X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=fdb0c298b0aef7a37bd2ea49a579a47135afb70a;hb=f2cbe59e113f08549949a76ac5b9b3972df4cc30;hp=820a79bc286c53f61dfe1d686373af87b5aaf70a;hpb=06b643e7f5a3b79005dd57497897ab7255fe3659;p=elogind.git
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 820a79bc2..fdb0c298b 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -106,7 +106,7 @@
yum8,
debootstrap8,
or
- pacman8
+ pacman8
to set up an OS directory tree suitable as file system
hierarchy for systemd-nspawn
containers.
@@ -165,14 +165,80 @@
Directory to use as
- file system root for the container. If
- neither
- nor are
+ file system root for the container.
+
+ If neither
+ , nor
+ is specified
+ the directory is determined as
+ /var/lib/container/
+ suffixed by the machine name as
+ specified with
+ . If
+ neither ,
+ , nor
+ are
specified, the current directory will
- be used. May not be specified together with
+ be used. May not be specified together
+ with
.
+
+
+
+ Directory or
+ btrfs subvolume to
+ use as template for the container's
+ root directory. If this is specified
+ and the container's root directory (as
+ configured by
+ ) does
+ not yet exist it is created as
+ btrfs subvolume and
+ populated from this template
+ tree. Ideally, the specified template
+ path refers to the root of a
+ btrfs subvolume, in
+ which case a simple copy-on-write
+ snapshot is taken, and populating the
+ root directory is instant. If the
+ specified template path does not refer
+ to the root of a
+ btrfs subvolume (or
+ not even to a btrfs
+ file system at all), the tree is
+ copied, which can be substantially
+ more time-consuming. Note that if this
+ option is used the container's root
+ directory (in contrast to the template
+ directory!) must be located on a
+ btrfs file system,
+ so that the btrfs
+ subvolume may be created. May not be
+ specified together with
+ or
+ .
+
+
+
+
+
+
+ If specified, the
+ container is run with a temporary
+ btrfs snapshot of
+ its root directory (as configured with
+ ), that
+ is removed immediately when the
+ container terminates. This option is
+ only supported if the root file system
+ is btrfs. May not
+ be specified together with
+ or
+ .
+
+
@@ -197,7 +263,9 @@
partitions, swap partitions or EFI
system partitions are not mounted. May
not be specified together with
- .
+ ,
+ or
+ .
@@ -237,13 +305,22 @@
Sets the machine name
for this container. This name may be
- used to identify this container on the
- host, and is used to initialize the
- container's hostname (which the
- container can choose to override,
- however). If not specified, the last
- component of the root directory of the
- container is used.
+ used to identify this container during
+ its runtime (for example in tools like
+ machinectl1
+ and similar), and is used to
+ initialize the container's hostname
+ (which the container can choose to
+ override, however). If not specified,
+ the last component of the root
+ directory path of the container is
+ used, possibly suffixed with a random
+ identifier in case
+ mode is
+ selected. If the root directory
+ selected is the host's root directory
+ the host's hostname is used as default
+ instead.
@@ -439,7 +516,9 @@
versa). Takes one of
no,
host,
+ try-host,
guest,
+ try-guest,
auto. If
no, the journal is
not linked. If host,
@@ -453,8 +532,11 @@
guest file system (beneath
/var/log/journal/machine-id)
and the subdirectory is symlinked into the host
- at the same location. If
- auto (the default),
+ at the same location. try-host
+ and try-guest do the same
+ but do not fail if the host does not have
+ persistant journalling enabled.
+ If auto (the default),
and the right subdirectory of
/var/log/journal
exists, it will be bind mounted
@@ -473,7 +555,7 @@
Equivalent to
- .
+ .
@@ -648,13 +730,13 @@
=MODEBoots the container in
- volatile (ephemeral) mode. When no
- mode parameter is passed or when mode
- is specified as yes
- full volatile mode is enabled. This
- means the root directory is mounted as
- mostly unpopulated
- tmpfs instance, and
+ volatile mode. When no mode parameter
+ is passed or when mode is specified as
+ yes full volatile
+ mode is enabled. This means the root
+ directory is mounted as mostly
+ unpopulated tmpfs
+ instance, and
/usr from the OS
tree is mounted into it, read-only
(the system thus starts up with
@@ -672,8 +754,8 @@
changes to the latter are lost on
shutdown). When the mode parameter is
specified as no
- (the default) the whole OS tree is made
- available writable.
+ (the default) the whole OS tree is
+ made available writable.
Note that setting this to
yes or
@@ -694,69 +776,73 @@
- Example 1
+ Examples
+
+ Boot a minimal Fedora distribution in a container
- # yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
+ # yum -y --releasever=21 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
# systemd-nspawn -bD /srv/mycontainer
- This installs a minimal Fedora distribution into
- the directory /srv/mycontainer/ and
- then boots an OS in a namespace container in
- it.
-
+ This installs a minimal Fedora distribution into
+ the directory /srv/mycontainer/ and
+ then boots an OS in a namespace container in
+ it.
+
-
- Example 2
+
+ Spawn a shell in a container of a minimal Debian unstable distribution
- # debootstrap --arch=amd64 unstable ~/debian-tree/
+ # debootstrap --arch=amd64 unstable ~/debian-tree/
# systemd-nspawn -D ~/debian-tree/
- This installs a minimal Debian unstable
- distribution into the directory
- ~/debian-tree/ and then spawns a
- shell in a namespace container in it.
-
+ This installs a minimal Debian unstable
+ distribution into the directory
+ ~/debian-tree/ and then spawns a
+ shell in a namespace container in it.
+
-
- Example 3
+
+ Boot a minimal Arch Linux distribution in a container
- # pacstrap -c -d ~/arch-tree/ base
+ # pacstrap -c -d ~/arch-tree/ base
# systemd-nspawn -bD ~/arch-tree/
- This installs a mimimal Arch Linux distribution into
- the directory ~/arch-tree/ and then
- boots an OS in a namespace container in it.
-
+ This installs a mimimal Arch Linux distribution into
+ the directory ~/arch-tree/ and then
+ boots an OS in a namespace container in it.
+
-
- Example 4
+
+ Enable Arch Linux container on boot
- # mv ~/arch-tree /var/lib/container/arch
+ # mv ~/arch-tree /var/lib/container/arch
# systemctl enable systemd-nspawn@arch.service
# systemctl start systemd-nspawn@arch.service
- This makes the Arch Linux container part of the
- multi-user.target on the host.
-
-
+ This makes the Arch Linux container part of the
+ multi-user.target on the host.
+
+
-
- Example 5
+
+ Boot into an ephemeral btrfs snapshot of the host system
- # btrfs subvolume snapshot / /.tmp
-# systemd-nspawn --private-network -D /.tmp -b
+ # systemd-nspawn -D / -xb
- This runs a copy of the host system in a
- btrfs snapshot.
-
+ This runs a copy of the host system in a
+ btrfs snapshot which is
+ removed immediately when the container
+ exits. All file system changes made during
+ runtime will be lost on shutdown,
+ hence.
+
-
- Example 6
+
+ Run a container with SELinux sandbox security contexts
- # chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+ # chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh
-
- This runs a container with SELinux sandbox security contexts.
+
@@ -773,9 +859,10 @@
chroot1,
yum8,
debootstrap8,
- pacman8,
+ pacman8,
systemd.slice5,
- machinectl1
+ machinectl1,
+ btrfs8