systemd-nspawn.xml revision 4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering This file is part of systemd.
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering Copyright 2010 Lennart Poettering
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering systemd is free software; you can redistribute it and/or modify it
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering under the terms of the GNU Lesser General Public License as published by
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering the Free Software Foundation; either version 2.1 of the License, or
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering (at your option) any later version.
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering systemd is distributed in the hope that it will be useful, but
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering WITHOUT ANY WARRANTY; without even the implied warranty of
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering Lesser General Public License for more details.
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering You should have received a copy of the GNU Lesser General Public License
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering along with systemd; If not, see <http://www.gnu.org/licenses/>.
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek xmlns:xi="http://www.w3.org/2001/XInclude">
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refentryinfo>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </authorgroup>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </refentryinfo>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refentrytitle>systemd-nspawn</refentrytitle>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refsynopsisdiv>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <command>systemd-nspawn</command>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">OPTIONS</arg>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt"><replaceable>COMMAND</replaceable>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">ARGS</arg>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <command>systemd-nspawn</command>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">OPTIONS</arg>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">ARGS</arg>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </cmdsynopsis>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </refsynopsisdiv>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para><command>systemd-nspawn</command> may be used to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering run a command or OS in a light-weight namespace
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering container. In many ways it is similar to
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering but more powerful since it fully virtualizes the file
9f7dad774ebfad23269800b7096eaad087481debVille Skyttä system hierarchy, as well as the process tree, the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering various IPC subsystems and the host and domain
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para><command>systemd-nspawn</command> limits access
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering to various kernel interfaces in the container to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering read-only, such as <filename>/sys</filename>,
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering <filename>/sys/fs/selinux</filename>. Network
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering interfaces and the system clock may not be changed
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering from within the container. Device nodes may not be
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering created. The host system cannot be rebooted and kernel
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering modules may not be loaded from within the
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering container.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that even though these security precautions
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering are taken <command>systemd-nspawn</command> is not
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering suitable for secure container setups. Many of the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering security features may be circumvented and are hence
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering primarily useful to avoid accidental changes to the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering host system from the container. The intended use of
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering this program is debugging and testing as well as
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering building of packages, distributions and software
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering involved with boot and systems management.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>In contrast to
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry> <command>systemd-nspawn</command>
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek may be used to boot full Linux-based operating systems
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek in a container.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Use a tool like
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='die-net'><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='die-net'><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
c45827d6e70baf6b683d7cafb13a9a6f02852731Ronny Chevalier <citerefentry project='archlinux'><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering to set up an OS directory tree suitable as file system
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering hierarchy for <command>systemd-nspawn</command>
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering containers.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that <command>systemd-nspawn</command> will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering mount file systems private to the container to
2b583ce6576d4a074ce6f1570b3e60b65c64ae7dKay Sievers <filename>/run</filename> and similar. These will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering not be visible outside of the container, and their
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering contents will be lost when the container exits.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that running two
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <command>systemd-nspawn</command> containers from the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering same directory tree will not make processes in them
9f7dad774ebfad23269800b7096eaad087481debVille Skyttä see each other. The PID namespace separation of the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering two containers is complete and the containers will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering share very few runtime objects except for the
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering underlying file system. Use
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <command>login</command> command to request an
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering additional login prompt in a running container.</para>
9980033377c105d2cd6539c9d73ee61d4c2263b0Lennart Poettering <para><command>systemd-nspawn</command> implements the
9980033377c105d2cd6539c9d73ee61d4c2263b0Lennart Poettering url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <para>As a safety check
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <command>systemd-nspawn</command> will verify the
5ae4d543cb9b45ad6c6b82b78da1d6abc2291cdbLennart Poettering existence of <filename>/usr/lib/os-release</filename>
5ae4d543cb9b45ad6c6b82b78da1d6abc2291cdbLennart Poettering or <filename>/etc/os-release</filename> in the
5ae4d543cb9b45ad6c6b82b78da1d6abc2291cdbLennart Poettering container tree before starting the container (see
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>). It
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering might be necessary to add this file to the container
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering tree manually if the OS of the container is too old to
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering contain this file out-of-the-box.</para>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <para>If option <option>-b</option> is specified, the
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek arguments are used as arguments for the init
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek binary. Otherwise, <replaceable>COMMAND</replaceable>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek specifies the program to launch in the container, and
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek the remaining arguments are used as arguments for this
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek program. If <option>-b</option> is not used and no
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek arguments are specifed, a shell is launched in the
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek container.</para>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <para>The following options are understood:</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <variablelist>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <varlistentry>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering file system root for the container.</para>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <para>If neither
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering the directory is determined as
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering suffixed by the machine name as
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering specified with
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering specified, the current directory will
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering be used. May not be specified together
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering <option>--image=</option>.</para></listitem>
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering </varlistentry>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <varlistentry>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <term><option>--template=</option></term>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering use as template for the container's
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering root directory. If this is specified
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering and the container's root directory (as
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering not yet exist it is created as
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering populated from this template
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering tree. Ideally, the specified template
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering path refers to the root of a
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering which case a simple copy-on-write
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering snapshot is taken, and populating the
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering root directory is instant. If the
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering specified template path does not refer
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering to the root of a
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering file system at all), the tree is
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering copied, which can be substantially
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering more time-consuming. Note that if this
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering option is used the container's root
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering directory (in contrast to the template
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering directory!) must be located on a
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering subvolume may be created. May not be
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering specified together with
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <option>--ephemeral</option>.</para></listitem>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering </varlistentry>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <varlistentry>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <term><option>--ephemeral</option></term>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering container is run with a temporary
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering its root directory (as configured with
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering is removed immediately when the
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering container terminates. This option is
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering only supported if the root file system
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering be specified together with
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <option>--template=</option>.</para></listitem>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering </varlistentry>
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering <varlistentry>
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering the root directory for the container
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering from. Takes a path to a regular file
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering or to a block device node. The file or
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering block device must contain either an
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering MBR partition table with a single
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering partition of type 0x83 that is marked
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering bootable, or a GUID partition table
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering with a root partition which is mounted
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering as the root directory of the
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering container. Optionally, GPT images may
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering partition which are mounted to the
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering appropriate places in the
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering container. All these partitions must
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering be identified by the partition types
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering defined by the <ulink
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering url="http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec/">Discoverable
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering Partitions Specification</ulink>. Any
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering other partitions, such as foreign
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering partitions, swap partitions or EFI
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering system partitions are not mounted. May
1b9e5b126359a2a2ec37de1f94f046093abc74b8Lennart Poettering not be specified together with
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering <option>--ephemeral</option>.</para></listitem>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </varlistentry>
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering <varlistentry>
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering for an init binary and invoke it
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering instead of a shell or a user supplied
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering program. If this option is used,
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering arguments specified on the command
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering line are used as arguments for the
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering init binary. This option may not be
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering </varlistentry>
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil <varlistentry>
1810e3dc6218afd69c469cfb816254730a0ef4e3Lennart Poettering into the container, change to the
70a44afee385c4afadaab9a002b3f9dd44aedf4aJan Engelhardt specified user-defined in the
1810e3dc6218afd69c469cfb816254730a0ef4e3Lennart Poettering container's user database. Like all
1810e3dc6218afd69c469cfb816254730a0ef4e3Lennart Poettering other systemd-nspawn features, this is
1810e3dc6218afd69c469cfb816254730a0ef4e3Lennart Poettering not a security feature and provides
1810e3dc6218afd69c469cfb816254730a0ef4e3Lennart Poettering protection against accidental
1810e3dc6218afd69c469cfb816254730a0ef4e3Lennart Poettering destructive operations
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil </varlistentry>
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering <varlistentry>
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering for this container. This name may be
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering used to identify this container during
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering its runtime (for example in tools like
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering and similar), and is used to
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering initialize the container's hostname
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering (which the container can choose to
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering override, however). If not specified,
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering the last component of the root
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering directory path of the container is
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering used, possibly suffixed with a random
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering identifier in case
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering selected. If the root directory
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering selected is the host's root directory
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering the host's hostname is used as default
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering </varlistentry>
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering <varlistentry>
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering for the container. The init system
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering will initialize
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering from this if this file is not set yet.
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering part of the specified slice, instead
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering of the default
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <filename>machine.slice</filename>.</para>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering <varlistentry>
ff01d048b4c1455241c894cf7982662c9d28fd34Lennart Poettering <term><option>--private-network</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering of the container from the host. This
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering makes all network interfaces
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering unavailable in the container, with the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering exception of the loopback device and
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering those specified with
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen and configured with
73e231abde39f22097df50542c745e01de879836Jan Engelhardt this option is specified, the
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering CAP_NET_ADMIN capability will be added
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering to the set of capabilities the
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering container retains. The latter may be
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering disabled by using
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering <option>--drop-capability=</option>.</para></listitem>
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering </varlistentry>
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering <varlistentry>
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering <term><option>--network-interface=</option></term>
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering network interface to the
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering container. This will remove the
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering specified interface from the calling
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering namespace and place it in the
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering container. When the container
73e231abde39f22097df50542c745e01de879836Jan Engelhardt terminates, it is moved back to the
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering host namespace. Note that
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering option may be used more than once to
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering add multiple network interfaces to the
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering </varlistentry>
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering <varlistentry>
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering <term><option>--network-macvlan=</option></term>
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering of the specified Ethernet network
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering interface and add it to the
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering is a virtual interface that adds a
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering second MAC address to an existing
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering physical Ethernet link. The interface
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering in the container will be named after
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering the interface on the host, prefixed
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering option may be used more than once to
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering add multiple network interfaces to the
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering </varlistentry>
bc2f673ec24b59948fcfc35b3077fda0314e69d8Lennart Poettering <varlistentry>
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen <term><option>--network-ipvlan=</option></term>
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen of the specified Ethernet network
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen interface and add it to the
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen container. An
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen is a virtual interface, similar to a
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen uses the same MAC address as the underlying
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen interface. The interface
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen in the container will be named after
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen the interface on the host, prefixed
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen option may be used more than once to
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen add multiple network interfaces to the
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen </varlistentry>
4bbfe7ad22b0666e82719e39e40be1c6cbb5cc91Tom Gundersen <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--network-veth</option></term>
c74e630d0ce4b1ace116e8211f3b6eb472efa7e3Lennart Poettering and container. The host side of the
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt Ethernet link will be available as a
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering network interface named after the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering container's name (as specified with
dca348bcbb462305864526c587495a14a76bfcdeJan Engelhardt container side of the Ethernet
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering link will be named
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <option>--private-network</option>.</para></listitem>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen <varlistentry>
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen <term><option>--network-bridge=</option></term>
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering the Ethernet link created with
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering specified bridge. Note that
b8bde11658366290521e3d03316378b482600323Jan Engelhardt this option is used, the host side of
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering the Ethernet link will use the
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering of <literal>ve-</literal>.</para></listitem>
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen </varlistentry>
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering <varlistentry>
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering is enabled, maps an IP port on the
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering host onto an IP port on the
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering container. Takes a protocol specifier
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering a colon from a host port number in the
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering range 1 to 65535, separated by a colon
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering from a container port number in the
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering range from 1 to 65535. The protocol
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering specifier and its separating colon may
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering be omitted, in which case
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering The container port number and its
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering colon may be ommitted, in which case
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering the same port as the host port is
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering implied. This option is only supported
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering if private networking is used, such as
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering <option>--network-bridge=</option>.</para></listitem>
6d0b55c272ea31d025e8b3c311cea8cda0bfefd7Lennart Poettering </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--selinux-context=</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering security context to be used to label
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering processes in the container.</para>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--selinux-apifs-context=</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <listitem><para>Sets the SELinux security
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering context to be used to label files in
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering the virtual API file systems in the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering container.</para>
bc2f673ec24b59948fcfc35b3077fda0314e69d8Lennart Poettering </varlistentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <varlistentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <term><option>--capability=</option></term>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering additional capabilities to grant the
e9dd9f9547350c7dc0473583b5c2228dc8f0ab76Jason St. John container. Takes a comma-separated
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering list of capability names, see
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering for more information. Note that the
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering following capabilities will be granted
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering in any way: CAP_CHOWN,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_KILL, CAP_LEASE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_LINUX_IMMUTABLE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_NET_BIND_SERVICE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_NET_BROADCAST, CAP_NET_RAW,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SETUID, CAP_SYS_ADMIN,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SYS_CHROOT, CAP_SYS_NICE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering CAP_SYS_RESOURCE, CAP_SYS_BOOT,
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering CAP_AUDIT_WRITE,
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering is retained if
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering specified. If the special value
39ed67d14694983dabd6641c02216aa440eed767Lennart Poettering capabilities are
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering </varlistentry>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering <varlistentry>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering <term><option>--drop-capability=</option></term>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering additional capabilities to drop for
420c7379fb96a188459690a634d0fede55721183Lennart Poettering the container. This allows running the
420c7379fb96a188459690a634d0fede55721183Lennart Poettering container with fewer capabilities than
420c7379fb96a188459690a634d0fede55721183Lennart Poettering the default (see above).</para></listitem>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering </varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <term><option>--link-journal=</option></term>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering container's journal shall be made
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt visible to the host system. If enabled,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering allows viewing the container's journal
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering files from the host (but not vice
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering versa). Takes one of
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek <literal>no</literal>, the journal is
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek not linked. If <literal>host</literal>,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering the journal files are stored on the
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek host file system (beneath
e670b166a08b7c1031a9e7d7675fa9a29c3e19c9Zbigniew Jędrzejewski-Szmek <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the subdirectory is bind-mounted
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering into the container at the same
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek location. If <literal>guest</literal>,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering the journal files are stored on the
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek guest file system (beneath
e670b166a08b7c1031a9e7d7675fa9a29c3e19c9Zbigniew Jędrzejewski-Szmek <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the subdirectory is symlinked into the host
574edc90066c3faeadcf4666928ed9b0ac409c75Martin Pitt at the same location. <literal>try-host</literal>
574edc90066c3faeadcf4666928ed9b0ac409c75Martin Pitt but do not fail if the host does not have
f131770b1465fbf423881f16ba85523a05f846feVeres Lajos persistent journalling enabled.
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the right subdirectory of
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek exists, it will be bind mounted
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek into the container. If the
6b4991cfde6c0a0b62e836ca75ae362779c474d4Jan Engelhardt subdirectory does not exist, no
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek linking is performed. Effectively,
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek booting a container once with
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek journal persistently if further on
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering </varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <varlistentry>
574edc90066c3faeadcf4666928ed9b0ac409c75Martin Pitt <option>--link-journal=try-guest</option>.</para></listitem>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--read-only</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering system read-only for the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering <varlistentry>
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering directory from the host into the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering container. Either takes a path
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering argument -- in which case the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering specified path will be mounted from
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering the host to the same path in the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering container --, or a colon-separated
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering pair of paths -- in which case the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering first specified path is the source in
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering the host, and the second path is the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering destination in the container. The
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering creates read-only bind
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering </varlistentry>
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering <varlistentry>
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering system into the container. Takes a
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering single absolute path argument that
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering specifies where to mount the tmpfs
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering instance to (in which case the
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering directory access mode will be chosen
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering optionally a colon-separated pair of
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering path and mount option string, that is
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering used for mounting (in which case the
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering kernel default for access mode and
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering owner will be chosen, unless otherwise
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering specified). This option is
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering particularly useful for mounting
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering directories such as
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering allow state-less systems, in
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering particular when combined with
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering <option>--read-only</option>.</para></listitem>
06c17c39a8345deef1ecff4dd5ef262f968c9be2Lennart Poettering </varlistentry>
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering <varlistentry>
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering environment variable assignment to
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering pass to the init process in the
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering container, in the format
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering may be used to override the default
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering variables or to set additional
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering variables. This parameter may be used
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering </varlistentry>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering <varlistentry>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering <term><option>--share-system</option></term>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering to share certain system facilities
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering with the host. More specifically, this
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering turns off PID namespacing, UTS
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering namespacing and IPC namespacing, and
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering thus allows the guest to see and
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering interact more easily with processes
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering outside of the container. Note that
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering using this option makes it impossible
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering to start up a full Operating System in
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering the container, as an init system
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering cannot operate in this mode. It is
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering only useful to run specific programs
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering or applications this way, without
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering involving an init system in the
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering container. This option implies
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering option may not be combined with
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <option>--boot</option>.</para></listitem>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering </varlistentry>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <varlistentry>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <term><option>--register=</option></term>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering container is registered with
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <citerefentry><refentrytitle>systemd-machined</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Takes
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering a boolean argument, defaults to
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering should be enabled when the container
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering runs a full Operating System (more
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering specifically: an init system), and is
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering useful to ensure that the container is
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering accessible via
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering and shown by tools such as
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum></citerefentry>. If
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering the container does not run an init
73e231abde39f22097df50542c745e01de879836Jan Engelhardt system, it is recommended to set this
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering </varlistentry>
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering <varlistentry>
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering <term><option>--keep-unit</option></term>
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering transient scope unit to run the
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering container in, simply register the
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering service or scope unit
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt been invoked in with
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering <citerefentry><refentrytitle>systemd-machined</refentrytitle><manvolnum>8</manvolnum></citerefentry>. This
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering has no effect if
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering used. This switch should be used if
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt invoked from within a service unit,
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering and the service unit's sole purpose
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering is to run a single
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering container. This option is not
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering available if run from a user
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering </varlistentry>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering <varlistentry>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering <term><option>--personality=</option></term>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering architecture ("personality") reported
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering <citerefentry><refentrytitle>uname</refentrytitle><manvolnum>2</manvolnum></citerefentry>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering in the container. Currently, only
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering supported. This is useful when running
70a44afee385c4afadaab9a002b3f9dd44aedf4aJan Engelhardt a 32-bit container on a 64-bit
b8bde11658366290521e3d03316378b482600323Jan Engelhardt host. If this setting is not used,
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering the personality reported in the
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering container is the same as the one
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering reported on the
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering </varlistentry>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <term><option>-q</option></term>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <term><option>--quiet</option></term>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <listitem><para>Turns off any status
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek output by the tool itself. When this
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek switch is used, the only output
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek from nspawn will be the console output
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek of the container OS itself.</para></listitem>
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering <varlistentry>
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering <term><option>--volatile</option><replaceable>=MODE</replaceable></term>
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering volatile mode. When no mode parameter
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering is passed or when mode is specified as
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering mode is enabled. This means the root
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering directory is mounted as mostly
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering tree is mounted into it, read-only
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering (the system thus starts up with
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering read-only OS resources, but pristine
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering state and configuration, any changes
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering to the either are lost on
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering shutdown). When the mode parameter is
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering the OS tree is mounted read-only, but
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering into it (the system thus starts up
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering with read-only OS resources and
06b643e7f5a3b79005dd57497897ab7255fe3659Ruben Kerkhof configuration, but pristine state, any
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering changes to the latter are lost on
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering shutdown). When the mode parameter is
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering (the default) the whole OS tree is
ec16945ebfe64d5cd5403ae1a1b16bc05a779a16Lennart Poettering made available writable.</para>
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering <para>Note that setting this to
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering work correctly with operating systems
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering in the container that can boot up with
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering mounted, and are able to populate
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering automatically, as
108e8cd11e88bd4795a62bf335921d438592601cLennart Poettering </varlistentry>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <xi:include href="standard-options.xml" xpointer="help" />
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <xi:include href="standard-options.xml" xpointer="version" />
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </variablelist>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <title>Boot a minimal Fedora distribution in a container</title>
667993e88eb7519c6674fe9a9e985619817465e0Lennart Poettering <programlisting># yum -y --releasever=21 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
2b3987a863975f5a1fa1754725e3d07a5d4f6478Lennart Poettering# systemd-nspawn -bD /srv/mycontainer</programlisting>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <para>This installs a minimal Fedora distribution into
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier the directory <filename noindex='true'>/srv/mycontainer/</filename> and
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier then boots an OS in a namespace container in
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <title>Spawn a shell in a container of a minimal Debian unstable distribution</title>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering# systemd-nspawn -D ~/debian-tree/</programlisting>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <para>This installs a minimal Debian unstable
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier distribution into the directory
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <filename>~/debian-tree/</filename> and then spawns a
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier shell in a namespace container in it.</para>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <title>Boot a minimal Arch Linux distribution in a container</title>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <programlisting># pacstrap -c -d ~/arch-tree/ base
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas# systemd-nspawn -bD ~/arch-tree/</programlisting>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <para>This installs a mimimal Arch Linux distribution into
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier the directory <filename>~/arch-tree/</filename> and then
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier boots an OS in a namespace container in it.</para>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <title>Enable Arch Linux container on boot</title>
5f129649b97bdff2bffefcd9c773157843ede6f6Lennart Poettering <programlisting># mv ~/arch-tree /var/lib/machines/arch
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek# systemctl enable systemd-nspawn@arch.service
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek# systemctl start systemd-nspawn@arch.service</programlisting>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <para>This makes the Arch Linux container part of the
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <filename>multi-user.target</filename> on the host.
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering <title>Boot into an ephemeral <literal>btrfs</literal> snapshot of the host system</title>
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering <programlisting># systemd-nspawn -D / -xb</programlisting>
1db8c66f2e500272cb5582f9087b8e2a123aee10Ronny Chevalier <para>This runs a copy of the host system in a
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering <literal>btrfs</literal> snapshot which is
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering removed immediately when the container
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering exits. All file system changes made during
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering runtime will be lost on shutdown,
0b3b83e59b637660524e90a07f9ef691856b19bfLennart Poettering <title>Run a container with SELinux sandbox security contexts</title>
0b3b83e59b637660524e90a07f9ef691856b19bfLennart Poettering <programlisting># chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
a8828ed93878b4b4866d40ebfb660e54995ff72eDaniel J Walsh# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh</programlisting>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>The exit code of the program executed in the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering container is returned.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='die-net'><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
5aded369782f28255bc6b494ca905d7acaea7a56Zbigniew Jędrzejewski-Szmek <citerefentry project='die-net'><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
c45827d6e70baf6b683d7cafb13a9a6f02852731Ronny Chevalier <citerefentry project='archlinux'><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
b9ba4dabbab8a58a044ec42655e11e65bd3ecc47Lennart Poettering <citerefentry><refentrytitle>btrfs</refentrytitle><manvolnum>8</manvolnum></citerefentry>