lxc-unshare.sgml.in revision 810567bbbe283c547e4ac837545d1e592916df26
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainenlxc: linux Container library
e015e2f7e7f48874495f9df8b0dd192b7ffcb5ccTimo Sirainen(C) Copyright IBM Corp. 2007, 2008
1098fc409a45e7603701dc94635927a673bee0c1Timo SirainenDaniel Lezcano <dlezcano at fr.ibm.com>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenSerge Hallyn <serge.hallyn at ubuntu.com>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenThis library is free software; you can redistribute it and/or
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainenmodify it under the terms of the GNU Lesser General Public
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenLicense as published by the Free Software Foundation; either
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainenversion 2.1 of the License, or (at your option) any later version.
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenThis library is distributed in the hope that it will be useful,
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainenbut WITHOUT ANY WARRANTY; without even the implied warranty of
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenLesser General Public License for more details.
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenYou should have received a copy of the GNU Lesser General Public
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenLicense along with this library; if not, write to the Free Software
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen<!ENTITY commonoptions SYSTEM "@builddir@/common_options.sgml">
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">
ad850190d946d34966a56838cfdb216e021b5b5fTimo Sirainen <docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen Run a task in a new set of namespaces.
8aacc9e7c84f8376822823ec98c2f551d4919b2eTimo Sirainen </refpurpose>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen </refnamediv>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen <refsynopsisdiv>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen <cmdsynopsis>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen <arg choice="req">-s <replaceable>namespaces</replaceable></arg>
1098fc409a45e7603701dc94635927a673bee0c1Timo Sirainen <arg choice="req">-u <replaceable>user</replaceable></arg>
1098fc409a45e7603701dc94635927a673bee0c1Timo Sirainen </cmdsynopsis>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen </refsynopsisdiv>
d9fdacd5fb3e07997e5c389739d2054f0c8441d8Timo Sirainen <command>lxc-unshare</command> can be used to run a task in a cloned set
d9fdacd5fb3e07997e5c389739d2054f0c8441d8Timo Sirainen of namespaces. This command is mainly provided for testing purposes.
d9fdacd5fb3e07997e5c389739d2054f0c8441d8Timo Sirainen Despite its name, it always uses clone rather than unshare to create
d9fdacd5fb3e07997e5c389739d2054f0c8441d8Timo Sirainen the new task with fresh namespaces. Apart from testing kernel
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen regressions this should make no difference.
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainen <variablelist>
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainen <varlistentry>
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainen <option>-s <replaceable>namespaces</replaceable></option>
3b20a37cb65c70f55e48dbdc912313fdacdab630Timo Sirainen Specify the namespaces to attach to, as a pipe-separated list,
3b20a37cb65c70f55e48dbdc912313fdacdab630Timo Sirainen e.g. <replaceable>NETWORK|IPC</replaceable>. Allowed values are
51b979b6414b940f04677a7e2d064be119345954Timo Sirainen <replaceable>MOUNT</replaceable>, <replaceable>PID</replaceable>,
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainen <replaceable>UTSNAME</replaceable>, <replaceable>IPC</replaceable>,
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainen <replaceable>NETWORK</replaceable>. This allows one to change
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainen the context of the process to e.g. the network namespace of the
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainen container while retaining the other namespaces as those of the
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen </varlistentry>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen <varlistentry>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen <option>-u <replaceable>user</replaceable></option>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen Specify a user which the new task should become. This option is
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen only valid if a user namespace is unshared.
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen </varlistentry>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen </variablelist>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen To spawn a new shell with its own UTS (hostname) namespace,
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen <programlisting>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen </programlisting>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen If the hostname is changed in that shell, the change will not be
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen reflected on the host.
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen To spawn a shell in a new network, pid, and mount namespace,
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen <programlisting>
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainen </programlisting>
6a19e109ee8c5a6f688da83a86a7f6abeb71abddTimo Sirainen The resulting shell will have pid 1 and will see no network interfaces.
6a19e109ee8c5a6f688da83a86a7f6abeb71abddTimo Sirainen After re-mounting /proc in that shell,
6a19e109ee8c5a6f688da83a86a7f6abeb71abddTimo Sirainen <programlisting>
d9fdacd5fb3e07997e5c389739d2054f0c8441d8Timo Sirainen mount -t proc proc /proc
d9fdacd5fb3e07997e5c389739d2054f0c8441d8Timo Sirainen </programlisting>
69e03a846f6980144aa75bff0590c04852bffbbcTimo Sirainen ps output will show there are no other processes in the namespace.
c53e8ee216904ffe6de4f6518d9f9f5107b7610eTimo Sirainen <para>Daniel Lezcano <email>daniel.lezcano@free.fr</email></para>
fd2f5fbc1f07aa93e2214a28cdf02437fb7d06c8Timo Sirainen<!-- Keep this comment at the end of the file
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo SirainenLocal variables:
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainensgml-omittag:t
abe7afb8f1766fbcef1b9df513109e43d7d16e49Timo Sirainensgml-shorttag:t
1098fc409a45e7603701dc94635927a673bee0c1Timo Sirainensgml-minimize-attributes:nil
fd2f5fbc1f07aa93e2214a28cdf02437fb7d06c8Timo Sirainensgml-always-quote-attributes:t
fd2f5fbc1f07aa93e2214a28cdf02437fb7d06c8Timo Sirainensgml-indent-step:2
0cb2e8eb55e70f8ebe1e8349bdf49e4cbe5d8834Timo Sirainensgml-indent-data:t
e015e2f7e7f48874495f9df8b0dd192b7ffcb5ccTimo Sirainensgml-parent-document:nil
e015e2f7e7f48874495f9df8b0dd192b7ffcb5ccTimo Sirainensgml-default-dtd-file:nil
e015e2f7e7f48874495f9df8b0dd192b7ffcb5ccTimo Sirainensgml-exposed-tags:nil
6a19e109ee8c5a6f688da83a86a7f6abeb71abddTimo Sirainensgml-local-catalogs:nil
6a19e109ee8c5a6f688da83a86a7f6abeb71abddTimo Sirainensgml-local-ecat-files:nil