From fc53809803cd2bc2434e312b19a18fa36776da12 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 12 Jun 2024 05:50:40 +0200 Subject: Adding upstream version 256. Signed-off-by: Daniel Baumann --- man/systemd-nspawn.xml | 138 +++++++++++++++++++++++++++++++------------------ 1 file changed, 89 insertions(+), 49 deletions(-) (limited to 'man/systemd-nspawn.xml') diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 349bc8a..2645a6b 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -1,6 +1,6 @@ %entities; ]> @@ -118,6 +118,28 @@ keeps track of running containers, and provides programming interfaces to interact with them. + + Unprivileged Operation + + systemd-nspawn may be invoked with or without privileges. The full functionality + is currently only available when invoked with privileges. When invoked without privileges, various + limitations apply, including, but not limited to: + + + Only disk image based containers are supported (i.e. ). + Directory based ones (i.e. ) are not supported. + + Machine registration via is not supported. + + Only and networking modes are supported. + + + When running in unprivileged mode, some needed functionality is provided via + systemd-mountfsd.service8 + and + systemd-nsresourced.service8 + + Options @@ -146,7 +168,7 @@ - MODE + Controls whether systemd-nspawn shall search for and use @@ -209,21 +231,19 @@ - Directory to use as file system root for the - container. + Directory to use as file system root for the container. - If neither , nor - is specified the directory is - determined by searching for a directory named the same as the - machine name specified with . See + If neither , nor is specified the + directory is determined by searching for a directory named the same as the machine name specified + with . See machinectl1 section "Files and Directories" for the precise search path. - If neither , - , nor - are specified, the current directory will - be used. May not be specified together with - . + + + If neither , , nor + are specified, the current directory will be used. May not be specified + together with . @@ -317,6 +337,8 @@ Any other partitions, such as foreign partitions or swap partitions are not mounted. May not be specified together with , . + + @@ -357,7 +379,7 @@ - MODE + Boots the container in volatile mode. When no mode parameter is passed or when mode is specified as , full volatile mode is enabled. This means the root directory is mounted as a @@ -584,7 +606,14 @@ After transitioning into the container, change to the specified user defined in the container's user database. Like all other systemd-nspawn features, this is not a security feature and - provides protection against accidental destructive operations only. + provides protection against accidental destructive operations only. + + Note that if credentials are used in combination with a non-root + (e.g.: , or + ), then must be used, and + or must not be used, as the credentials would + otherwise be unreadable by the container due to missing privileges after switching to the specified + user. @@ -1487,12 +1516,12 @@ After=sys-subsystem-net-devices-ens1.device Mount options are comma-separated. and control whether to create a recursive or a regular bind mount. Defaults to . , - , and control ID mapping. + , and control ID mapping. - Using or requires support by the source filesystem - for user/group ID mapped mounts. Defaults to . With being the container's UID range - offset, being the length of the container's UID range, and being the - owner UID of the bind mount source inode on the host: + Using , or requires support + by the source filesystem for user/group ID mapped mounts. Defaults to . With + being the container's UID range offset, being the length of the + container's UID range, and being the owner UID of the bind mount source inode on the host: If is used, any user in the range @@ -1508,10 +1537,15 @@ After=sys-subsystem-net-devices-ens1.device If is used, the user seen from inside of the container is mapped to on the host. Other host users are mapped to inside the container. + + If is used, the owner of the target directory inside of the + container is mapped to on the host. Other host users are mapped to + inside the container. Whichever ID mapping option is used, the same mapping will be used for users and groups IDs. If - is used, the group owning the bind mounted directory will have no effect. + or are used, the group owning the bind mounted directory + will have no effect. Note that when this option is used in combination with , the resulting mount points will be owned by the nobody user. That's because the mount and its files and @@ -1665,7 +1699,7 @@ After=sys-subsystem-net-devices-ens1.device - MODE + Configures how to set up standard input, output and error output for the container payload, as well as the /dev/console device for the container. Takes one of @@ -1708,6 +1742,21 @@ After=sys-subsystem-net-devices-ens1.device + + + + + Change the terminal background color to the specified ANSI color as long as the + container runs. The color specified should be an ANSI X3.64 SGR background color, i.e. strings such + as 40, 41, …, 47, 48;2;…, + 48;5;…. See ANSI + Escape Code (Wikipedia) for details. Assign an empty string to disable any coloring. + + + + + @@ -1716,8 +1765,8 @@ After=sys-subsystem-net-devices-ens1.device - ID:PATH - ID:VALUE + + Pass a credential to the container. These two options correspond to the LoadCredential= and SetCredential= settings in unit files. See @@ -1780,19 +1829,7 @@ After=sys-subsystem-net-devices-ens1.device Examples - - Download a - <ulink url="https://getfedora.org">Fedora</ulink> image and start a shell in it - - # machinectl pull-raw --verify=no \ - https://download.fedoraproject.org/pub/fedora/linux/releases/&fedora_latest_version;/Cloud/x86_64/images/Fedora-Cloud-Base-&fedora_latest_version;-&fedora_cloud_release;.x86_64.raw.xz \ - Fedora-Cloud-Base-&fedora_latest_version;-&fedora_cloud_release;.x86-64 -# systemd-nspawn -M Fedora-Cloud-Base-&fedora_latest_version;-&fedora_cloud_release;.x86-64 - - This downloads an image using - machinectl1 - and opens a shell in it. - + Build and boot a minimal Fedora distribution in a container @@ -1891,18 +1928,21 @@ After=sys-subsystem-net-devices-ens1.device See Also - - systemd1, - systemd.nspawn5, - chroot1, - dnf8, - debootstrap8, - pacman8, - zypper8, - systemd.slice5, - machinectl1, - btrfs8 - + + systemd1 + systemd.nspawn5 + chroot1 + dnf8 + debootstrap8 + pacman8 + zypper8 + systemd.slice5 + machinectl1 + importctl1 + systemd-mountfsd.service8 + systemd-nsresourced.service8 + btrfs8 + -- cgit v1.2.3