</listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>-L</option></term>
+ <term><option>--file-label=</option></term>
+
+ <listitem><para>Sets the mandatory
+ access control (MAC) file label to be
+ used by tmpfs file systems in the
+ container.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>-Z</option></term>
+ <term><option>--process-label=</option></term>
+
+ <listitem><para>Sets the mandatory
+ access control (MAC) label to be used by
+ processes in the container.</para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term><option>--uuid=</option></term>
creates read-only bind
mount.</para></listitem>
</varlistentry>
+
+ <varlistentry>
+ <term><option>--setenv=</option></term>
+
+ <listitem><para>Specifies an
+ environment variable assignment to
+ pass to the init process in the
+ container, in the format
+ <literal>NAME=VALUE</literal>. This
+ may be used to override the default
+ variables or to set additional
+ variables. This parameter may be used
+ more than once.</para></listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>
</para>
</refsect1>
+ <refsect1>
+ <title>Example 5</title>
+
+ <programlisting># btrfs subvolume snapshot / /.tmp
+# systemd-nspawn --private-network -D /.tmp -b</programlisting>
+
+ <para>This runs a copy of the host system in a
+ btrfs snapshot.</para>
+ </refsect1>
+
+ <refsect1>
+ <title>Example 6</title>
+
+ <programlisting># chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
+# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh</programlisting>
+
+ <para>This runs a container with SELinux sandbox labels.</para>
+ </refsect1>
+
<refsect1>
<title>Exit status</title>