man/systemd.nspawn.xml

   1 <?xml version='1.0'?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   4 <!ENTITY % entities SYSTEM "custom-entities.ent" >
   5 %entities;
   6 ]>
   7 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
   8
   9 <refentry id="systemd.nspawn">
  10
  11   <refentryinfo>
  12     <title>systemd.nspawn</title>
  13     <productname>systemd</productname>
  14   </refentryinfo>
  15
  16   <refmeta>
  17     <refentrytitle>systemd.nspawn</refentrytitle>
  18     <manvolnum>5</manvolnum>
  19   </refmeta>
  20
  21   <refnamediv>
  22     <refname>systemd.nspawn</refname>
  23     <refpurpose>Container settings</refpurpose>
  24   </refnamediv>
  25
  26   <refsynopsisdiv>
  27     <para><filename>/etc/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  28     <para><filename>/run/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  29     <para><filename>/var/lib/machines/<replaceable>machine</replaceable>.nspawn</filename></para>
  30   </refsynopsisdiv>
  31
  32   <refsect1>
  33     <title>Description</title>
  34
  35     <para>An nspawn container settings file (suffix <filename>.nspawn</filename>) contains runtime
  36     configuration for a local container, and is used by
  37     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
  38     Files of this type are named after the containers they define settings for. They are optional, and only
  39     required for containers whose execution environment shall differ from the defaults. Files of this type
  40     mostly contain settings that may also be set on the <command>systemd-nspawn</command> command line, and
  41     make it easier to persistently attach specific settings to specific containers. The syntax of these files
  42     is inspired by <filename>.desktop</filename> files, similarly to other configuration files supported by
  43     the systemd project. See
  44     <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry> for an
  45     overview.</para>
  46   </refsect1>
  47
  48   <refsect1>
  49     <title><filename>.nspawn</filename> File Discovery</title>
  50
  51     <para>Files are searched for by appending the <filename>.nspawn</filename> suffix to the machine name of
  52     the container, as specified with the <option>--machine=</option> switch of
  53     <command>systemd-nspawn</command>, or derived from the directory or image file name. This file is first
  54     searched for in <filename>/etc/systemd/nspawn/</filename> and
  55     <filename>/run/systemd/nspawn/</filename>. If found there, the settings are read and all of them take
  56     full effect (but may still be overridden by corresponding command line arguments). Otherwise, the file
  57     will then be searched for next to the image file or in the immediate parent of the root directory of the
  58     container. If the file is found there, only a subset of the settings will take effect however. All
  59     settings that possibly elevate privileges or grant additional access to resources of the host (such as
  60     files or directories) are ignored. To which options this applies is documented below.</para>
  61
  62     <para>Persistent settings files created and maintained by the
  63     administrator (and thus trusted) should be placed in
  64     <filename>/etc/systemd/nspawn/</filename>, while automatically
  65     downloaded (and thus potentially untrusted) settings files are
  66     placed in <filename>/var/lib/machines/</filename> instead (next to
  67     the container images), where their security impact is limited. In
  68     order to add privileged settings to <filename>.nspawn</filename>
  69     files acquired from the image vendor, it is recommended to copy the
  70     settings files into <filename>/etc/systemd/nspawn/</filename> and
  71     edit them there, so that the privileged options become
  72     available. The precise algorithm for how the files are searched and
  73     interpreted may be configured with
  74     <command>systemd-nspawn</command>'s <option>--settings=</option>
  75     switch, see
  76     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  77     for details.</para>
  78   </refsect1>
  79
  80   <refsect1>
  81     <title>[Exec] Section Options</title>
  82
  83     <para>Settings files may include an [Exec]
  84     section, which carries various execution parameters:</para>
  85
  86     <variablelist class='nspawn-directives'>
  87
  88       <varlistentry>
  89         <term><varname>Boot=</varname></term>
  90
  91         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, <command>systemd-nspawn</command>
  92         will automatically search for an <filename>init</filename> executable and invoke it. In this case, the
  93         specified parameters using <varname>Parameters=</varname> are passed as additional arguments to the
  94         <filename>init</filename> process. This setting corresponds to the <option>--boot</option> switch on the
  95         <command>systemd-nspawn</command> command line. This option may not be combined with
  96         <varname>ProcessTwo=yes</varname>. This option is specified by default in the
  97         <filename>systemd-nspawn@.service</filename> template unit.</para></listitem>
  98       </varlistentry>
  99
 100       <varlistentry>
 101         <term><varname>Ephemeral=</varname></term>
 102
 103         <listitem><para>Takes a boolean argument, which defaults to off, If enabled, the container is run with
 104         a temporary snapshot of its file system that is removed immediately when the container terminates.
 105         This is equivalent to the <option>--ephemeral</option> command line switch. See
 106         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 107         about the specific options supported.</para></listitem>
 108       </varlistentry>
 109
 110       <varlistentry>
 111         <term><varname>ProcessTwo=</varname></term>
 112
 113         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, the specified program is run as
 114         PID 2. A stub init process is run as PID 1. This setting corresponds to the <option>--as-pid2</option> switch
 115         on the <command>systemd-nspawn</command> command line. This option may not be combined with
 116         <varname>Boot=yes</varname>.</para></listitem>
 117       </varlistentry>
 118
 119       <varlistentry>
 120         <term><varname>Parameters=</varname></term>
 121
 122         <listitem><para>Takes a whitespace-separated list of arguments. Single (<literal>'</literal>) and
 123         double (<literal>"</literal>) quotes may be used around arguments with whitespace. This is either a
 124         command line, beginning with the binary name to execute, or – if <varname>Boot=</varname> is enabled
 125         – the list of arguments to pass to the init process. This setting corresponds to the command line
 126         parameters passed on the <command>systemd-nspawn</command> command line.</para>
 127
 128         <para>Note: <option>Boot=no</option>, <option>Parameters=a b "c c"</option> is the same as
 129         <command>systemd-nspawn a b "c c"</command>, and <option>Boot=yes</option>, <option>Parameters=b 'c c'</option>
 130         is the same as <command>systemd-nspawn --boot b 'c c'</command>.</para></listitem>
 131       </varlistentry>
 132
 133       <varlistentry>
 134         <term><varname>Environment=</varname></term>
 135
 136         <listitem><para>Takes an environment variable assignment
 137         consisting of key and value, separated by
 138         <literal>=</literal>. Sets an environment variable for the
 139         main process invoked in the container. This setting may be
 140         used multiple times to set multiple environment variables. It
 141         corresponds to the <option>--setenv=</option> command line
 142         switch.</para></listitem>
 143       </varlistentry>
 144
 145       <varlistentry>
 146         <term><varname>User=</varname></term>
 147
 148         <listitem><para>Takes a UNIX user name. Specifies the user
 149         name to invoke the main process of the container as. This user
 150         must be known in the container's user database. This
 151         corresponds to the <option>--user=</option> command line
 152         switch.</para></listitem>
 153       </varlistentry>
 154
 155       <varlistentry>
 156         <term><varname>WorkingDirectory=</varname></term>
 157
 158         <listitem><para>Selects the working directory for the process invoked in the container. Expects an absolute
 159         path in the container's file system namespace. This corresponds to the <option>--chdir=</option> command line
 160         switch.</para></listitem>
 161       </varlistentry>
 162
 163       <varlistentry>
 164         <term><varname>PivotRoot=</varname></term>
 165
 166         <listitem><para>Selects a directory to pivot to <filename>/</filename> inside the container when starting up.
 167         Takes a single path, or a pair of two paths separated by a colon. Both paths must be absolute, and are resolved
 168         in the container's file system namespace. This corresponds to the <option>--pivot-root=</option> command line
 169         switch.</para></listitem>
 170       </varlistentry>
 171
 172       <varlistentry>
 173         <term><varname>Capability=</varname></term>
 174         <term><varname>DropCapability=</varname></term>
 175
 176         <listitem><para>Takes a space-separated list of Linux process
 177         capabilities (see
 178         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 179         for details). The <varname>Capability=</varname> setting
 180         specifies additional capabilities to pass on top of the
 181         default set of capabilities. The
 182         <varname>DropCapability=</varname> setting specifies
 183         capabilities to drop from the default set. These settings
 184         correspond to the <option>--capability=</option> and
 185         <option>--drop-capability=</option> command line
 186         switches. Note that <varname>Capability=</varname> is a
 187         privileged setting, and only takes effect in
 188         <filename>.nspawn</filename> files in
 189         <filename>/etc/systemd/nspawn/</filename> and
 190         <filename>/run/system/nspawn/</filename> (see above). On the
 191         other hand, <varname>DropCapability=</varname> takes effect in
 192         all cases. If the special value <literal>all</literal> is passed, all
 193         capabilities are retained (or dropped).</para>
 194         <para>These settings change the bounding set of capabilities which
 195         also limits the ambient capabilities as given with the
 196         <varname>AmbientCapability=</varname>.</para></listitem>
 197       </varlistentry>
 198
 199       <varlistentry>
 200         <term><varname>AmbientCapability=</varname></term>
 201         <listitem><para>Takes a space-separated list of Linux process
 202         capabilities (see
 203         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 204         for details). The <varname>AmbientCapability=</varname> setting
 205         specifies capability which will be passed to the started program
 206         in the inheritable and ambient capability sets. This will grant
 207         these capabilities to this process. This setting correspond to
 208         the <option>--ambient-capability=</option> command line switch.
 209         </para>
 210
 211         <para>The value <literal>all</literal> is not supported for this
 212         setting.</para>
 213
 214         <para>The setting of <varname>AmbientCapability=</varname> must
 215         be covered by the bounding set settings which were established by
 216         <varname>Capability=</varname> and <varname>DropCapability=</varname>.
 217         </para>
 218
 219         <para>Note that <varname>AmbientCapability=</varname> is a privileged
 220         setting (see above).</para></listitem>
 221       </varlistentry>
 222
 223       <varlistentry>
 224         <term><varname>NoNewPrivileges=</varname></term>
 225
 226         <listitem><para>Takes a boolean argument that controls the <constant>PR_SET_NO_NEW_PRIVS</constant> flag for
 227         the container payload. This is equivalent to the
 228         <option>--no-new-privileges=</option> command line switch. See
 229         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 230         details.</para>
 231         </listitem>
 232       </varlistentry>
 233
 234       <varlistentry>
 235         <term><varname>KillSignal=</varname></term>
 236
 237         <listitem><para>Specify the process signal to send to the
 238         container's PID 1 when nspawn itself receives SIGTERM, in
 239         order to trigger an orderly shutdown of the container.
 240         Defaults to SIGRTMIN+3 if <option>Boot=</option> is used
 241         (on systemd-compatible init systems SIGRTMIN+3 triggers an
 242         orderly shutdown). For a list of valid signals, see
 243         <citerefentry project='man-pages'><refentrytitle>signal</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para></listitem>
 244       </varlistentry>
 245
 246       <varlistentry>
 247         <term><varname>Personality=</varname></term>
 248
 249         <listitem><para>Configures the kernel personality for the
 250         container. This is equivalent to the
 251         <option>--personality=</option> switch.</para></listitem>
 252       </varlistentry>
 253
 254       <varlistentry>
 255         <term><varname>MachineID=</varname></term>
 256
 257         <listitem><para>Configures the 128-bit machine ID (UUID) to pass to
 258         the container. This is equivalent to the
 259         <option>--uuid=</option> command line switch. This option is
 260         privileged (see above). </para></listitem>
 261       </varlistentry>
 262
 263       <varlistentry>
 264         <term><varname>PrivateUsers=</varname></term>
 265
 266         <listitem><para>Configures support for usernamespacing. This is equivalent to the
 267         <option>--private-users=</option> command line switch, and takes the same options. This option is privileged
 268         (see above). This option is the default if the <filename>systemd-nspawn@.service</filename> template unit file
 269         is used.</para></listitem>
 270       </varlistentry>
 271
 272       <varlistentry>
 273         <term><varname>NotifyReady=</varname></term>
 274
 275         <listitem><para>Configures support for notifications from the container's init process.  This is equivalent to
 276         the <option>--notify-ready=</option> command line switch, and takes the same parameters. See
 277         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 278         about the specific options supported.</para></listitem>
 279       </varlistentry>
 280
 281       <varlistentry>
 282         <term><varname>SystemCallFilter=</varname></term>
 283
 284         <listitem><para>Configures the system call filter applied to containers. This is equivalent to the
 285         <option>--system-call-filter=</option> command line switch, and takes the same list parameter. See
 286         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 287         details.</para></listitem>
 288       </varlistentry>
 289
 290       <varlistentry>
 291         <term><varname>LimitCPU=</varname></term>
 292         <term><varname>LimitFSIZE=</varname></term>
 293         <term><varname>LimitDATA=</varname></term>
 294         <term><varname>LimitSTACK=</varname></term>
 295         <term><varname>LimitCORE=</varname></term>
 296         <term><varname>LimitRSS=</varname></term>
 297         <term><varname>LimitNOFILE=</varname></term>
 298         <term><varname>LimitAS=</varname></term>
 299         <term><varname>LimitNPROC=</varname></term>
 300         <term><varname>LimitMEMLOCK=</varname></term>
 301         <term><varname>LimitLOCKS=</varname></term>
 302         <term><varname>LimitSIGPENDING=</varname></term>
 303         <term><varname>LimitMSGQUEUE=</varname></term>
 304         <term><varname>LimitNICE=</varname></term>
 305         <term><varname>LimitRTPRIO=</varname></term>
 306         <term><varname>LimitRTTIME=</varname></term>
 307
 308         <listitem><para>Configures various types of resource limits applied to containers. This is equivalent to the
 309         <option>--rlimit=</option> command line switch, and takes the same arguments. See
 310         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 311         details.</para></listitem>
 312       </varlistentry>
 313
 314       <varlistentry>
 315         <term><varname>OOMScoreAdjust=</varname></term>
 316
 317         <listitem><para>Configures the OOM score adjustment value. This is equivalent to the
 318         <option>--oom-score-adjust=</option> command line switch, and takes the same argument. See
 319         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 320         details.</para></listitem>
 321       </varlistentry>
 322
 323       <varlistentry>
 324         <term><varname>CPUAffinity=</varname></term>
 325
 326         <listitem><para>Configures the CPU affinity. This is equivalent to the <option>--cpu-affinity=</option> command
 327         line switch, and takes the same argument. See
 328         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 329         details.</para></listitem>
 330       </varlistentry>
 331
 332       <varlistentry>
 333         <term><varname>Hostname=</varname></term>
 334
 335         <listitem><para>Configures the kernel hostname set for the container. This is equivalent to the
 336         <option>--hostname=</option> command line switch, and takes the same argument. See
 337         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 338         details.</para></listitem>
 339       </varlistentry>
 340
 341       <varlistentry>
 342         <term><varname>ResolvConf=</varname></term>
 343
 344         <listitem><para>Configures how <filename>/etc/resolv.conf</filename> in the container shall be handled. This is
 345         equivalent to the <option>--resolv-conf=</option> command line switch, and takes the same argument. See
 346         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 347         details.</para></listitem>
 348       </varlistentry>
 349
 350       <varlistentry>
 351         <term><varname>Timezone=</varname></term>
 352
 353         <listitem><para>Configures how <filename>/etc/localtime</filename> in the container shall be handled. This is
 354         equivalent to the <option>--timezone=</option> command line switch, and takes the same argument. See
 355         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 356         details.</para></listitem>
 357       </varlistentry>
 358
 359       <varlistentry>
 360         <term><varname>LinkJournal=</varname></term>
 361
 362         <listitem><para>Configures how to link host and container journal setups. This is equivalent to the
 363         <option>--link-journal=</option> command line switch, and takes the same parameter. See
 364         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 365         details.</para></listitem>
 366       </varlistentry>
 367
 368       <varlistentry>
 369         <term><varname>SuppressSync=</varname></term>
 370
 371         <listitem><para>Configures whether to suppress disk synchronization for the container payload. This
 372         is equivalent to the <option>--suppress-sync=</option> command line switch, and takes the same
 373         parameter. See
 374         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 375         for details.</para></listitem>
 376       </varlistentry>
 377
 378     </variablelist>
 379   </refsect1>
 380
 381   <refsect1>
 382     <title>[Files] Section Options</title>
 383
 384     <para>Settings files may include a [Files]
 385     section, which carries various parameters configuring the file
 386     system of the container:</para>
 387
 388     <variablelist class='nspawn-directives'>
 389
 390       <varlistentry>
 391         <term><varname>ReadOnly=</varname></term>
 392
 393         <listitem><para>Takes a boolean argument, which defaults to off. If
 394         specified, the container will be run with a read-only file
 395         system. This setting corresponds to the
 396         <option>--read-only</option> command line
 397         switch.</para></listitem>
 398       </varlistentry>
 399
 400       <varlistentry>
 401         <term><varname>Volatile=</varname></term>
 402
 403         <listitem><para>Takes a boolean argument, or the special value
 404         <literal>state</literal>. This configures whether to run the
 405         container with volatile state and/or configuration. This
 406         option is equivalent to <option>--volatile=</option>, see
 407         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 408         for details about the specific options
 409         supported.</para></listitem>
 410       </varlistentry>
 411
 412       <varlistentry>
 413         <term><varname>Bind=</varname></term>
 414         <term><varname>BindReadOnly=</varname></term>
 415
 416         <listitem><para>Adds a bind mount from the host into the
 417         container. Takes a single path, a pair of two paths separated
 418         by a colon, or a triplet of two paths plus an option string
 419         separated by colons. This option may be used multiple times to
 420         configure multiple bind mounts. This option is equivalent to
 421         the command line switches <option>--bind=</option> and
 422         <option>--bind-ro=</option>, see
 423         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 424         for details about the specific options supported. This setting
 425         is privileged (see above).</para></listitem>
 426       </varlistentry>
 427
 428       <varlistentry>
 429         <term><varname>BindUser=</varname></term>
 430
 431         <listitem><para>Binds a user from the host into the container. This option is equivalent to the
 432         command line switch <option>--bind-user=</option>, see
 433         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 434         for details about the specific options supported. This setting is privileged (see
 435         above).</para></listitem>
 436       </varlistentry>
 437
 438       <varlistentry>
 439         <term><varname>TemporaryFileSystem=</varname></term>
 440
 441         <listitem><para>Adds a <literal>tmpfs</literal> mount to the
 442         container. Takes a path or a pair of path and option string,
 443         separated by a colon. This option may be used multiple times to
 444         configure multiple <literal>tmpfs</literal> mounts. This
 445         option is equivalent to the command line switch
 446         <option>--tmpfs=</option>, see
 447         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 448         for details about the specific options supported. This setting
 449         is privileged (see above).</para></listitem>
 450       </varlistentry>
 451
 452       <varlistentry>
 453         <term><varname>Inaccessible=</varname></term>
 454
 455         <listitem><para>Masks the specified file or directory in the container, by over-mounting it with an empty file
 456         node of the same type with the most restrictive access mode. Takes a file system path as argument. This option
 457         may be used multiple times to mask multiple files or directories. This option is equivalent to the command line
 458         switch <option>--inaccessible=</option>, see
 459         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 460         about the specific options supported. This setting is privileged (see above).</para></listitem>
 461       </varlistentry>
 462
 463       <varlistentry>
 464         <term><varname>Overlay=</varname></term>
 465         <term><varname>OverlayReadOnly=</varname></term>
 466
 467         <listitem><para>Adds an overlay mount point. Takes a colon-separated list of paths.  This option may be used
 468         multiple times to configure multiple overlay mounts. This option is equivalent to the command line switches
 469         <option>--overlay=</option> and <option>--overlay-ro=</option>, see
 470         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 471         about the specific options supported. This setting is privileged (see above).</para></listitem>
 472       </varlistentry>
 473
 474       <varlistentry>
 475         <term><varname>PrivateUsersOwnership=</varname></term>
 476
 477         <listitem><para>Configures whether the ownership of the files and directories in the container tree
 478         shall be adjusted to the UID/GID range used, if necessary and user namespacing is enabled. This is
 479         equivalent to the <option>--private-users-ownership=</option> command line switch. This option is
 480         privileged (see above).</para></listitem>
 481       </varlistentry>
 482
 483     </variablelist>
 484   </refsect1>
 485
 486   <refsect1>
 487     <title>[Network] Section Options</title>
 488
 489     <para>Settings files may include a [Network]
 490     section, which carries various parameters configuring the network
 491     connectivity of the container:</para>
 492
 493     <variablelist class='nspawn-directives'>
 494
 495       <varlistentry>
 496         <term><varname>Private=</varname></term>
 497
 498         <listitem><para>Takes a boolean argument, which defaults to off. If
 499         enabled, the container will run in its own network namespace
 500         and not share network interfaces and configuration with the
 501         host. This setting corresponds to the
 502         <option>--private-network</option> command line
 503         switch.</para></listitem>
 504       </varlistentry>
 505
 506       <varlistentry>
 507         <term><varname>VirtualEthernet=</varname></term>
 508
 509         <listitem><para>Takes a boolean argument. Configures whether to create a virtual Ethernet connection
 510         (<literal>veth</literal>) between host and the container. This setting implies
 511         <varname>Private=yes</varname>. This setting corresponds to the <option>--network-veth</option> command line
 512         switch. This option is privileged (see above). This option is the default if the
 513         <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
 514       </varlistentry>
 515
 516       <varlistentry>
 517         <term><varname>VirtualEthernetExtra=</varname></term>
 518
 519         <listitem><para>Takes a colon-separated pair of interface names. Configures an additional virtual
 520         Ethernet connection (<literal>veth</literal>) between host and the container. The first specified
 521         name is the interface name on the host, the second the interface name in the container. The latter
 522         may be omitted in which case it is set to the same name as the host side interface. This setting
 523         implies <varname>Private=yes</varname>. This setting corresponds to the
 524         <option>--network-veth-extra=</option> command line switch, and maybe be used multiple times. It is
 525         independent of <varname>VirtualEthernet=</varname>. Note that this option is unrelated to the
 526         <varname>Bridge=</varname> setting below, and thus any connections created this way are not
 527         automatically added to any bridge device on the host side. This option is privileged (see
 528         above).</para></listitem>
 529       </varlistentry>
 530
 531       <varlistentry>
 532         <term><varname>Interface=</varname></term>
 533
 534         <listitem><para>Takes a space-separated list of interfaces to
 535         add to the container. This option corresponds to the
 536         <option>--network-interface=</option> command line switch and
 537         implies <varname>Private=yes</varname>. This option is
 538         privileged (see above).</para></listitem>
 539       </varlistentry>
 540
 541       <varlistentry>
 542         <term><varname>MACVLAN=</varname></term>
 543         <term><varname>IPVLAN=</varname></term>
 544
 545         <listitem><para>Takes a space-separated list of interfaces to
 546         add MACLVAN or IPVLAN interfaces to, which are then added to
 547         the container. These options correspond to the
 548         <option>--network-macvlan=</option> and
 549         <option>--network-ipvlan=</option> command line switches and
 550         imply <varname>Private=yes</varname>. These options are
 551         privileged (see above).</para></listitem>
 552       </varlistentry>
 553
 554       <varlistentry>
 555         <term><varname>Bridge=</varname></term>
 556
 557         <listitem><para>Takes an interface name. This setting implies
 558         <varname>VirtualEthernet=yes</varname> and
 559         <varname>Private=yes</varname> and has the effect that the
 560         host side of the created virtual Ethernet link is connected to
 561         the specified bridge interface. This option corresponds to the
 562         <option>--network-bridge=</option> command line switch. This
 563         option is privileged (see above).</para></listitem>
 564       </varlistentry>
 565
 566       <varlistentry>
 567         <term><varname>Zone=</varname></term>
 568
 569         <listitem><para>Takes a network zone name. This setting implies <varname>VirtualEthernet=yes</varname> and
 570         <varname>Private=yes</varname> and has the effect that the host side of the created virtual Ethernet link is
 571         connected to an automatically managed bridge interface named after the passed argument, prefixed with
 572         <literal>vz-</literal>. This option corresponds to the <option>--network-zone=</option> command line
 573         switch. This option is privileged (see above).</para></listitem>
 574       </varlistentry>
 575
 576       <varlistentry>
 577         <term><varname>Port=</varname></term>
 578
 579         <listitem><para>Exposes a TCP or UDP port of the container on
 580         the host. This option corresponds to the
 581         <option>--port=</option> command line switch, see
 582         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 583         for the precise syntax of the argument this option takes. This
 584         option is privileged (see above).</para></listitem>
 585       </varlistentry>
 586     </variablelist>
 587   </refsect1>
 588
 589   <refsect1>
 590     <title>See Also</title>
 591     <para>
 592       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 593       <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 594       <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 595     </para>
 596   </refsect1>
 597
 598 </refentry>