-
-
-
- Prints a version string
- and exits.
-
-
Directory to use as
- file system root for the namespace
- container. If omitted, the current
- directory will be
- used.
+ file system root for the container. If
+ neither
+ nor are
+ specified, the current directory will
+ be used. May not be specified together with
+ .
+
+
+
+
+
+
+ Disk image to mount
+ the root directory for the container
+ from. Takes a path to a regular file
+ or to a block device node. The file or
+ block device must contain a GUID
+ Partition Table with a root partition
+ which is mounted as the root directory
+ of the container. Optionally, it may
+ contain a home and/or a server data
+ partition which are mounted to the
+ appropriate places in the
+ container. All these partitions must
+ be identified by the partition types
+ defined by the Discoverable
+ Partitions Specification. Any
+ other partitions, such as foreign
+ partitions, swap partitions or EFI
+ system partitions are not mounted. May
+ not be specified together with
+ .
@@ -204,9 +206,12 @@
Automatically search
for an init binary and invoke it
instead of a shell or a user supplied
- program. If this option is used, arguments
- specified on the command line are used
- as arguments for the init binary.
+ program. If this option is used,
+ arguments specified on the command
+ line are used as arguments for the
+ init binary. This option may not be
+ combined with
+ .
@@ -214,13 +219,15 @@
- Run the command
- under specified user, create home
- directory and cd into it. As rest
- of systemd-nspawn, this is not
- the security feature and limits
- against accidental changes only.
-
+ After transitioning
+ into the container, change to the
+ specified user-defined in the
+ container's user database. Like all
+ other systemd-nspawn features, this is
+ not a security feature and provides
+ protection against accidental
+ destructive operations
+ only.
@@ -238,64 +245,144 @@
container is used.
+
+
+
+ Set the specified UUID
+ for the container. The init system
+ will initialize
+ /etc/machine-id
+ from this if this file is not set yet.
+
+
+
Make the container
part of the specified slice, instead
- of the
+ of the default
machine.slice.
-
-
+
- Sets the mandatory
- access control (MAC/SELinux) file
- label to be used by virtual API file
- systems in the container.
-
+ Disconnect networking
+ of the container from the host. This
+ makes all network interfaces
+ unavailable in the container, with the
+ exception of the loopback device and
+ those specified with
+
+ and configured with
+ . If
+ this option is specified, the
+ CAP_NET_ADMIN capability will be added
+ to the set of capabilities the
+ container retains. The latter may be
+ disabled by using
+ .
-
-
+
+
+ Assign the specified
+ network interface to the
+ container. This will remove the
+ specified interface from the calling
+ namespace and place it in the
+ container. When the container
+ terminates, it is moved back to the
+ host namespace. Note that
+
+ implies
+ . This
+ option may be used more than once to
+ add multiple network interfaces to the
+ container.
+
- Sets the mandatory
- access control (MAC/SELinux) label to be used by
- processes in the container.
-
+
+
+
+ Create a
+ macvlan interface
+ of the specified Ethernet network
+ interface and add it to the
+ container. A
+ macvlan interface
+ is a virtual interface that adds a
+ second MAC address to an existing
+ physical Ethernet link. The interface
+ in the container will be named after
+ the interface on the host, prefixed
+ with mv-. Note that
+
+ implies
+ . This
+ option may be used more than once to
+ add multiple network interfaces to the
+ container.
-
+
+
+ Create a virtual
+ Ethernet link
+ (veth) between host
+ and container. The host side of the
+ Ethernet link will be available as a
+ network interface named after the
+ container's name (as specified with
+ ), prefixed
+ with ve-. The
+ container side of the Ethernet
+ link will be named
+ host0. Note that
+
+ implies
+ .
+
- Set the specified UUID
- for the container. The init system
- will initialize
- /etc/machine-id
- from this if this file is not set yet.
-
+
+
+
+ Adds the host side of
+ the Ethernet link created with
+ to the
+ specified bridge. Note that
+
+ implies
+ . If
+ this option is used, the host side of
+ the Ethernet link will use the
+ vb- prefix instead
+ of ve-.
-
+
+
- Turn off networking in
- the container. This makes all network
- interfaces unavailable in the
- container, with the exception of the
- loopback device.
+ Sets the SELinux
+ security context to be used to label
+ processes in the container.
+
-
+
+
- Mount the root file
- system read-only for the
- container.
+ Sets the SELinux security
+ context to be used to label files in
+ the virtual API file systems in the
+ container.
+
@@ -321,7 +408,13 @@
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
CAP_SYS_RESOURCE, CAP_SYS_BOOT,
CAP_AUDIT_WRITE,
- CAP_AUDIT_CONTROL.
+ CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN
+ is retained if
+ is
+ specified. If the special value
+ all is passed, all
+ capabilities are
+ retained.
@@ -382,6 +475,14 @@
.
+
+
+
+ Mount the root file
+ system read-only for the
+ container.
+
+
@@ -399,7 +500,7 @@
destination in the container. The
option
creates read-only bind
- mount.
+ mounts.
@@ -416,18 +517,110 @@
more than once.
+
+
+
+ Allows the container
+ to share certain system facilities
+ with the host. More specifically, this
+ turns off PID namespacing, UTS
+ namespacing and IPC namespacing, and
+ thus allows the guest to see and
+ interact more easily with processes
+ outside of the container. Note that
+ using this option makes it impossible
+ to start up a full Operating System in
+ the container, as an init system
+ cannot operate in this mode. It is
+ only useful to run specific programs
+ or applications this way, without
+ involving an init system in the
+ container. This option implies
+ . This
+ option may not be combined with
+ .
+
+
+
+
+
+ Controls whether the
+ container is registered with
+ systemd-machined8. Takes
+ a boolean argument, defaults to
+ yes. This option
+ should be enabled when the container
+ runs a full Operating System (more
+ specifically: an init system), and is
+ useful to ensure that the container is
+ accessible via
+ machinectl1
+ and shown by tools such as
+ ps1. If
+ the container does not run an init
+ system, it is recommended to set this
+ option to no. Note
+ that
+ implies
+ .
+
+
+
+
+
+
+ Instead of creating a
+ transient scope unit to run the
+ container in, simply register the
+ service or scope unit
+ systemd-nspawn has
+ been invoked in with
+ systemd-machined8. This
+ has no effect if
+ is
+ used. This switch should be used if
+ systemd-nspawn is
+ invoked from within a service unit,
+ and the service unit's sole purpose
+ is to run a single
+ systemd-nspawn
+ container. This option is not
+ available if run from a user
+ session.
+
+
+
+
+
+ Control the
+ architecture ("personality") reported
+ by
+ uname2
+ in the container. Currently, only
+ x86 and
+ x86-64 are
+ supported. This is useful when running
+ a 32-bit container on a 64-bit
+ host. If this setting is not used,
+ the personality reported in the
+ container is the same as the one
+ reported on the
+ host.
+
+
Turns off any status
output by the tool itself. When this
- switch is used, then the only output
- by nspawn will be the console output
- of the container OS
- itself.
+ switch is used, the only output
+ from nspawn will be the console output
+ of the container OS itself.
+
+
@@ -495,7 +688,7 @@
# chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
- This runs a container with SELinux sandbox labels.
+ This runs a container with SELinux sandbox security contexts.