X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd-nspawn.xml;h=aea50559f04f643e87ad6173390bc749f3a75663;hp=b34d38c9b53638926654675739c714bf0ecff1de;hb=41488fe9024a8955d19811620fd55dcc56a5b2ba;hpb=66f756d437658cc464bfb5647c97efd0cf77f933 diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index b34d38c9b..aea50559f 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -21,7 +21,8 @@ along with systemd; If not, see . --> - + systemd-nspawn @@ -69,7 +70,7 @@ systemd-nspawn may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to - chroot1, + chroot1, but more powerful since it fully virtualizes the file system hierarchy, as well as the process tree, the various IPC subsystems and the host and domain @@ -97,15 +98,15 @@ involved with boot and systems management. In contrast to - chroot1 systemd-nspawn + chroot1 systemd-nspawn may be used to boot full Linux-based operating systems in a container. Use a tool like - yum8, - debootstrap8, + yum8, + debootstrap8, or - pacman8 + pacman8 to set up an OS directory tree suitable as file system hierarchy for systemd-nspawn containers. @@ -135,8 +136,9 @@ As a safety check systemd-nspawn will verify the - existence of /etc/os-release in - the container tree before starting the container (see + existence of /usr/lib/os-release + or /etc/os-release in the + container tree before starting the container (see os-release5). It might be necessary to add this file to the container tree manually if the OS of the container is too old to @@ -158,41 +160,44 @@ The following options are understood: - - - - - Prints a short help - text and exits. - - - - - - Prints a version string - and exits. - - - - - - - Turns off any status - output by the tool itself. When this - switch is used, the only output - from nspawn will be the console output - of the container OS itself. - - Directory to use as - file system root for the namespace - container. If omitted, the current - directory will be - used. + file system root for the container. If + neither + nor are + specified, the current directory will + be used. May not be specified together with + . + + + + + + + Disk image to mount + the root directory for the container + from. Takes a path to a regular file + or to a block device node. The file or + block device must contain a GUID + Partition Table with a root partition + which is mounted as the root directory + of the container. Optionally, it may + contain a home and/or a server data + partition which are mounted to the + appropriate places in the + container. All these partitions must + be identified by the partition types + defined by the Discoverable + Partitions Specification. Any + other partitions, such as foreign + partitions, swap partitions or EFI + system partitions are not mounted. May + not be specified together with + . @@ -215,13 +220,15 @@ - Run the command - under specified user, create home - directory and cd into it. As rest - of systemd-nspawn, this is not - the security feature and limits - against accidental changes only. - + After transitioning + into the container, change to the + specified user-defined in the + container's user database. Like all + other systemd-nspawn features, this is + not a security feature and provides + protection against accidental + destructive operations + only. @@ -285,7 +292,7 @@ Assign the specified network interface to the - container. This will move the + container. This will remove the specified interface from the calling namespace and place it in the container. When the container @@ -299,18 +306,42 @@ container. + + + + Create a + macvlan interface + of the specified Ethernet network + interface and add it to the + container. A + macvlan interface + is a virtual interface that adds a + second MAC address to an existing + physical Ethernet link. The interface + in the container will be named after + the interface on the host, prefixed + with mv-. Note that + + implies + . This + option may be used more than once to + add multiple network interfaces to the + container. + + Create a virtual - Ethernet link between host and - container. The host side of the + Ethernet link + (veth) between host + and container. The host side of the Ethernet link will be available as a network interface named after the container's name (as specified with ), prefixed with ve-. The - container side of the the Ethernet + container side of the Ethernet link will be named host0. Note that @@ -321,13 +352,17 @@ - Adds the host side of the - Ethernet link created with - - to the specified bridge. Note that - + Adds the host side of + the Ethernet link created with + to the + specified bridge. Note that + implies - . + . If + this option is used, the host side of + the Ethernet link will use the + vb- prefix instead + of ve-. @@ -358,7 +393,7 @@ additional capabilities to grant the container. Takes a comma-separated list of capability names, see - capabilities7 + capabilities7 for more information. Note that the following capabilities will be granted in any way: CAP_CHOWN, @@ -466,7 +501,31 @@ destination in the container. The option creates read-only bind - mount. + mounts. + + + + + + Mount a tmpfs file + system into the container. Takes a + single absolute path argument that + specifies where to mount the tmpfs + instance to (in which case the + directory access mode will be chosen + as 0755, owned by root/root), or + optionally a colon-separated pair of + path and mount option string, that is + used for mounting (in which case the + kernel default for access mode and + owner will be chosen, unless otherwise + specified). This option is + particularly useful for mounting + directories such as + /var as tmpfs, to + allow state-less systems, in + particular when combined with + . @@ -522,7 +581,7 @@ accessible via machinectl1 and shown by tools such as - ps1. If + ps1. If the container does not run an init system, it is recommended to set this option to no. Note @@ -555,6 +614,81 @@ session. + + + + Control the + architecture ("personality") reported + by + uname2 + in the container. Currently, only + x86 and + x86-64 are + supported. This is useful when running + a 32-bit container on a 64-bit + host. If this setting is not used, + the personality reported in the + container is the same as the one + reported on the + host. + + + + + + + Turns off any status + output by the tool itself. When this + switch is used, the only output + from nspawn will be the console output + of the container OS itself. + + + + =MODE + + Boots the container in + volatile (ephemeral) mode. When no + mode parameter is passed or when mode + is specified as yes + full volatile mode is enabled. This + means the root directory is mounted as + mostly unpopulated + tmpfs instance, and + /usr from the OS + tree is mounted into it, read-only + (the system thus starts up with + read-only OS resources, but pristine + state and configuration, any changes + to the either are lost on + shutdown). When the mode parameter is + specified as state + the OS tree is mounted read-only, but + /var is mounted + as tmpfs instance + into it (the system thus starts up + with read-only OS resources and + configuration, but prestine state, any + changes to the latter are lost on + shutdown). When the mode parameter is + specified as no + (the default) the whole OS tree is made + available writable. + + Note that setting this to + yes or + state will only + work correctly with operating systems + in the container that can boot up with + only /usr + mounted, and are able to populate + /var + automatically, as + needed. + + + + @@ -636,10 +770,10 @@ See Also systemd1, - chroot1, - yum8, - debootstrap8, - pacman8, + chroot1, + yum8, + debootstrap8, + pacman8, systemd.slice5, machinectl1