container. In many ways it is similar to
<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
but more powerful since it fully virtualizes the file
- system hierachy, as well as the process tree, the
+ system hierarchy, as well as the process tree, the
various IPC subsystems and the host and domain
name.</para>
<para>Note that running two
<command>systemd-nspawn</command> containers from the
same directory tree will not make processes in them
- see each other. The PID namespace seperation of the
+ see each other. The PID namespace separation of the
two containers is complete and the containers will
share very few runtime objects except for the
underlying file system.</para>
<variablelist>
<varlistentry>
<term><option>--help</option></term>
+ <term><option>-h</option></term>
<listitem><para>Prints a short help
text and exits.</para></listitem>
used.</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term><option>--user=</option></term>
+ <term><option>--u</option></term>
+
+ <listitem><para>Run the command
+ under specified user, create home
+ directory and cd into it. As rest
+ of systemd-nspawn, this is not
+ the security feature and limits
+ against accidental changes only.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><option>--no-net</option></term>
+
+ <listitem><para>Turn off networking in
+ the container. This makes all network
+ interfaces unavailable in the
+ container, with the exception of the
+ loopback device.</para></listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>