systemd-nspawn.xml revision dfdebb1b925332352966804303b2516a6506a429
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering This file is part of systemd.
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering Copyright 2010 Lennart Poettering
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering systemd is free software; you can redistribute it and/or modify it
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering under the terms of the GNU Lesser General Public License as published by
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering the Free Software Foundation; either version 2.1 of the License, or
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering (at your option) any later version.
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering systemd is distributed in the hope that it will be useful, but
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering WITHOUT ANY WARRANTY; without even the implied warranty of
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering Lesser General Public License for more details.
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering You should have received a copy of the GNU Lesser General Public License
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering along with systemd; If not, see <http://www.gnu.org/licenses/>.
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek xmlns:xi="http://www.w3.org/2001/XInclude">
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refentryinfo>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </authorgroup>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </refentryinfo>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refentrytitle>systemd-nspawn</refentrytitle>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refsynopsisdiv>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <command>systemd-nspawn</command>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">OPTIONS</arg>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt"><replaceable>COMMAND</replaceable>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">ARGS</arg>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <command>systemd-nspawn</command>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">OPTIONS</arg>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">ARGS</arg>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </cmdsynopsis>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </refsynopsisdiv>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para><command>systemd-nspawn</command> may be used to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering run a command or OS in a light-weight namespace
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering container. In many ways it is similar to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering but more powerful since it fully virtualizes the file
9f7dad774ebfad23269800b7096eaad087481debVille Skyttä system hierarchy, as well as the process tree, the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering various IPC subsystems and the host and domain
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para><command>systemd-nspawn</command> limits access
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering to various kernel interfaces in the container to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering read-only, such as <filename>/sys</filename>,
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering <filename>/sys/fs/selinux</filename>. Network
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering interfaces and the system clock may not be changed
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering from within the container. Device nodes may not be
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering created. The host system cannot be rebooted and kernel
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering modules may not be loaded from within the
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering container.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that even though these security precautions
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering are taken <command>systemd-nspawn</command> is not
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering suitable for secure container setups. Many of the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering security features may be circumvented and are hence
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering primarily useful to avoid accidental changes to the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering host system from the container. The intended use of
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering this program is debugging and testing as well as
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering building of packages, distributions and software
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering involved with boot and systems management.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>In contrast to
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry> <command>systemd-nspawn</command>
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek may be used to boot full Linux-based operating systems
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek in a container.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Use a tool like
4d62fb4298a5904a53f484636c91540d08f68765Lennart Poettering <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
4d62fb4298a5904a53f484636c91540d08f68765Lennart Poettering <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering to set up an OS directory tree suitable as file system
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering hierarchy for <command>systemd-nspawn</command>
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering containers.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that <command>systemd-nspawn</command> will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering mount file systems private to the container to
2b583ce6576d4a074ce6f1570b3e60b65c64ae7dKay Sievers <filename>/run</filename> and similar. These will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering not be visible outside of the container, and their
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering contents will be lost when the container exits.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that running two
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <command>systemd-nspawn</command> containers from the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering same directory tree will not make processes in them
9f7dad774ebfad23269800b7096eaad087481debVille Skyttä see each other. The PID namespace separation of the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering two containers is complete and the containers will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering share very few runtime objects except for the
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering underlying file system. Use
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <command>login</command> command to request an
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering additional login prompt in a running container.</para>
9980033377c105d2cd6539c9d73ee61d4c2263b0Lennart Poettering <para><command>systemd-nspawn</command> implements the
9980033377c105d2cd6539c9d73ee61d4c2263b0Lennart Poettering url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <para>As a safety check
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <command>systemd-nspawn</command> will verify the
fb69ed55e5f8e82145440ba15075e8db807bf7faMichael Biebl existence of <filename>/etc/os-release</filename> in
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering the container tree before starting the container (see
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>). It
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering might be necessary to add this file to the container
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering tree manually if the OS of the container is too old to
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering contain this file out-of-the-box.</para>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <para>If option <option>-b</option> is specified, the
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek arguments are used as arguments for the init
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek binary. Otherwise, <replaceable>COMMAND</replaceable>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek specifies the program to launch in the container, and
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek the remaining arguments are used as arguments for this
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek program. If <option>-b</option> is not used and no
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek arguments are specifed, a shell is launched in the
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek container.</para>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <para>The following options are understood:</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <variablelist>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <varlistentry>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering file system root for the namespace
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt container. If omitted, the current
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering directory will be
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </varlistentry>
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering <varlistentry>
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering for an init binary and invoke it
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering instead of a shell or a user supplied
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering program. If this option is used,
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering arguments specified on the command
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering line are used as arguments for the
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering init binary. This option may not be
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering </varlistentry>
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil <varlistentry>
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil under specified user, create home
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil directory and cd into it. As rest
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil of systemd-nspawn, this is not
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil the security feature and limits
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil against accidental changes only.
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil </varlistentry>
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering <varlistentry>
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering for this container. This name may be
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering used to identify this container on the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering host, and is used to initialize the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering container's hostname (which the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering container can choose to override,
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt however). If not specified, the last
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering component of the root directory of the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering </varlistentry>
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering <varlistentry>
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering for the container. The init system
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering will initialize
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering from this if this file is not set yet.
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering part of the specified slice, instead
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering of the default
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <filename>machine.slice</filename>.</para>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering <varlistentry>
ff01d048b4c1455241c894cf7982662c9d28fd34Lennart Poettering <term><option>--private-network</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering of the container from the host. This
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering makes all network interfaces
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering unavailable in the container, with the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering exception of the loopback device and
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering those specified with
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen and configured with
73e231abde39f22097df50542c745e01de879836Jan Engelhardt this option is specified, the
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering CAP_NET_ADMIN capability will be added
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering to the set of capabilities the
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering container retains. The latter may be
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering disabled by using
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering <option>--drop-capability=</option>.</para></listitem>
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering </varlistentry>
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering <varlistentry>
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering <term><option>--network-interface=</option></term>
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering network interface to the
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering container. This will move the
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering specified interface from the calling
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering namespace and place it in the
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering container. When the container
73e231abde39f22097df50542c745e01de879836Jan Engelhardt terminates, it is moved back to the
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering host namespace. Note that
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering option may be used more than once to
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering add multiple network interfaces to the
aa28aefe61c5406c5cb631f3e82457b6d1bcc967Lennart Poettering </varlistentry>
bc2f673ec24b59948fcfc35b3077fda0314e69d8Lennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--network-veth</option></term>
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt Ethernet link between host and
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering container. The host side of the
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt Ethernet link will be available as a
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering network interface named after the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering container's name (as specified with
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt container side of the the Ethernet
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering link will be named
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <option>--private-network</option>.</para></listitem>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen <varlistentry>
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen <term><option>--network-bridge=</option></term>
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering the Ethernet link created with
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering specified bridge. Note that
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering this option is used the host side of
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering the Ethernet link will use the
08af0da26935e827b58809ff1946e2f7d496e666Lennart Poettering of <literal>ve-</literal>.</para></listitem>
ab046dde6f355f4a8b07ff6120a7ef51f5d49fc9Tom Gundersen </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--selinux-context=</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering security context to be used to label
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering processes in the container.</para>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--selinux-apifs-context=</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <listitem><para>Sets the SELinux security
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering context to be used to label files in
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering the virtual API file systems in the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering container.</para>
bc2f673ec24b59948fcfc35b3077fda0314e69d8Lennart Poettering </varlistentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <varlistentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <term><option>--capability=</option></term>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering additional capabilities to grant the
e9dd9f9547350c7dc0473583b5c2228dc8f0ab76Jason St. John container. Takes a comma-separated
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering list of capability names, see
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering for more information. Note that the
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering following capabilities will be granted
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering in any way: CAP_CHOWN,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_KILL, CAP_LEASE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_LINUX_IMMUTABLE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_NET_BIND_SERVICE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_NET_BROADCAST, CAP_NET_RAW,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SETUID, CAP_SYS_ADMIN,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SYS_CHROOT, CAP_SYS_NICE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering CAP_SYS_RESOURCE, CAP_SYS_BOOT,
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering CAP_AUDIT_WRITE,
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering CAP_AUDIT_CONTROL. Also CAP_NET_ADMIN
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering is retained if
a42c8b54b1619078c02f5e439bd2564c6d0f901fLennart Poettering specified. If the special value
39ed67d14694983dabd6641c02216aa440eed767Lennart Poettering capabilities are
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering </varlistentry>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering <varlistentry>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering <term><option>--drop-capability=</option></term>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering additional capabilities to drop for
420c7379fb96a188459690a634d0fede55721183Lennart Poettering the container. This allows running the
420c7379fb96a188459690a634d0fede55721183Lennart Poettering container with fewer capabilities than
420c7379fb96a188459690a634d0fede55721183Lennart Poettering the default (see above).</para></listitem>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering </varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <term><option>--link-journal=</option></term>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering container's journal shall be made
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt visible to the host system. If enabled,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering allows viewing the container's journal
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering files from the host (but not vice
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering versa). Takes one of
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek <literal>no</literal>, the journal is
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek not linked. If <literal>host</literal>,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering the journal files are stored on the
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek host file system (beneath
e670b166a08b7c1031a9e7d7675fa9a29c3e19c9Zbigniew Jędrzejewski-Szmek <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the subdirectory is bind-mounted
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering into the container at the same
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek location. If <literal>guest</literal>,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering the journal files are stored on the
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek guest file system (beneath
e670b166a08b7c1031a9e7d7675fa9a29c3e19c9Zbigniew Jędrzejewski-Szmek <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the subdirectory is symlinked into the host
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering at the same location. If
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek <literal>auto</literal> (the default),
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the right subdirectory of
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek exists, it will be bind mounted
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek into the container. If the
6b4991cfde6c0a0b62e836ca75ae362779c474d4Jan Engelhardt subdirectory does not exist, no
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek linking is performed. Effectively,
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek booting a container once with
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek journal persistently if further on
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering </varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <option>--link-journal=guest</option>.</para></listitem>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering </varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <varlistentry>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering <term><option>--read-only</option></term>
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering system read-only for the
69c79d3c32ff4d6a572ee1cdec248b27df1fb6caLennart Poettering </varlistentry>
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering <varlistentry>
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering directory from the host into the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering container. Either takes a path
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering argument -- in which case the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering specified path will be mounted from
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering the host to the same path in the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering container --, or a colon-separated
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering pair of paths -- in which case the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering first specified path is the source in
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering the host, and the second path is the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering destination in the container. The
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering creates read-only bind
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering </varlistentry>
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering <varlistentry>
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering environment variable assignment to
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering pass to the init process in the
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering container, in the format
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering may be used to override the default
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering variables or to set additional
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering variables. This parameter may be used
f4889f656b477887b02caa5e9d27387309c75a87Lennart Poettering </varlistentry>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering <varlistentry>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering <term><option>--share-system</option></term>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering to share certain system facilities
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering with the host. More specifically, this
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering turns off PID namespacing, UTS
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering namespacing and IPC namespacing, and
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering thus allows the guest to see and
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering interact more easily with processes
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering outside of the container. Note that
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering using this option makes it impossible
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering to start up a full Operating System in
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering the container, as an init system
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering cannot operate in this mode. It is
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering only useful to run specific programs
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering or applications this way, without
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering involving an init system in the
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering container. This option implies
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering option may not be combined with
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <option>--boot</option>.</para></listitem>
8a96d94e4c33173d1426b7e0a6325405804ba224Lennart Poettering </varlistentry>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <varlistentry>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <term><option>--register=</option></term>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering container is registered with
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <citerefentry><refentrytitle>systemd-machined</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Takes
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering a boolean argument, defaults to
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering should be enabled when the container
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering runs a full Operating System (more
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering specifically: an init system), and is
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering useful to ensure that the container is
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering accessible via
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering and shown by tools such as
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering <citerefentry><refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum></citerefentry>. If
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering the container does not run an init
73e231abde39f22097df50542c745e01de879836Jan Engelhardt system, it is recommended to set this
eb91eb187b7491e05fb95215b77cb62061f41d08Lennart Poettering </varlistentry>
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering <varlistentry>
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering <term><option>--keep-unit</option></term>
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering transient scope unit to run the
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering container in, simply register the
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering service or scope unit
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt been invoked in with
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering <citerefentry><refentrytitle>systemd-machined</refentrytitle><manvolnum>8</manvolnum></citerefentry>. This
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering has no effect if
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering used. This switch should be used if
66f756d437658cc464bfb5647c97efd0cf77f933Jan Engelhardt invoked from within a service unit,
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering and the service unit's sole purpose
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering is to run a single
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering container. This option is not
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering available if run from a user
89f7c8465cd1ab37347dd0c15920bce31e8225dfLennart Poettering </varlistentry>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering <varlistentry>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering <term><option>--personality=</option></term>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering architecture ("personality") reported
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering <citerefentry><refentrytitle>uname</refentrytitle><manvolnum>2</manvolnum></citerefentry>
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering in the container. Currently, only
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering supported. This is useful when running
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering a 32bit container on a 64bit
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering host. If this setting is not used
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering the personality reported in the
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering container is the same as the one
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering reported on the
6afc95b73605833e6e966af1c466b5c08feb953fLennart Poettering </varlistentry>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <term><option>-q</option></term>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <term><option>--quiet</option></term>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <listitem><para>Turns off any status
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek output by the tool itself. When this
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek switch is used, the only output
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek from nspawn will be the console output
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek of the container OS itself.</para></listitem>
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <xi:include href="standard-options.xml" xpointer="help" />
dfdebb1b925332352966804303b2516a6506a429Zbigniew Jędrzejewski-Szmek <xi:include href="standard-options.xml" xpointer="version" />
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </variablelist>
2b3987a863975f5a1fa1754725e3d07a5d4f6478Lennart Poettering <programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
2b3987a863975f5a1fa1754725e3d07a5d4f6478Lennart Poettering# systemd-nspawn -bD /srv/mycontainer</programlisting>
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <para>This installs a minimal Fedora distribution into
845c53246f73a505f12bb7f685a530045fa60a40Zbigniew Jędrzejewski-Szmek the directory <filename noindex='true'>/srv/mycontainer/</filename> and
2b3987a863975f5a1fa1754725e3d07a5d4f6478Lennart Poettering then boots an OS in a namespace container in
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering# systemd-nspawn -D ~/debian-tree/</programlisting>
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <para>This installs a minimal Debian unstable
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering distribution into the directory
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <filename>~/debian-tree/</filename> and then spawns a
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering shell in a namespace container in it.</para>
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas <programlisting># pacstrap -c -d ~/arch-tree/ base
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas# systemd-nspawn -bD ~/arch-tree/</programlisting>
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas <para>This installs a mimimal Arch Linux distribution into
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas the directory <filename>~/arch-tree/</filename> and then
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas boots an OS in a namespace container in it.</para>
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek <programlisting># mv ~/arch-tree /var/lib/container/arch
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek# systemctl enable systemd-nspawn@arch.service
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek# systemctl start systemd-nspawn@arch.service</programlisting>
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek <para>This makes the Arch Linux container part of the
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek <filename>multi-user.target</filename> on the host.
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek <programlisting># btrfs subvolume snapshot / /.tmp
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek# systemd-nspawn --private-network -D /.tmp -b</programlisting>
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek <para>This runs a copy of the host system in a
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek btrfs snapshot.</para>
a8828ed93878b4b4866d40ebfb660e54995ff72eDaniel J Walsh <programlisting># chcon system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -R /srv/container
a8828ed93878b4b4866d40ebfb660e54995ff72eDaniel J Walsh# systemd-nspawn -L system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 -Z system_u:system_r:svirt_lxc_net_t:s0:c0,c1 -D /srv/container /bin/sh</programlisting>
82adf6af7c72b852449346835f33184a841b4796Lennart Poettering <para>This runs a container with SELinux sandbox security contexts.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>The exit code of the program executed in the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering container is returned.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
4d62fb4298a5904a53f484636c91540d08f68765Lennart Poettering <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
431c72dc3d482732a01d3ab929aa9b2c36422d46Lennart Poettering <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>