systemd-nspawn.xml revision f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering This file is part of systemd.
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering Copyright 2010 Lennart Poettering
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering systemd is free software; you can redistribute it and/or modify it
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering under the terms of the GNU Lesser General Public License as published by
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering the Free Software Foundation; either version 2.1 of the License, or
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering (at your option) any later version.
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering systemd is distributed in the hope that it will be useful, but
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering WITHOUT ANY WARRANTY; without even the implied warranty of
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering Lesser General Public License for more details.
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering You should have received a copy of the GNU Lesser General Public License
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering along with systemd; If not, see <http://www.gnu.org/licenses/>.
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refentryinfo>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </authorgroup>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </refentryinfo>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refentrytitle>systemd-nspawn</refentrytitle>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <refsynopsisdiv>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <command>systemd-nspawn</command>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">OPTIONS</arg>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt"><replaceable>COMMAND</replaceable>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">ARGS</arg>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <command>systemd-nspawn</command>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">OPTIONS</arg>
1fd961211df69ce672252d543bf4777738647048Zbigniew Jędrzejewski-Szmek <arg choice="opt" rep="repeat">ARGS</arg>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </cmdsynopsis>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </refsynopsisdiv>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para><command>systemd-nspawn</command> may be used to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering run a command or OS in a light-weight namespace
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering container. In many ways it is similar to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering but more powerful since it fully virtualizes the file
9f7dad774ebfad23269800b7096eaad087481debVille Skyttä system hierarchy, as well as the process tree, the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering various IPC subsystems and the host and domain
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para><command>systemd-nspawn</command> limits access
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering to various kernel interfaces in the container to
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering read-only, such as <filename>/sys</filename>,
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering <filename>/sys/fs/selinux</filename>. Network
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering interfaces and the system clock may not be changed
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering from within the container. Device nodes may not be
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering created. The host system cannot be rebooted and kernel
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering modules may not be loaded from within the
4f755fc6ab8b75f89ed84c93cd5c3fac2a448b16Lennart Poettering container.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that even though these security precautions
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering are taken <command>systemd-nspawn</command> is not
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering suitable for secure container setups. Many of the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering security features may be circumvented and are hence
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering primarily useful to avoid accidental changes to the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering host system from the container. The intended use of
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering this program is debugging and testing as well as
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering building of packages, distributions and software
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering involved with boot and systems management.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>In contrast to
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry> <command>systemd-nspawn</command>
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek may be used to boot full Linux-based operating systems
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek in a container.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Use a tool like
4d62fb4298a5904a53f484636c91540d08f68765Lennart Poettering <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
4d62fb4298a5904a53f484636c91540d08f68765Lennart Poettering <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering to set up an OS directory tree suitable as file system
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering hierarchy for <command>systemd-nspawn</command>
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering containers.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that <command>systemd-nspawn</command> will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering mount file systems private to the container to
2b583ce6576d4a074ce6f1570b3e60b65c64ae7dKay Sievers <filename>/run</filename> and similar. These will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering not be visible outside of the container, and their
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering contents will be lost when the container exits.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>Note that running two
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <command>systemd-nspawn</command> containers from the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering same directory tree will not make processes in them
9f7dad774ebfad23269800b7096eaad087481debVille Skyttä see each other. The PID namespace separation of the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering two containers is complete and the containers will
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering share very few runtime objects except for the
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering underlying file system. Use
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <command>login</command> command to request an
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering additional login prompt in a running container.</para>
9980033377c105d2cd6539c9d73ee61d4c2263b0Lennart Poettering <para><command>systemd-nspawn</command> implements the
9980033377c105d2cd6539c9d73ee61d4c2263b0Lennart Poettering url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <para>As a safety check
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <command>systemd-nspawn</command> will verify the
fb69ed55e5f8e82145440ba15075e8db807bf7faMichael Biebl existence of <filename>/etc/os-release</filename> in
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering the container tree before starting the container (see
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>). It
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering might be necessary to add this file to the container
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering tree manually if the OS of the container is too old to
f8964235e69f58225dec378437b1789744cd22a9Lennart Poettering contain this file out-of-the-box.</para>
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering <title>Incompatibility with Auditing</title>
2aba426ffb345408a461ed0ff6fba46e63ae625bLennart Poettering <para>Note that the kernel auditing subsystem is
2aba426ffb345408a461ed0ff6fba46e63ae625bLennart Poettering currently broken when used together with
2aba426ffb345408a461ed0ff6fba46e63ae625bLennart Poettering containers. We hence recommend turning it off entirely
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering by booting with <literal>audit=0</literal> on the
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering kernel command line, or by turning it off at kernel
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt build time. If auditing is enabled in the kernel,
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering operating systems booted in an nspawn container might
77b6e19458f37cfde127ec6aa9494c0ac45ad890Lennart Poettering refuse log-in attempts.</para>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <para>If option <option>-b</option> is specified, the
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek arguments are used as arguments for the init
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek binary. Otherwise, <replaceable>COMMAND</replaceable>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek specifies the program to launch in the container, and
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek the remaining arguments are used as arguments for this
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek program. If <option>-b</option> is not used and no
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek arguments are specifed, a shell is launched in the
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek container.</para>
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek <para>The following options are understood:</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <variablelist>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <varlistentry>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </varlistentry>
acbeb42770e1e99955ebc4464a0439cf741b3aebZbigniew Jędrzejewski-Szmek <term><option>--version</option></term>
acbeb42770e1e99955ebc4464a0439cf741b3aebZbigniew Jędrzejewski-Szmek <listitem><para>Prints a version string
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <varlistentry>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering file system root for the namespace
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt container. If omitted, the current
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering directory will be
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </varlistentry>
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering <varlistentry>
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering for an init binary and invoke it
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering instead of a shell or a user supplied
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek program. If this option is used, arguments
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek specified on the command line are used
870c4365cf3d407270788abe14d216a636ecf6c3Zbigniew Jędrzejewski-Szmek as arguments for the init binary.
0f0dbc46ccf5aaaf3131446d0a4d78bc97a37295Lennart Poettering </varlistentry>
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil <varlistentry>
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil under specified user, create home
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil directory and cd into it. As rest
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil of systemd-nspawn, this is not
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil the security feature and limits
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil against accidental changes only.
687d0825a4636b1841dc0c01fbcbf3160dddab74Michal Vyskocil </varlistentry>
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering <varlistentry>
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering for this container. This name may be
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering used to identify this container on the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering host, and is used to initialize the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering container's hostname (which the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering container can choose to override,
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt however). If not specified, the last
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering component of the root directory of the
7027ff61a34a12487712b382a061c654acc3a679Lennart Poettering </varlistentry>
431c72dc3d482732a01d3ab929aa9b2c36422d46Lennart Poettering <varlistentry>
431c72dc3d482732a01d3ab929aa9b2c36422d46Lennart Poettering part of the specified slice, instead
431c72dc3d482732a01d3ab929aa9b2c36422d46Lennart Poettering <filename>machine.slice</filename>.</para>
431c72dc3d482732a01d3ab929aa9b2c36422d46Lennart Poettering </varlistentry>
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering <varlistentry>
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering for the container. The init system
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering will initialize
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering from this if this file is not set yet.
144f0fc0c8a5e2f6b72179e2b5fb992474da24adLennart Poettering </varlistentry>
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering <varlistentry>
ff01d048b4c1455241c894cf7982662c9d28fd34Lennart Poettering <term><option>--private-network</option></term>
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering the container. This makes all network
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering interfaces unavailable in the
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering container, with the exception of the
a41fe3a29372f8e6c4e7733bf85940a023811301Lennart Poettering </varlistentry>
bc2f673ec24b59948fcfc35b3077fda0314e69d8Lennart Poettering <varlistentry>
bc2f673ec24b59948fcfc35b3077fda0314e69d8Lennart Poettering <term><option>--read-only</option></term>
e9dd9f9547350c7dc0473583b5c2228dc8f0ab76Jason St. John system read-only for the
bc2f673ec24b59948fcfc35b3077fda0314e69d8Lennart Poettering </varlistentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <varlistentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <term><option>--capability=</option></term>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering additional capabilities to grant the
e9dd9f9547350c7dc0473583b5c2228dc8f0ab76Jason St. John container. Takes a comma-separated
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering list of capability names, see
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering for more information. Note that the
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering following capabilities will be granted
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering in any way: CAP_CHOWN,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_KILL, CAP_LEASE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_LINUX_IMMUTABLE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_NET_BIND_SERVICE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_NET_BROADCAST, CAP_NET_RAW,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SETUID, CAP_SYS_ADMIN,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SYS_CHROOT, CAP_SYS_NICE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering CAP_SYS_RESOURCE, CAP_SYS_BOOT,
88d04e31ce0837ebf937ab46c3c39a0d93ab4c7cLennart Poettering CAP_AUDIT_WRITE,
5076f0ccfd36b67512d44fe355b80305ced7dcbaLennart Poettering </varlistentry>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering <varlistentry>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering <term><option>--drop-capability=</option></term>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering additional capabilities to drop for
420c7379fb96a188459690a634d0fede55721183Lennart Poettering the container. This allows running the
420c7379fb96a188459690a634d0fede55721183Lennart Poettering container with fewer capabilities than
420c7379fb96a188459690a634d0fede55721183Lennart Poettering the default (see above).</para></listitem>
420c7379fb96a188459690a634d0fede55721183Lennart Poettering </varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <term><option>--link-journal=</option></term>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering container's journal shall be made
79640424059328268b9fb6c5fa8eb777b27a177eJan Engelhardt visible to the host system. If enabled,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering allows viewing the container's journal
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering files from the host (but not vice
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering versa). Takes one of
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek <literal>no</literal>, the journal is
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek not linked. If <literal>host</literal>,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering the journal files are stored on the
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek host file system (beneath
e670b166a08b7c1031a9e7d7675fa9a29c3e19c9Zbigniew Jędrzejewski-Szmek <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the subdirectory is bind-mounted
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering into the container at the same
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek location. If <literal>guest</literal>,
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering the journal files are stored on the
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek guest file system (beneath
e670b166a08b7c1031a9e7d7675fa9a29c3e19c9Zbigniew Jędrzejewski-Szmek <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the subdirectory is symlinked into the host
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering at the same location. If
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek <literal>auto</literal> (the default),
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek and the right subdirectory of
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek exists, it will be bind mounted
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek into the container. If the
6b4991cfde6c0a0b62e836ca75ae362779c474d4Jan Engelhardt subdirectory does not exist, no
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek linking is performed. Effectively,
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek booting a container once with
27407a01c6c115ed09ad938ab95dcb56ab963ba9Zbigniew Jędrzejewski-Szmek journal persistently if further on
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering </varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <varlistentry>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering <option>--link-journal=guest</option>.</para></listitem>
57fb9fb56db0584581ce33ee842dcbf5f1136856Lennart Poettering </varlistentry>
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering <varlistentry>
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering directory from the host into the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering container. Either takes a path
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering argument -- in which case the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering specified path will be mounted from
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering the host to the same path in the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering container --, or a colon-separated
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering pair of paths -- in which case the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering first specified path is the source in
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering the host, and the second path is the
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering destination in the container. The
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering creates read-only bind
17fe052346f1d905b5ce0f12123b5ce24e992c6bLennart Poettering </varlistentry>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering </variablelist>
2b3987a863975f5a1fa1754725e3d07a5d4f6478Lennart Poettering <programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
2b3987a863975f5a1fa1754725e3d07a5d4f6478Lennart Poettering# systemd-nspawn -bD /srv/mycontainer</programlisting>
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <para>This installs a minimal Fedora distribution into
845c53246f73a505f12bb7f685a530045fa60a40Zbigniew Jędrzejewski-Szmek the directory <filename noindex='true'>/srv/mycontainer/</filename> and
2b3987a863975f5a1fa1754725e3d07a5d4f6478Lennart Poettering then boots an OS in a namespace container in
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering# systemd-nspawn -D ~/debian-tree/</programlisting>
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <para>This installs a minimal Debian unstable
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering distribution into the directory
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <filename>~/debian-tree/</filename> and then spawns a
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering shell in a namespace container in it.</para>
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas <programlisting># pacstrap -c -d ~/arch-tree/ base
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas# systemd-nspawn -bD ~/arch-tree/</programlisting>
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas <para>This installs a mimimal Arch Linux distribution into
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas the directory <filename>~/arch-tree/</filename> and then
68562936c243a2e2190a7232c4805ffd094e9b3bWilliam Giokas boots an OS in a namespace container in it.</para>
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek <programlisting># mv ~/arch-tree /var/lib/container/arch
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek# systemctl enable systemd-nspawn@arch.service
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek# systemctl start systemd-nspawn@arch.service</programlisting>
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek <para>This makes the Arch Linux container part of the
9cb74bcb23dde8488459ca233bf9caee642b8402Zbigniew Jędrzejewski-Szmek <filename>multi-user.target</filename> on the host.
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek <programlisting># btrfs subvolume snapshot / /.tmp
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek# systemd-nspawn --private-network -D /.tmp -b</programlisting>
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek <para>This runs a copy of the host system in a
f9f4dd51bdb016bab84f7fb3cf47a2ad102b4c76Zbigniew Jędrzejewski-Szmek btrfs snapshot.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <para>The exit code of the program executed in the
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering container is returned.</para>
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
8f7a3c1402a8de36b2c63935358a53510d2fe7c1Lennart Poettering <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
25f5971b5e0b3ab5b91a7d0359cd7f5a5094c1d0Lennart Poettering <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
4d62fb4298a5904a53f484636c91540d08f68765Lennart Poettering <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
431c72dc3d482732a01d3ab929aa9b2c36422d46Lennart Poettering <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering <citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>