From c0c8f7180023e7c72bf9dd67f1a82d3ea611d445 Mon Sep 17 00:00:00 2001 From: Andreas Valder Date: Sat, 5 Jun 2021 18:39:38 +0200 Subject: nspawn: add filesystem id mapping support to --bind and --bind-ro --- man/systemd-nspawn.xml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'man/systemd-nspawn.xml') diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index aec0b0e129..9c1cb33c01 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -1357,17 +1357,21 @@ After=sys-subsystem-net-devices-ens1.device source path is taken relative to the image's root directory. This permits setting up bind mounts within the container image. The source path may be specified as empty string, in which case a temporary directory below the host's /var/tmp/ directory is used. It is automatically removed when the container is - shut down. Mount options are comma-separated and currently, only and - are allowed, controlling whether to create a recursive or a regular bind - mount. Defaults to "rbind". Backslash escapes are interpreted, so \: may be used to embed - colons in either path. This option may be specified multiple times for creating multiple independent bind - mount points. The option creates read-only bind mounts. + shut down. The option creates read-only bind mounts. Backslash escapes are interpreted, + so \: may be used to embed colons in either path. This option may be specified + multiple times for creating multiple independent bind mount points. + + Mount options are comma-separated. and control whether + to create a recursive or a regular bind mount. Defaults to "rbind". and + control if the bind mount should use filesystem id mappings. Using this option requires support by the source filesystem + for id mappings. Defaults to "noidmap". Note that when this option is used in combination with , the resulting mount points will be owned by the nobody user. That's because the mount and its files and directories continue to be owned by the relevant host users and groups, which do not exist in the container, and thus show up under the wildcard UID 65534 (nobody). If such bind mounts are created, it is recommended to - make them read-only, using . + make them read-only, using . Alternatively you can use the "idmap" mount option to + map the filesystem ids. -- cgit v1.2.1