X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=d6687038af68467bc3adb42d210a71e889ca12bf;hb=06c17c39a8345deef1ecff4dd5ef262f968c9be2;hp=9d8db83e81ba9e845c0fe41f919e58c869b365de;hpb=89f7c8465cd1ab37347dd0c15920bce31e8225df;p=elogind.git
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 9d8db83e8..d6687038a 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -21,7 +21,8 @@
along with systemd; If not, see .
-->
-
+systemd-nspawn
@@ -143,19 +144,6 @@
contain this file out-of-the-box.
-
- Incompatibility with Auditing
-
- Note that the kernel auditing subsystem is
- currently broken when used together with
- containers. We hence recommend turning it off entirely
- by booting with audit=0 on the
- kernel command line, or by turning it off at kernel
- build time. If auditing is enabled in the kernel,
- operating systems booted in an nspawn container might
- refuse log-in attempts.
-
-
Options
@@ -171,30 +159,44 @@
The following options are understood:
-
-
-
-
- Prints a short help
- text and exits.
-
-
-
-
-
- Prints a version string
- and exits.
-
-
Directory to use as
- file system root for the namespace
- container. If omitted, the current
- directory will be
- used.
+ file system root for the container. If
+ neither
+ nor are
+ specified, the current directory will
+ be used. May not be specified together with
+ .
+
+
+
+
+
+
+ Disk image to mount
+ the root directory for the container
+ from. Takes a path to a regular file
+ or to a block device node. The file or
+ block device must contain a GUID
+ Partition Table with a root partition
+ which is mounted as the root directory
+ of the container. Optionally, it may
+ contain a home and/or a server data
+ partition which are mounted to the
+ appropriate places in the
+ container. All these partitions must
+ be identified by the partition types
+ defined by the Discoverable
+ Partitions Specification. Any
+ other partitions, such as foreign
+ partitions, swap partitions or EFI
+ system partitions are not mounted. May
+ not be specified together with
+ .
@@ -217,13 +219,15 @@
- Run the command
- under specified user, create home
- directory and cd into it. As rest
- of systemd-nspawn, this is not
- the security feature and limits
- against accidental changes only.
-
+ After transitioning
+ into the container, change to the
+ specified user-defined in the
+ container's user database. Like all
+ other systemd-nspawn features, this is
+ not a security feature and provides
+ protection against accidental
+ destructive operations
+ only.
@@ -241,16 +245,125 @@
container is used.
+
+
+
+ Set the specified UUID
+ for the container. The init system
+ will initialize
+ /etc/machine-id
+ from this if this file is not set yet.
+
+
+
Make the container
part of the specified slice, instead
- of the
+ of the default
machine.slice.
+
+
+
+ Disconnect networking
+ of the container from the host. This
+ makes all network interfaces
+ unavailable in the container, with the
+ exception of the loopback device and
+ those specified with
+
+ and configured with
+ . If
+ this option is specified, the
+ CAP_NET_ADMIN capability will be added
+ to the set of capabilities the
+ container retains. The latter may be
+ disabled by using
+ .
+
+
+
+
+
+ Assign the specified
+ network interface to the
+ container. This will remove the
+ specified interface from the calling
+ namespace and place it in the
+ container. When the container
+ terminates, it is moved back to the
+ host namespace. Note that
+
+ implies
+ . This
+ option may be used more than once to
+ add multiple network interfaces to the
+ container.
+
+
+
+
+
+ Create a
+ macvlan interface
+ of the specified Ethernet network
+ interface and add it to the
+ container. A
+ macvlan interface
+ is a virtual interface that adds a
+ second MAC address to an existing
+ physical Ethernet link. The interface
+ in the container will be named after
+ the interface on the host, prefixed
+ with mv-. Note that
+
+ implies
+ . This
+ option may be used more than once to
+ add multiple network interfaces to the
+ container.
+
+
+
+
+
+ Create a virtual
+ Ethernet link
+ (veth) between host
+ and container. The host side of the
+ Ethernet link will be available as a
+ network interface named after the
+ container's name (as specified with
+ ), prefixed
+ with ve-. The
+ container side of the Ethernet
+ link will be named
+ host0. Note that
+
+ implies
+ .
+
+
+
+
+
+ Adds the host side of
+ the Ethernet link created with
+ to the
+ specified bridge. Note that
+
+ implies
+ . If
+ this option is used, the host side of
+ the Ethernet link will use the
+ vb- prefix instead
+ of ve-.
+
+
@@ -272,35 +385,6 @@
-
-
-
- Set the specified UUID
- for the container. The init system
- will initialize
- /etc/machine-id
- from this if this file is not set yet.
-
-
-
-
-
-
- Turn off networking in
- the container. This makes all network
- interfaces unavailable in the
- container, with the exception of the
- loopback device.
-
-
-
-
-
- Mount the root file
- system read-only for the
- container.
-
-
@@ -324,7 +408,13 @@
CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
CAP_SYS_RESOURCE, CAP_SYS_BOOT,
CAP_AUDIT_WRITE,
- CAP_AUDIT_CONTROL.
+ CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN
+ is retained if
+ is
+ specified. If the special value
+ all is passed, all
+ capabilities are
+ retained.
@@ -385,6 +475,14 @@
.
+
+
+
+ Mount the root file
+ system read-only for the
+ container.
+
+
@@ -402,7 +500,31 @@
destination in the container. The
option
creates read-only bind
- mount.
+ mounts.
+
+
+
+
+
+ Mount a tmpfs file
+ system into the container. Takes a
+ single absolute path argument that
+ specifies where to mount the tmpfs
+ instance to (in which case the
+ directory access mode will be chosen
+ as 0755, owned by root/root), or
+ optionally a colon-separated pair of
+ path and mount option string, that is
+ used for mounting (in which case the
+ kernel default for access mode and
+ owner will be chosen, unless otherwise
+ specified). This option is
+ particularly useful for mounting
+ directories such as
+ /var as tmpfs, to
+ allow state-less systems, in
+ particular when combined with
+ .
@@ -419,17 +541,6 @@
more than once.
-
-
-
-
- Turns off any status
- output by the tool itself. When this
- switch is used, then the only output
- by nspawn will be the console output
- of the container OS itself.
-
-
@@ -471,7 +582,7 @@
and shown by tools such as
ps1. If
the container does not run an init
- system it is recommended to set this
+ system, it is recommended to set this
option to no. Note
that
implies
@@ -487,13 +598,13 @@
container in, simply register the
service or scope unit
systemd-nspawn has
- been invoked in in
+ been invoked in with
systemd-machined8. This
has no effect if
is
used. This switch should be used if
systemd-nspawn is
- invoked from within an a service unit,
+ invoked from within a service unit,
and the service unit's sole purpose
is to run a single
systemd-nspawn
@@ -502,6 +613,38 @@
session.
+
+
+
+ Control the
+ architecture ("personality") reported
+ by
+ uname2
+ in the container. Currently, only
+ x86 and
+ x86-64 are
+ supported. This is useful when running
+ a 32-bit container on a 64-bit
+ host. If this setting is not used,
+ the personality reported in the
+ container is the same as the one
+ reported on the
+ host.
+
+
+
+
+
+
+ Turns off any status
+ output by the tool itself. When this
+ switch is used, the only output
+ from nspawn will be the console output
+ of the container OS itself.
+
+
+
+