summaryrefslogtreecommitdiff
path: root/man/systemd-nspawn.xml
Commit message (Collapse)AuthorAgeFilesLines
* Add SPDX license identifiers to man pagesZbigniew Jędrzejewski-Szmek2017-11-191-0/+2
|
* man: document how nspawn's --bind= and --private-users interactLennart Poettering2017-11-171-1/+7
| | | | Fixes: #5900
* nspawn: correctly document the relationship of --keep-unit and --register=no ↵Lennart Poettering2017-11-171-13/+10
| | | | | (#7364) Fixes: #7228
* man: mention how to provision Ubuntu and Tanglu for nspawn (#7359)Zbigniew Jędrzejewski-Szmek2017-11-161-3/+16
| | | Also add urls. Urls are nice.
* man: recommend using /var/lib/machines in systemd-nspawn(1)Zbigniew Jędrzejewski-Szmek2017-10-181-4/+7
| | | | Also update the instruction to latest Fedora version.
* nspawn: replace syscall blacklist by a whitelistLennart Poettering2017-09-141-3/+3
| | | | | | | | | | | | | | | | | | | | | | | Let's lock things down a bit, and maintain a list of what's permitted rather than a list of what's prohibited in nspawn (also to make things a bit more like Docker and friends). Note that this slightly alters the effect of --system-call-filter=, as now the negative list now takes precedence over the positive list. However, given that the option is just a few days old and not included in any released version it should be fine to change it at this point in time. Note that the whitelist is good chunk more restrictive thatn the previous blacklist. Specifically: - fanotify is not permitted (given the buffer size issues it's problematic in containers) - nfsservctl is not permitted (NFS server support is not virtualized) - pkey_xyz stuff is not permitted (really new stuff I don't grok) - @cpu-emulation is prohibited (untested legacy stuff mostly, and if people really want to run dosemu in nspawn, they should use --system-call-filter=@cpu-emulation and all should be good)
* nspawn: implement configurable syscall whitelisting/blacklistingLennart Poettering2017-09-121-0/+17
| | | | | | | | | | | | | | | | | | | | | Now that we have ported nspawn's seccomp code to the generic code in seccomp-util, let's extend it to support whitelisting and blacklisting of specific additional syscalls. This uses similar syntax as PID1's support for system call filtering, but in contrast to that always implements a blacklist (and not a whitelist), as we prepopulate the filter with a blacklist, and the unit's system call filter logic does not come with anything prepopulated. (Later on we might actually want to invert the logic here, and whitelist rather than blacklist things, but at this point let's not do that. In case we switch this over later, the syscall add/remove logic of this commit should be compatible conceptually.) Fixes: #5163 Replaces: #5944
* man: add zypper instructions for systemd-nspawnZbigniew Jędrzejewski-Szmek2017-07-021-0/+13
| | | | | | | v2: - add -c and update the list of packages v3: - link to a man page on mankier.com
* nspawn: register a scope for the unit if --register=no is specified (#6166)Lennart Poettering2017-06-281-25/+20
| | | | | | | | | | | | | | | | | Previously, only when --register=yes was set (the default) the invoked container would get its own scope, created by machined on behalf of nspawn. With this change if --register=no is set nspawn will still get its own scope (which is a good thing, so that --slice= and --property= take effect), but this is not done through machined but by registering a scope unit directly in PID 1. Summary: --register=yes → allocate a new scope through machined (the default) --register=yes --keep-unit → use the unit we are already running in an register with machined --register=no → allocate a new scope directly, but no machined --register=no --keep-unit → do not allocate nor register anything Fixes: #5823
* man: fix typo (`--network-zones` → `--network-zone`)Elias Probst2017-05-131-1/+1
|
* man: use https:// in URLsAsciiWolf2017-02-211-2/+2
|
* man: document that user namespacing complicates file copiesLennart Poettering2017-02-171-1/+6
|
* Merge pull request #5279 from keszybz/man-revertsMartin Pitt2017-02-091-7/+14
|\ | | | | A revert and some other tweaks for the man pages
| * man: break long lines and update Fedora versionsZbigniew Jędrzejewski-Szmek2017-02-081-7/+14
| | | | | | | | | | | | | | We should try to keep the unbreakable lines below 80 columns. It's not always possible of course. Also, use the dl.fp.o alias instead of a specific mirror.
* | Merge pull request #4962 from poettering/root-directory-2Zbigniew Jędrzejewski-Szmek2017-02-081-4/+8
|\ \ | |/ |/| Add new MountAPIVFS= boolean unit file setting + RootImage=
| * man: add more commas for clarify and reword a few sentencesZbigniew Jędrzejewski-Szmek2017-02-081-4/+4
| |
| * dissect: try to read roothash value off user.verity.roothash xattr of image fileLennart Poettering2017-02-071-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This slightly extends the roothash loading logic to first check for a user.verity.roothash extended attribute on the image file. If it exists, it is used as Verity root hash and the ".roothash" file is not used. This should improve the chance that the roothash is retained when the file is moved around, as the data snippet is attached directly to the image file. The field is still detached from the file payload however, in order to make sure it may be trusted independently. This does not replace the ".roothash" file loading, it simply adds a second way to retrieve the data. Extended attributes are often a poor choice for storing metadata like this as it is usually difficult to discover for admins and users, and hard to fix if it ever gets out of sync. However, in this case I think it's safe as verity implies read-only access, and thus there's little chance of it to get out of sync.
* | nspawn: Add support for sysroot pivoting (#5258)Philip Withnall2017-02-081-0/+21
|/ | | | | | | | | Add a new --pivot-root argument to systemd-nspawn, which specifies a directory to pivot to / inside the container; while the original / is pivoted to another specified directory (if provided). This adds support for booting container images which may contain several bootable sysroots, as is common with OSTree disk images. When these disk images are booted on real hardware, ostree-prepare-root is run in conjunction with sysroot.mount in the initramfs to achieve the same results.
* fstab-generator: add support for volatile bootsLennart Poettering2016-12-211-6/+9
| | | | | | | | | | | | | | | | | | | | This adds support for a new kernel command line option "systemd.volatile=" that provides the same functionality that systemd-nspawn's --volatile= switch provides, but for host systems (i.e. systems booting with a kernel). It takes the same parameter and has the same effect. In order to implement systemd.volatile=yes a new service systemd-volatile-root.service is introduced that only runs in the initrd and rearranges the root directory as needed to become a tmpfs instance. Note that systemd.volatile=state is implemented different: it simply generates a var.mount unit file that is part of the normal boot and has no effect on the initrd execution. The way this is implemented ensures that other explicit configuration for /var can always override the effect of these options. Specifically, the var.mount unit is generated in the "late" generator directory, so that it only is in effect if nothing else overrides it.
* man: update the nspawn man page, and document what kind of dissection ↵Lennart Poettering2016-12-071-0/+17
| | | | features we now support
* nspawn: optionally, automatically allocated --bind=/--overlay source from ↵Lennart Poettering2016-12-011-10/+17
| | | | | | | | | | | /var/tmp This extends the --bind= and --overlay= syntax so that an empty string as source/upper directory is taken as request to automatically allocate a temporary directory below /var/tmp, whose lifetime is bound to the nspawn runtime. In combination with the "+" path extension this permits a switch "--overlay=+/var::/var" in order to use the container's shipped /var, combine it with a writable temporary directory and mount it to the runtime /var of the container.
* nspawn: permit prefixing of source paths in --bind= and --overlay= with "+"Lennart Poettering2016-12-011-15/+14
| | | | | | | | | | | | | If a source path is prefixed with "+" it is taken relative to the container's root directory instead of the host. This permits easily establishing bind and overlay mounts based on data from the container rather than the host. This also reworks custom_mounts_prepare(), and turns it into two functions: one custom_mount_check_all() that remains in nspawn.c but purely verifies the validity of the custom mounts configured. And one called custom_mount_prepare_all() that actually does the preparation step, sorts the custom mounts, resolves relative paths, and allocates temporary directories as necessary.
* nspawn: add fallback top normal copy/reflink when we cannot btrfs snapshotLennart Poettering2016-11-221-24/+12
| | | | | | | | | | | | | | | | | Given that other file systems (notably: xfs) support reflinks these days, let's extend the file system snapshotting logic to fall back to plan copies or reflinks when full btrfs subvolume snapshots are not available. This essentially makes "systemd-nspawn --ephemeral" and "systemd-nspawn --template=" available on non-btrfs subvolumes. Of course, both operations will still be slower on non-btrfs than on btrfs (simply because reflinking each file individually in a directory tree is still slower than doing this in one step for a whole subvolume), but it's probably good enough for many cases, and we should provide the users with the tools, they have to figure out what's good for them. Note that "machinectl clone" already had a fallback like this in place, this patch generalizes this, and adds similar support to our other cases.
* nspawn: support ephemeral boots from imagesLennart Poettering2016-11-221-12/+8
| | | | | | | | | | | Previously --ephemeral was only supported with container trees in btrfs subvolumes (i.e. in combination with --directory=). This adds support for --ephemeral in conjunction with disk images (i.e. --image=) too. As side effect this fixes that --ephemeral was accepted but ignored when using -M on a container that turned out to be an image. Fixes: #4664
* man: typo fixesThomas Hindoe Paaboel Andersen2016-10-121-5/+5
| | | | A mix of fixes for typos and UK english
* nspawn,man: fix parsing of numeric args for --private-users, accept any booleanZbigniew Jędrzejewski-Szmek2016-10-101-29/+30
| | | | | This is like the previous reverted commit, but any boolean is still accepted, not just "yes" and "no". Man page is adjusted to match the code.
* man: describe how to reverse systemd-nspawn -UZbigniew Jędrzejewski-Szmek2016-10-091-11/+17
| | | | | Now that systemd-nspawn@.service includes -U, more users might be interested in this tidbit ;)
* man: Update example for downloading a Fedora image (#4166)Stefan Schweter2016-09-161-2/+2
|
* nspawn: deprecate --share-system supportLennart Poettering2016-08-031-24/+3
| | | | | | | | | | | This removes the --share-system switch: from the documentation, the --help text as well as the command line parsing. It's an ugly option, given that it kinda contradicts the whole concept of PID namespaces that nspawn implements. Since it's barely ever used, let's just deprecate it and remove it from the options. It might be useful as a debugging option, hence the functionality is kept around for now, exposed via an undocumented $SYSTEMD_NSPAWN_SHARE_SYSTEM environment variable.
* man: make chroot less prominent in discussion of nspawnZbigniew Jędrzejewski-Szmek2016-07-251-6/+4
| | | | | | | | Not as many people use chroot as before, so make the flow a bit nicer by talking less about chroot. "change to the either" is awkward and unclear. Just remove that part, because all changes are lost, period.
* treewide: fix typosTorstein Husebø2016-07-041-2/+2
|
* nspawn: improve man page (#3577)Lennart Poettering2016-06-221-65/+90
| | | | | | | | | | This change documents the existance of the systemd-nspawn@.service template unit file, which was previously not mentioned at all. Since the unit file uses slightly different default than nspawn invoked from the command line, these defaults are now explicitly documented too. A couple of further additions and changes are made, too. Replaces: #3497
* nspawn: introduce --notify-ready=[no|yes] (#3474)Alessandro Puccetti2016-06-101-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This the patch implements a notificaiton mechanism from the init process in the container to systemd-nspawn. The switch --notify-ready=yes configures systemd-nspawn to wait the "READY=1" message from the init process in the container to send its own to systemd. --notify-ready=no is equivalent to the previous behavior before this patch, systemd-nspawn notifies systemd with a "READY=1" message when the container is created. This notificaiton mechanism uses socket file with path relative to the contanier "/run/systemd/nspawn/notify". The default values it --notify-ready=no. It is also possible to configure this mechanism from the .nspawn files using NotifyReady. This parameter takes the same options of the command line switch. Before this patch, systemd-nspawn notifies "ready" after the inner child was created, regardless the status of the service running inside it. Now, with --notify-ready=yes, systemd-nspawn notifies when the service is ready. This is really useful when there are dependencies between different contaniers. Fixes https://github.com/systemd/systemd/issues/1369 Based on the work from https://github.com/systemd/systemd/pull/3022 Testing: Boot a OS inside a container with systemd-nspawn. Note: modify the commands accordingly with your filesystem. 1. Create a filesystem where you can boot an OS. 2. sudo systemd-nspawn -D ${HOME}/distros/fedora-23/ sh 2.1. Create the unit file /etc/systemd/system/sleep.service inside the container (You can use the example below) 2.2. systemdctl enable sleep 2.3 exit 3. sudo systemd-run --service-type=notify --unit=notify-test ${HOME}/systemd/systemd-nspawn --notify-ready=yes -D ${HOME}/distros/fedora-23/ -b 4. In a different shell run "systemctl status notify-test" When using --notify-ready=yes the service status is "activating" for 20 seconds before being set to "active (running)". Instead, using --notify-ready=no the service status is marked "active (running)" quickly, without waiting for the 20 seconds. This patch was also test with --private-users=yes, you can test it just adding it at the end of the command at point 3. ------ sleep.service ------ [Unit] Description=sleep After=network.target [Service] Type=oneshot ExecStart=/bin/sleep 20 [Install] WantedBy=multi-user.target ------------ end ------------
* man: add documentation for the new --network-zone= concept of nspawnLennart Poettering2016-05-091-1/+30
|
* man: document that nspawn's host0 and ve-* interfaces have default config in ↵Lennart Poettering2016-05-091-15/+21
| | | | networkd
* nspawn: make -U a tiny bit smarterLennart Poettering2016-04-251-1/+3
| | | | | With this change -U will turn on user namespacing only if the kernel actually supports it and otherwise gracefully degrade to non-userns mode.
* man: document the new user namespacing optionsLennart Poettering2016-04-251-30/+69
|
* tree-wide: use mdash instead of a two minusesZbigniew Jędrzejewski-Szmek2016-04-211-1/+1
|
* nspawn: add -E as alias for --setenvZbigniew Jędrzejewski-Szmek2016-04-201-1/+2
| | | | | v2: - "=" is required, so remove the <optional> tags that v1 added
* man: minor nspawn doc fixesLennart Poettering2016-04-121-4/+4
|
* nspawn: always setup machine idMichal Sekletar2016-04-111-1/+3
| | | | | | | | | | | | | | | | We check /etc/machine-id of the container and if it is already populated we use value from there, possibly ignoring value of --uuid option from the command line. When dealing with R/O image we setup transient machine id. Once we determined machine id of the container, we use this value for registration with systemd-machined and we also export it via container_uuid environment variable. As registration with systemd-machined is done by the main nspawn process we communicate container machine id established by setup_machine_id from outer child to the main process by unix domain socket. Similarly to PID of inner child.
* man: document missing KillSignal= .nspawn optionPetros Angelatos2016-03-151-3/+2
| | | | Signed-off-by: Petros Angelatos <petrosagg@gmail.com>
* nspawn: optionally run a stub init process as PID 1Lennart Poettering2016-02-031-6/+59
| | | | | | This adds a new switch --as-pid2, which allows running commands as PID 2, while a stub init process is run as PID 1. This is useful in order to run arbitrary commands in a container, as PID1's semantics are different from all other processes regarding reaping of unknown children or signal handling.
* nspawn: add new --chdir= switchLennart Poettering2016-02-031-0/+7
| | | | Fixes: #2192
* doc: improved wording in some placesJan Engelhardt2016-01-281-2/+2
| | | | | Avoid "mountpoint mounted" (word repetition), "queriable" (no match in m-w.com and dict.cc).
* nspawn: add new --network-veth-extra= switch for defining additional veth linksLennart Poettering2015-11-121-0/+15
| | | | | | | | | | | The new switch operates like --network-veth, but may be specified multiple times (to define multiple link pairs) and allows flexible definition of the interface names. This is an independent reimplementation of #1678, but defines different semantics, keeping the behaviour completely independent of --network-veth. It also comes will full hook-up for .nspawn files, and the matching documentation.
* doc: correct orthography, word forms and missing/extraneous wordsJan Engelhardt2015-11-061-7/+7
|
* doc: correct punctuation and improve typography in documentationJan Engelhardt2015-11-061-30/+30
|
* man: let's enclose * in shell examples in ''Lennart Poettering2015-10-241-1/+1
| | | | | | | Technically, it's safer that way, since dnf is supposed to parse the "*", not the shell. It doesn't really matter too much in real life (as the expression is too complex), but let's better be safe than sorry, and make sure people won't file bugs about this...
* man: also add --enablerepo=updates to dnf invocationZbigniew Jędrzejewski-Szmek2015-10-221-1/+1
| | | | | | | | | Without the updates repo, we are installing packages from the time that that version of Fedora was released. Normally, during the lifetime of the release most packages are updated, so most of the packages installed would be outdated, and the first update after installation would update a massive set of packages. Avoid all this by installing from the updates repo from the start.
View Lorry Controller Status