]>
Commit | Line | Data |
---|---|---|
c454426c | 1 | <?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*--> |
19887cd0 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" |
12b42c76 | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> |
19887cd0 ZJS |
4 | |
5 | <!-- | |
6 | This file is part of systemd. | |
7 | ||
8 | Copyright 2013 Zbigniew Jędrzejewski-Szmek | |
9 | ||
10 | systemd is free software; you can redistribute it and/or modify it | |
11 | under the terms of the GNU Lesser General Public License as published by | |
12 | the Free Software Foundation; either version 2.1 of the License, or | |
13 | (at your option) any later version. | |
14 | ||
15 | systemd is distributed in the hope that it will be useful, but | |
16 | WITHOUT ANY WARRANTY; without even the implied warranty of | |
17 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
18 | Lesser General Public License for more details. | |
19 | ||
20 | You should have received a copy of the GNU Lesser General Public License | |
21 | along with systemd; If not, see <http://www.gnu.org/licenses/>. | |
22 | --> | |
23 | ||
21ac6ff1 | 24 | <refentry id="machinectl" conditional='ENABLE_MACHINED' |
798d3a52 ZJS |
25 | xmlns:xi="http://www.w3.org/2001/XInclude"> |
26 | ||
27 | <refentryinfo> | |
28 | <title>machinectl</title> | |
29 | <productname>systemd</productname> | |
30 | ||
31 | <authorgroup> | |
32 | <author> | |
33 | <contrib>Developer</contrib> | |
34 | <firstname>Lennart</firstname> | |
35 | <surname>Poettering</surname> | |
36 | <email>lennart@poettering.net</email> | |
37 | </author> | |
38 | </authorgroup> | |
39 | </refentryinfo> | |
40 | ||
41 | <refmeta> | |
42 | <refentrytitle>machinectl</refentrytitle> | |
43 | <manvolnum>1</manvolnum> | |
44 | </refmeta> | |
45 | ||
46 | <refnamediv> | |
47 | <refname>machinectl</refname> | |
48 | <refpurpose>Control the systemd machine manager</refpurpose> | |
49 | </refnamediv> | |
50 | ||
51 | <refsynopsisdiv> | |
52 | <cmdsynopsis> | |
53 | <command>machinectl</command> | |
54 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
55 | <arg choice="req">COMMAND</arg> | |
56 | <arg choice="opt" rep="repeat">NAME</arg> | |
57 | </cmdsynopsis> | |
58 | </refsynopsisdiv> | |
59 | ||
60 | <refsect1> | |
61 | <title>Description</title> | |
62 | ||
63 | <para><command>machinectl</command> may be used to introspect and | |
64 | control the state of the | |
65 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
66 | virtual machine and container registration manager | |
67 | <citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para> | |
91913f58 LP |
68 | |
69 | <para><command>machinectl</command> may be used to execute | |
70 | operations on machines and images. Machines in this sense are | |
71 | considered running instances of:</para> | |
72 | ||
73 | <itemizedlist> | |
74 | <listitem><para>Virtual Machines (VMs) that virtualize hardware | |
75 | to run full operating system (OS) instances (including their kernels) | |
76 | in a virtualized environment on top of the host OS.</para></listitem> | |
77 | ||
78 | <listitem><para>Containers that share the hardware and | |
79 | OS kernel with the host OS, in order to run | |
80 | OS userspace instances on top the host OS.</para></listitem> | |
81 | ||
82 | <listitem><para>The host system itself</para></listitem> | |
83 | </itemizedlist> | |
84 | ||
85 | <para>Machines are identified by names that follow the same rules | |
b938cb90 JE |
86 | as UNIX and DNS host names, for details, see below. Machines are |
87 | instantiated from disk or file system images that frequently — but not | |
88 | necessarily — carry the same name as machines running from | |
91913f58 LP |
89 | them. Images in this sense are considered:</para> |
90 | ||
91 | <itemizedlist> | |
92 | <listitem><para>Directory trees containing an OS, including its | |
93 | top-level directories <filename>/usr</filename>, | |
94 | <filename>/etc</filename>, and so on.</para></listitem> | |
95 | ||
96 | <listitem><para>btrfs subvolumes containing OS trees, similar to | |
97 | normal directory trees.</para></listitem> | |
98 | ||
99 | <listitem><para>Binary "raw" disk images containing MBR or GPT | |
100 | partition tables and Linux file system partitions.</para></listitem> | |
101 | ||
102 | <listitem><para>The file system tree of the host OS itself.</para></listitem> | |
103 | </itemizedlist> | |
104 | ||
798d3a52 ZJS |
105 | </refsect1> |
106 | ||
107 | <refsect1> | |
108 | <title>Options</title> | |
109 | ||
110 | <para>The following options are understood:</para> | |
111 | ||
112 | <variablelist> | |
113 | <varlistentry> | |
114 | <term><option>-p</option></term> | |
115 | <term><option>--property=</option></term> | |
116 | ||
117 | <listitem><para>When showing machine or image properties, | |
118 | limit the output to certain properties as specified by the | |
119 | argument. If not specified, all set properties are shown. The | |
120 | argument should be a property name, such as | |
121 | <literal>Name</literal>. If specified more than once, all | |
122 | properties with the specified names are | |
123 | shown.</para></listitem> | |
124 | </varlistentry> | |
125 | ||
126 | <varlistentry> | |
127 | <term><option>-a</option></term> | |
128 | <term><option>--all</option></term> | |
129 | ||
130 | <listitem><para>When showing machine or image properties, show | |
131 | all properties regardless of whether they are set or | |
132 | not.</para> | |
133 | ||
134 | <para>When listing VM or container images, do not suppress | |
135 | images beginning in a dot character | |
d94c2b06 LP |
136 | (<literal>.</literal>).</para> |
137 | ||
138 | <para>When cleaning VM or container images, remove all images, not just hidden ones.</para></listitem> | |
798d3a52 ZJS |
139 | </varlistentry> |
140 | ||
85500523 ZJS |
141 | <varlistentry> |
142 | <term><option>--value</option></term> | |
143 | ||
144 | <listitem><para>When printing properties with <command>show</command>, only print the value, | |
145 | and skip the property name and <literal>=</literal>.</para></listitem> | |
146 | </varlistentry> | |
147 | ||
798d3a52 ZJS |
148 | <varlistentry> |
149 | <term><option>-l</option></term> | |
150 | <term><option>--full</option></term> | |
151 | ||
152 | <listitem><para>Do not ellipsize process tree entries.</para> | |
153 | </listitem> | |
154 | </varlistentry> | |
155 | ||
156 | <varlistentry> | |
157 | <term><option>--no-ask-password</option></term> | |
158 | ||
159 | <listitem><para>Do not query the user for authentication for | |
160 | privileged operations.</para></listitem> | |
161 | </varlistentry> | |
162 | ||
163 | <varlistentry> | |
164 | <term><option>--kill-who=</option></term> | |
165 | ||
166 | <listitem><para>When used with <command>kill</command>, choose | |
167 | which processes to kill. Must be one of | |
168 | <option>leader</option>, or <option>all</option> to select | |
169 | whether to kill only the leader process of the machine or all | |
170 | processes of the machine. If omitted, defaults to | |
171 | <option>all</option>.</para></listitem> | |
172 | </varlistentry> | |
173 | ||
174 | <varlistentry> | |
175 | <term><option>-s</option></term> | |
176 | <term><option>--signal=</option></term> | |
177 | ||
178 | <listitem><para>When used with <command>kill</command>, choose | |
179 | which signal to send to selected processes. Must be one of the | |
180 | well-known signal specifiers, such as | |
181 | <constant>SIGTERM</constant>, <constant>SIGINT</constant> or | |
182 | <constant>SIGSTOP</constant>. If omitted, defaults to | |
183 | <constant>SIGTERM</constant>.</para></listitem> | |
184 | </varlistentry> | |
185 | ||
c454426c LP |
186 | <varlistentry> |
187 | <term><option>--uid=</option></term> | |
188 | ||
bc3bb330 ZJS |
189 | <listitem><para>When used with the <command>shell</command> command, chooses the user ID to |
190 | open the interactive shell session as. If the argument to the <command>shell</command> | |
b17649ee | 191 | command also specifies a user name, this option is ignored. If the name is not specified |
bc3bb330 ZJS |
192 | in either way, <literal>root</literal> will be used by default. Note that this switch is |
193 | not supported for the <command>login</command> command (see below).</para></listitem> | |
c454426c LP |
194 | </varlistentry> |
195 | ||
196 | <varlistentry> | |
4d46e5db ZJS |
197 | <term><option>-E <replaceable>NAME</replaceable>=<replaceable>VALUE</replaceable></option></term> |
198 | <term><option>--setenv=<replaceable>NAME</replaceable>=<replaceable>VALUE</replaceable></option></term> | |
199 | ||
200 | <listitem><para>When used with the <command>shell</command> command, sets an environment | |
201 | variable to pass to the executed shell. Takes an environment variable name and value, | |
202 | separated by <literal>=</literal>. This switch may be used multiple times to set multiple | |
203 | environment variables. Note that this switch is not supported for the | |
204 | <command>login</command> command (see below).</para></listitem> | |
c454426c LP |
205 | </varlistentry> |
206 | ||
798d3a52 ZJS |
207 | <varlistentry> |
208 | <term><option>--mkdir</option></term> | |
209 | ||
b938cb90 | 210 | <listitem><para>When used with <command>bind</command>, creates |
798d3a52 ZJS |
211 | the destination directory before applying the bind |
212 | mount.</para></listitem> | |
213 | </varlistentry> | |
214 | ||
798d3a52 ZJS |
215 | <varlistentry> |
216 | <term><option>--read-only</option></term> | |
217 | ||
b938cb90 | 218 | <listitem><para>When used with <command>bind</command>, applies |
d94c2b06 | 219 | a read-only bind mount.</para> |
798d3a52 | 220 | |
d94c2b06 LP |
221 | <para>When used with <command>clone</command>, <command>import-raw</command> or <command>import-tar</command> a |
222 | read-only container or VM image is created.</para></listitem> | |
223 | </varlistentry> | |
798d3a52 ZJS |
224 | |
225 | <varlistentry> | |
226 | <term><option>-n</option></term> | |
227 | <term><option>--lines=</option></term> | |
228 | ||
229 | <listitem><para>When used with <command>status</command>, | |
230 | controls the number of journal lines to show, counting from | |
231 | the most recent ones. Takes a positive integer argument. | |
232 | Defaults to 10.</para> | |
233 | </listitem> | |
234 | </varlistentry> | |
235 | ||
236 | <varlistentry> | |
237 | <term><option>-o</option></term> | |
238 | <term><option>--output=</option></term> | |
239 | ||
240 | <listitem><para>When used with <command>status</command>, | |
241 | controls the formatting of the journal entries that are shown. | |
242 | For the available choices, see | |
243 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>. | |
244 | Defaults to <literal>short</literal>.</para></listitem> | |
245 | </varlistentry> | |
246 | ||
247 | <varlistentry> | |
248 | <term><option>--verify=</option></term> | |
249 | ||
250 | <listitem><para>When downloading a container or VM image, | |
251 | specify whether the image shall be verified before it is made | |
252 | available. Takes one of <literal>no</literal>, | |
253 | <literal>checksum</literal> and <literal>signature</literal>. | |
b938cb90 JE |
254 | If <literal>no</literal>, no verification is done. If |
255 | <literal>checksum</literal> is specified, the download is | |
a8eaaee7 | 256 | checked for integrity after the transfer is complete, but no |
798d3a52 | 257 | signatures are verified. If <literal>signature</literal> is |
7f3fdb7f | 258 | specified, the checksum is verified and the image's signature |
798d3a52 ZJS |
259 | is checked against a local keyring of trustable vendors. It is |
260 | strongly recommended to set this option to | |
261 | <literal>signature</literal> if the server and protocol | |
262 | support this. Defaults to | |
263 | <literal>signature</literal>.</para></listitem> | |
264 | </varlistentry> | |
265 | ||
266 | <varlistentry> | |
267 | <term><option>--force</option></term> | |
268 | ||
269 | <listitem><para>When downloading a container or VM image, and | |
270 | a local copy by the specified local machine name already | |
271 | exists, delete it first and replace it by the newly downloaded | |
272 | image.</para></listitem> | |
273 | </varlistentry> | |
274 | ||
6e9efa59 LP |
275 | <varlistentry> |
276 | <term><option>--format=</option></term> | |
277 | ||
278 | <listitem><para>When used with the <option>export-tar</option> | |
b938cb90 | 279 | or <option>export-raw</option> commands, specifies the |
6e9efa59 LP |
280 | compression format to use for the resulting file. Takes one of |
281 | <literal>uncompressed</literal>, <literal>xz</literal>, | |
b938cb90 | 282 | <literal>gzip</literal>, <literal>bzip2</literal>. By default, |
6e9efa59 LP |
283 | the format is determined automatically from the image file |
284 | name passed.</para></listitem> | |
285 | </varlistentry> | |
286 | ||
07b0b339 SK |
287 | <varlistentry> |
288 | <term><option>--max-addresses=</option></term> | |
289 | ||
290 | <listitem><para>When used with the <option>list-machines</option> | |
291 | command, limits the number of ip addresses output for every machine. | |
292 | Defaults to 1. All addresses can be requested with <literal>all</literal> | |
293 | as argument to <option>--max-addresses</option> . If the argument to | |
294 | <option>--max-addresses</option> is less than the actual number | |
2a03116d | 295 | of addresses, <literal>...</literal>follows the last address. |
07b0b339 SK |
296 | If multiple addresses are to be written for a given machine, every |
297 | address except the first one is on a new line and is followed by | |
298 | <literal>,</literal> if another address will be output afterwards. </para></listitem> | |
299 | </varlistentry> | |
300 | ||
798d3a52 ZJS |
301 | <xi:include href="user-system-options.xml" xpointer="host" /> |
302 | <xi:include href="user-system-options.xml" xpointer="machine" /> | |
303 | ||
304 | <xi:include href="standard-options.xml" xpointer="no-pager" /> | |
305 | <xi:include href="standard-options.xml" xpointer="no-legend" /> | |
306 | <xi:include href="standard-options.xml" xpointer="help" /> | |
307 | <xi:include href="standard-options.xml" xpointer="version" /> | |
308 | </variablelist> | |
309 | </refsect1> | |
310 | ||
311 | <refsect1> | |
312 | <title>Commands</title> | |
313 | ||
314 | <para>The following commands are understood:</para> | |
315 | ||
316 | <refsect2><title>Machine Commands</title><variablelist> | |
317 | ||
318 | <varlistentry> | |
319 | <term><command>list</command></term> | |
320 | ||
321 | <listitem><para>List currently running (online) virtual | |
91913f58 LP |
322 | machines and containers. To enumerate machine images that can |
323 | be started, use <command>list-images</command> (see | |
324 | below). Note that this command hides the special | |
325 | <literal>.host</literal> machine by default. Use the | |
326 | <option>--all</option> switch to show it.</para></listitem> | |
798d3a52 ZJS |
327 | </varlistentry> |
328 | ||
329 | <varlistentry> | |
1eecafb8 | 330 | <term><command>status</command> <replaceable>NAME</replaceable>…</term> |
798d3a52 | 331 | |
28f90ea2 | 332 | <listitem><para>Show runtime status information about |
798d3a52 ZJS |
333 | one or more virtual machines and containers, followed by the |
334 | most recent log data from the journal. This function is | |
335 | intended to generate human-readable output. If you are looking | |
336 | for computer-parsable output, use <command>show</command> | |
337 | instead. Note that the log data shown is reported by the | |
338 | virtual machine or container manager, and frequently contains | |
339 | console output of the machine, but not necessarily journal | |
340 | contents of the machine itself.</para></listitem> | |
341 | </varlistentry> | |
342 | ||
343 | <varlistentry> | |
1eecafb8 | 344 | <term><command>show</command> [<replaceable>NAME</replaceable>…]</term> |
798d3a52 | 345 | |
e9c880dd LP |
346 | <listitem><para>Show properties of one or more registered virtual machines or containers or the manager |
347 | itself. If no argument is specified, properties of the manager will be shown. If a NAME is specified, | |
348 | properties of this virtual machine or container are shown. By default, empty properties are suppressed. Use | |
349 | <option>--all</option> to show those too. To select specific properties to show, use | |
350 | <option>--property=</option>. This command is intended to be used whenever computer-parsable output is | |
351 | required, and does not print the control group tree or journal entries. Use <command>status</command> if you | |
352 | are looking for formatted human-readable output.</para></listitem> | |
798d3a52 ZJS |
353 | </varlistentry> |
354 | ||
355 | <varlistentry> | |
1eecafb8 | 356 | <term><command>start</command> <replaceable>NAME</replaceable>…</term> |
798d3a52 ZJS |
357 | |
358 | <listitem><para>Start a container as a system service, using | |
359 | <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>. | |
360 | This starts <filename>systemd-nspawn@.service</filename>, | |
361 | instantiated for the specified machine name, similar to the | |
362 | effect of <command>systemctl start</command> on the service | |
363 | name. <command>systemd-nspawn</command> looks for a container | |
364 | image by the specified name in | |
365 | <filename>/var/lib/machines/</filename> (and other search | |
366 | paths, see below) and runs it. Use | |
b938cb90 | 367 | <command>list-images</command> (see below) for listing |
798d3a52 ZJS |
368 | available container images to start.</para> |
369 | ||
370 | <para>Note that | |
371 | <citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry> | |
372 | also interfaces with a variety of other container and VM | |
373 | managers, <command>systemd-nspawn</command> is just one | |
374 | implementation of it. Most of the commands available in | |
375 | <command>machinectl</command> may be used on containers or VMs | |
376 | controlled by other managers, not just | |
377 | <command>systemd-nspawn</command>. Starting VMs and container | |
378 | images on those managers requires manager-specific | |
379 | tools.</para> | |
380 | ||
381 | <para>To interactively start a container on the command line | |
382 | with full access to the container's console, please invoke | |
383 | <command>systemd-nspawn</command> directly. To stop a running | |
b2bb19bb | 384 | container use <command>machinectl poweroff</command>.</para></listitem> |
798d3a52 ZJS |
385 | </varlistentry> |
386 | ||
387 | <varlistentry> | |
91913f58 | 388 | <term><command>login</command> [<replaceable>NAME</replaceable>]</term> |
798d3a52 | 389 | |
c454426c | 390 | <listitem><para>Open an interactive terminal login session in |
b938cb90 | 391 | a container or on the local host. If an argument is supplied, |
91913f58 LP |
392 | it refers to the container machine to connect to. If none is |
393 | specified, or the container name is specified as the empty | |
394 | string, or the special machine name <literal>.host</literal> | |
395 | (see below) is specified, the connection is made to the local | |
396 | host instead. This will create a TTY connection to a specific | |
397 | container or the local host and asks for the execution of a | |
398 | getty on it. Note that this is only supported for containers | |
399 | running | |
798d3a52 ZJS |
400 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
401 | as init system.</para> | |
402 | ||
403 | <para>This command will open a full login prompt on the | |
91913f58 LP |
404 | container or the local host, which then asks for username and |
405 | password. Use <command>shell</command> (see below) or | |
798d3a52 | 406 | <citerefentry><refentrytitle>systemd-run</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
91913f58 LP |
407 | with the <option>--machine=</option> switch to directly invoke |
408 | a single command, either interactively or in the | |
409 | background.</para></listitem> | |
798d3a52 ZJS |
410 | </varlistentry> |
411 | ||
c454426c | 412 | <varlistentry> |
1eecafb8 | 413 | <term><command>shell</command> [[<replaceable>NAME</replaceable>@]<replaceable>NAME</replaceable> [<replaceable>PATH</replaceable> [<replaceable>ARGUMENTS</replaceable>…]]] </term> |
c454426c LP |
414 | |
415 | <listitem><para>Open an interactive shell session in a | |
91913f58 LP |
416 | container or on the local host. The first argument refers to |
417 | the container machine to connect to. If none is specified, or | |
418 | the machine name is specified as the empty string, or the | |
419 | special machine name <literal>.host</literal> (see below) is | |
420 | specified, the connection is made to the local host | |
421 | instead. This works similar to <command>login</command> but | |
422 | immediately invokes a user process. This command runs the | |
423 | specified executable with the specified arguments, or | |
b938cb90 | 424 | <filename>/bin/sh</filename> if none is specified. By default, |
ef3100e9 LP |
425 | opens a <literal>root</literal> shell, but by using |
426 | <option>--uid=</option>, or by prefixing the machine name with | |
427 | a username and an <literal>@</literal> character, a different | |
428 | user may be selected. Use <option>--setenv=</option> to set | |
429 | environment variables for the executed process.</para> | |
430 | ||
7f129a1f LP |
431 | <para>Note that <command>machinectl shell</command> does not propagate the exit code/status of the invoked |
432 | shell process. Use <command>systemd-run</command> instead if that information is required (see below).</para> | |
433 | ||
ef3100e9 | 434 | <para>When using the <command>shell</command> command without |
b938cb90 | 435 | arguments, (thus invoking the executed shell or command on the |
a8eaaee7 | 436 | local host), it is in many ways similar to a <citerefentry |
ef3100e9 | 437 | project='die-net'><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
b938cb90 | 438 | session, but, unlike <command>su</command>, completely isolates |
ef3100e9 LP |
439 | the new session from the originating session, so that it |
440 | shares no process or session properties, and is in a clean and | |
441 | well-defined state. It will be tracked in a new utmp, login, | |
762a5766 LP |
442 | audit, security and keyring session, and will not inherit any |
443 | environment variables or resource limits, among other | |
444 | properties.</para> | |
ef3100e9 | 445 | |
7f129a1f LP |
446 | <para>Note that <citerefentry><refentrytitle>systemd-run</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
447 | with its <option>--machine=</option> switch may be used in place of the <command>machinectl shell</command> | |
448 | command, and allows non-interactive operation, more detailed and low-level configuration of the invoked unit, | |
449 | as well as access to runtime and exit code/status information of the invoked shell process. In particular, use | |
450 | <command>systemd-run</command>'s <option>--wait</option> switch to propagate exit status information of the | |
451 | invoked process. Use <command>systemd-run</command>'s <option>--pty</option> switch for acquiring an | |
452 | interactive shell, similar to <command>machinectl shell</command>. In general, <command>systemd-run</command> | |
453 | is preferable for scripting purposes. However, note that <command>systemd-run</command> might require higher | |
454 | privileges than <command>machinectl shell</command>.</para></listitem> | |
c454426c LP |
455 | </varlistentry> |
456 | ||
798d3a52 | 457 | <varlistentry> |
1eecafb8 ZJS |
458 | <term><command>enable</command> <replaceable>NAME</replaceable>…</term> |
459 | <term><command>disable</command> <replaceable>NAME</replaceable>…</term> | |
798d3a52 ZJS |
460 | |
461 | <listitem><para>Enable or disable a container as a system | |
462 | service to start at system boot, using | |
463 | <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>. | |
464 | This enables or disables | |
465 | <filename>systemd-nspawn@.service</filename>, instantiated for | |
466 | the specified machine name, similar to the effect of | |
467 | <command>systemctl enable</command> or <command>systemctl | |
468 | disable</command> on the service name.</para></listitem> | |
469 | </varlistentry> | |
470 | ||
471 | <varlistentry> | |
1eecafb8 | 472 | <term><command>poweroff</command> <replaceable>NAME</replaceable>…</term> |
798d3a52 ZJS |
473 | |
474 | <listitem><para>Power off one or more containers. This will | |
475 | trigger a reboot by sending SIGRTMIN+4 to the container's init | |
476 | process, which causes systemd-compatible init systems to shut | |
b2bb19bb CR |
477 | down cleanly. Use <command>stop</command> as alias for <command>poweroff</command>. |
478 | This operation does not work on containers that do not run a | |
798d3a52 ZJS |
479 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>-compatible |
480 | init system, such as sysvinit. Use | |
481 | <command>terminate</command> (see below) to immediately | |
482 | terminate a container or VM, without cleanly shutting it | |
483 | down.</para></listitem> | |
484 | </varlistentry> | |
485 | ||
486 | <varlistentry> | |
1eecafb8 | 487 | <term><command>reboot</command> <replaceable>NAME</replaceable>…</term> |
798d3a52 ZJS |
488 | |
489 | <listitem><para>Reboot one or more containers. This will | |
490 | trigger a reboot by sending SIGINT to the container's init | |
491 | process, which is roughly equivalent to pressing Ctrl+Alt+Del | |
492 | on a non-containerized system, and is compatible with | |
493 | containers running any system manager.</para></listitem> | |
494 | </varlistentry> | |
495 | ||
496 | <varlistentry> | |
1eecafb8 | 497 | <term><command>terminate</command> <replaceable>NAME</replaceable>…</term> |
798d3a52 ZJS |
498 | |
499 | <listitem><para>Immediately terminates a virtual machine or | |
500 | container, without cleanly shutting it down. This kills all | |
501 | processes of the virtual machine or container and deallocates | |
502 | all resources attached to that instance. Use | |
503 | <command>poweroff</command> to issue a clean shutdown | |
504 | request.</para></listitem> | |
505 | </varlistentry> | |
506 | ||
507 | <varlistentry> | |
1eecafb8 | 508 | <term><command>kill</command> <replaceable>NAME</replaceable>…</term> |
798d3a52 ZJS |
509 | |
510 | <listitem><para>Send a signal to one or more processes of the | |
511 | virtual machine or container. This means processes as seen by | |
512 | the host, not the processes inside the virtual machine or | |
513 | container. Use <option>--kill-who=</option> to select which | |
514 | process to kill. Use <option>--signal=</option> to select the | |
515 | signal to send.</para></listitem> | |
516 | </varlistentry> | |
517 | ||
518 | <varlistentry> | |
519 | <term><command>bind</command> <replaceable>NAME</replaceable> <replaceable>PATH</replaceable> [<replaceable>PATH</replaceable>]</term> | |
520 | ||
7f43928b LP |
521 | <listitem><para>Bind mounts a directory from the host into the specified container. The first directory |
522 | argument is the source directory on the host, the second directory argument is the destination directory in the | |
523 | container. When the latter is omitted, the destination path in the container is the same as the source path on | |
524 | the host. When combined with the <option>--read-only</option> switch, a ready-only bind mount is created. When | |
525 | combined with the <option>--mkdir</option> switch, the destination path is first created before the mount is | |
526 | applied. Note that this option is currently only supported for | |
527 | <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> containers, | |
528 | and only if user namespacing (<option>--private-users</option>) is not used.</para></listitem> | |
798d3a52 ZJS |
529 | </varlistentry> |
530 | ||
531 | <varlistentry> | |
532 | <term><command>copy-to</command> <replaceable>NAME</replaceable> <replaceable>PATH</replaceable> [<replaceable>PATH</replaceable>]</term> | |
533 | ||
534 | <listitem><para>Copies files or directories from the host | |
535 | system into a running container. Takes a container name, | |
536 | followed by the source path on the host and the destination | |
b938cb90 | 537 | path in the container. If the destination path is omitted, the |
d01cd401 | 538 | same as the source path is used.</para> |
798d3a52 | 539 | |
d01cd401 LP |
540 | <para>If host and container share the same user and group namespace, file ownership by numeric user ID and |
541 | group ID is preserved for the copy, otherwise all files and directories in the copy will be owned by the root | |
542 | user and group (UID/GID 0).</para></listitem> | |
543 | </varlistentry> | |
798d3a52 ZJS |
544 | |
545 | <varlistentry> | |
546 | <term><command>copy-from</command> <replaceable>NAME</replaceable> <replaceable>PATH</replaceable> [<replaceable>PATH</replaceable>]</term> | |
547 | ||
548 | <listitem><para>Copies files or directories from a container | |
549 | into the host system. Takes a container name, followed by the | |
550 | source path in the container the destination path on the host. | |
b938cb90 | 551 | If the destination path is omitted, the same as the source path |
d01cd401 LP |
552 | is used.</para> |
553 | ||
554 | <para>If host and container share the same user and group namespace, file ownership by numeric user ID and | |
555 | group ID is preserved for the copy, otherwise all files and directories in the copy will be owned by the root | |
556 | user and group (UID/GID 0).</para></listitem> | |
798d3a52 ZJS |
557 | </varlistentry> |
558 | </variablelist></refsect2> | |
559 | ||
560 | <refsect2><title>Image Commands</title><variablelist> | |
561 | ||
562 | <varlistentry> | |
563 | <term><command>list-images</command></term> | |
564 | ||
565 | <listitem><para>Show a list of locally installed container and | |
566 | VM images. This enumerates all raw disk images and container | |
567 | directories and subvolumes in | |
568 | <filename>/var/lib/machines/</filename> (and other search | |
569 | paths, see below). Use <command>start</command> (see above) to | |
b938cb90 JE |
570 | run a container off one of the listed images. Note that, by |
571 | default, containers whose name begins with a dot | |
798d3a52 ZJS |
572 | (<literal>.</literal>) are not shown. To show these too, |
573 | specify <option>--all</option>. Note that a special image | |
574 | <literal>.host</literal> always implicitly exists and refers | |
575 | to the image the host itself is booted from.</para></listitem> | |
576 | </varlistentry> | |
577 | ||
578 | <varlistentry> | |
1eecafb8 | 579 | <term><command>image-status</command> [<replaceable>NAME</replaceable>…]</term> |
798d3a52 ZJS |
580 | |
581 | <listitem><para>Show terse status information about one or | |
582 | more container or VM images. This function is intended to | |
583 | generate human-readable output. Use | |
584 | <command>show-image</command> (see below) to generate | |
585 | computer-parsable output instead.</para></listitem> | |
586 | </varlistentry> | |
587 | ||
588 | <varlistentry> | |
1eecafb8 | 589 | <term><command>show-image</command> [<replaceable>NAME</replaceable>…]</term> |
798d3a52 ZJS |
590 | |
591 | <listitem><para>Show properties of one or more registered | |
592 | virtual machine or container images, or the manager itself. If | |
593 | no argument is specified, properties of the manager will be | |
037a3ded | 594 | shown. If a NAME is specified, properties of this virtual |
798d3a52 ZJS |
595 | machine or container image are shown. By default, empty |
596 | properties are suppressed. Use <option>--all</option> to show | |
597 | those too. To select specific properties to show, use | |
598 | <option>--property=</option>. This command is intended to be | |
599 | used whenever computer-parsable output is required. Use | |
600 | <command>image-status</command> if you are looking for | |
601 | formatted human-readable output.</para></listitem> | |
602 | </varlistentry> | |
603 | ||
604 | <varlistentry> | |
605 | <term><command>clone</command> <replaceable>NAME</replaceable> <replaceable>NAME</replaceable></term> | |
606 | ||
d13febb1 LP |
607 | <listitem><para>Clones a container or VM image. The arguments specify the name of the image to clone and the |
608 | name of the newly cloned image. Note that plain directory container images are cloned into btrfs subvolume | |
609 | images with this command, if the underlying file system supports this. Note that cloning a container or VM | |
17cbb288 LP |
610 | image is optimized for file systems that support copy-on-write, and might not be efficient on others, due to |
611 | file system limitations.</para> | |
3fe22bb4 LP |
612 | |
613 | <para>Note that this command leaves host name, machine ID and | |
614 | all other settings that could identify the instance | |
615 | unmodified. The original image and the cloned copy will hence | |
616 | share these credentials, and it might be necessary to manually | |
d94c2b06 LP |
617 | change them in the copy.</para> |
618 | ||
619 | <para>If combined with the <option>--read-only</option> switch a read-only cloned image is | |
620 | created.</para></listitem> | |
798d3a52 ZJS |
621 | </varlistentry> |
622 | ||
623 | <varlistentry> | |
624 | <term><command>rename</command> <replaceable>NAME</replaceable> <replaceable>NAME</replaceable></term> | |
625 | ||
d6ce17c7 | 626 | <listitem><para>Renames a container or VM image. The |
798d3a52 ZJS |
627 | arguments specify the name of the image to rename and the new |
628 | name of the image.</para></listitem> | |
629 | </varlistentry> | |
630 | ||
631 | <varlistentry> | |
632 | <term><command>read-only</command> <replaceable>NAME</replaceable> [<replaceable>BOOL</replaceable>]</term> | |
633 | ||
d6ce17c7 | 634 | <listitem><para>Marks or (unmarks) a container or VM image |
798d3a52 ZJS |
635 | read-only. Takes a VM or container image name, followed by a |
636 | boolean as arguments. If the boolean is omitted, positive is | |
637 | implied, i.e. the image is marked read-only.</para></listitem> | |
638 | </varlistentry> | |
639 | ||
798d3a52 | 640 | <varlistentry> |
1eecafb8 | 641 | <term><command>remove</command> <replaceable>NAME</replaceable>…</term> |
798d3a52 | 642 | |
d6ce17c7 | 643 | <listitem><para>Removes one or more container or VM images. |
798d3a52 | 644 | The special image <literal>.host</literal>, which refers to |
b938cb90 | 645 | the host's own directory tree, may not be |
798d3a52 ZJS |
646 | removed.</para></listitem> |
647 | </varlistentry> | |
648 | ||
d6ce17c7 LP |
649 | <varlistentry> |
650 | <term><command>set-limit</command> [<replaceable>NAME</replaceable>] <replaceable>BYTES</replaceable></term> | |
651 | ||
a8eaaee7 | 652 | <listitem><para>Sets the maximum size in bytes that a specific |
b938cb90 | 653 | container or VM image, or all images, may grow up to on disk |
7de30452 | 654 | (disk quota). Takes either one or two parameters. The first, |
d6ce17c7 | 655 | optional parameter refers to a container or VM image name. If |
b938cb90 JE |
656 | specified, the size limit of the specified image is changed. If |
657 | omitted, the overall size limit of the sum of all images stored | |
7de30452 LP |
658 | locally is changed. The final argument specifies the size |
659 | limit in bytes, possibly suffixed by the usual K, M, G, T | |
660 | units. If the size limit shall be disabled, specify | |
661 | <literal>-</literal> as size.</para> | |
662 | ||
663 | <para>Note that per-container size limits are only supported | |
b938cb90 | 664 | on btrfs file systems. Also note that, if |
a8eaaee7 | 665 | <command>set-limit</command> is invoked without an image |
7de30452 LP |
666 | parameter, and <filename>/var/lib/machines</filename> is |
667 | empty, and the directory is not located on btrfs, a btrfs | |
668 | loopback file is implicitly created as | |
669 | <filename>/var/lib/machines.raw</filename> with the given | |
670 | size, and mounted to | |
671 | <filename>/var/lib/machines</filename>. The size of the | |
672 | loopback may later be readjusted with | |
673 | <command>set-limit</command>, as well. If such a | |
674 | loopback-mounted <filename>/var/lib/machines</filename> | |
a8eaaee7 | 675 | directory is used, <command>set-limit</command> without an image |
7de30452 LP |
676 | name alters both the quota setting within the file system as |
677 | well as the loopback file and file system size | |
678 | itself.</para></listitem> | |
d6ce17c7 LP |
679 | </varlistentry> |
680 | ||
d94c2b06 LP |
681 | <varlistentry> |
682 | <term><command>clean</command></term> | |
683 | ||
684 | <listitem><para>Remove hidden VM or container images (or all). This command removes all hidden machine images | |
685 | from <filename>/var/lib/machines</filename>, i.e. those whose name begins with a dot. Use <command>machinectl | |
686 | list-images --all</command> to see a list of all machine images, including the hidden ones.</para> | |
687 | ||
688 | <para>When combined with the <option>--all</option> switch removes all images, not just hidden ones. This | |
689 | command effectively empties <filename>/var/lib/machines</filename>.</para> | |
690 | ||
691 | <para>Note that commands such as <command>machinectl pull-tar</command> or <command>machinectl | |
692 | pull-raw</command> usually create hidden, read-only, unmodified machine images from the downloaded image first, | |
693 | before cloning a writable working copy of it, in order to avoid duplicate downloads in case of images that are | |
694 | reused multiple times. Use <command>machinectl clean</command> to remove old, hidden images created this | |
695 | way.</para></listitem> | |
696 | </varlistentry> | |
697 | ||
798d3a52 ZJS |
698 | </variablelist></refsect2> |
699 | ||
700 | <refsect2><title>Image Transfer Commands</title><variablelist> | |
701 | ||
702 | <varlistentry> | |
703 | <term><command>pull-tar</command> <replaceable>URL</replaceable> [<replaceable>NAME</replaceable>]</term> | |
704 | ||
705 | <listitem><para>Downloads a <filename>.tar</filename> | |
706 | container image from the specified URL, and makes it available | |
707 | under the specified local machine name. The URL must be of | |
708 | type <literal>http://</literal> or | |
709 | <literal>https://</literal>, and must refer to a | |
710 | <filename>.tar</filename>, <filename>.tar.gz</filename>, | |
711 | <filename>.tar.xz</filename> or <filename>.tar.bz2</filename> | |
b938cb90 | 712 | archive file. If the local machine name is omitted, it |
798d3a52 ZJS |
713 | is automatically derived from the last component of the URL, |
714 | with its suffix removed.</para> | |
715 | ||
697be0be TB |
716 | <para>The image is verified before it is made available, unless |
717 | <option>--verify=no</option> is specified. | |
718 | Verification is done either via an inline signed file with the name | |
719 | of the image and the suffix <filename>.sha256</filename> or via | |
720 | separate <filename>SHA256SUMS</filename> and | |
721 | <filename>SHA256SUMS.gpg</filename> files. | |
722 | The signature files need to be made available on the same web | |
723 | server, under the same URL as the <filename>.tar</filename> file. | |
724 | With <option>--verify=checksum</option>, only the SHA256 checksum | |
725 | for the file is verified, based on the <filename>.sha256</filename> | |
726 | suffixed file or the<filename>SHA256SUMS</filename> file. | |
727 | With <option>--verify=signature</option>, the sha checksum file is | |
728 | first verified with the inline signature in the | |
729 | <filename>.sha256</filename> file or the detached GPG signature file | |
730 | <filename>SHA256SUMS.gpg</filename>. | |
731 | The public key for this verification step needs to be available in | |
12b42c76 TG |
732 | <filename>/usr/lib/systemd/import-pubring.gpg</filename> or |
733 | <filename>/etc/systemd/import-pubring.gpg</filename>.</para> | |
798d3a52 ZJS |
734 | |
735 | <para>The container image will be downloaded and stored in a | |
736 | read-only subvolume in | |
b938cb90 | 737 | <filename>/var/lib/machines/</filename> that is named after |
798d3a52 ZJS |
738 | the specified URL and its HTTP etag. A writable snapshot is |
739 | then taken from this subvolume, and named after the specified | |
dd2b607b | 740 | local name. This behavior ensures that creating multiple |
798d3a52 ZJS |
741 | container instances of the same URL is efficient, as multiple |
742 | downloads are not necessary. In order to create only the | |
743 | read-only image, and avoid creating its writable snapshot, | |
744 | specify <literal>-</literal> as local machine name.</para> | |
745 | ||
746 | <para>Note that the read-only subvolume is prefixed with | |
6b94875f | 747 | <filename>.tar-</filename>, and is thus not shown by |
798d3a52 ZJS |
748 | <command>list-images</command>, unless <option>--all</option> |
749 | is passed.</para> | |
750 | ||
751 | <para>Note that pressing C-c during execution of this command | |
752 | will not abort the download. Use | |
753 | <command>cancel-transfer</command>, described | |
754 | below.</para></listitem> | |
755 | </varlistentry> | |
756 | ||
757 | <varlistentry> | |
758 | <term><command>pull-raw</command> <replaceable>URL</replaceable> [<replaceable>NAME</replaceable>]</term> | |
759 | ||
760 | <listitem><para>Downloads a <filename>.raw</filename> | |
761 | container or VM disk image from the specified URL, and makes | |
762 | it available under the specified local machine name. The URL | |
763 | must be of type <literal>http://</literal> or | |
764 | <literal>https://</literal>. The container image must either | |
765 | be a <filename>.qcow2</filename> or raw disk image, optionally | |
766 | compressed as <filename>.gz</filename>, | |
767 | <filename>.xz</filename>, or <filename>.bz2</filename>. If the | |
b938cb90 | 768 | local machine name is omitted, it is automatically |
798d3a52 ZJS |
769 | derived from the last component of the URL, with its suffix |
770 | removed.</para> | |
771 | ||
772 | <para>Image verification is identical for raw and tar images | |
773 | (see above).</para> | |
774 | ||
1d3eaa93 | 775 | <para>If the downloaded image is in |
6b94875f | 776 | <filename>.qcow2</filename> format it is converted into a raw |
798d3a52 ZJS |
777 | image file before it is made available.</para> |
778 | ||
779 | <para>Downloaded images of this type will be placed as | |
780 | read-only <filename>.raw</filename> file in | |
781 | <filename>/var/lib/machines/</filename>. A local, writable | |
782 | (reflinked) copy is then made under the specified local | |
783 | machine name. To omit creation of the local, writable copy | |
784 | pass <literal>-</literal> as local machine name.</para> | |
785 | ||
dd2b607b | 786 | <para>Similar to the behavior of <command>pull-tar</command>, |
798d3a52 | 787 | the read-only image is prefixed with |
6b94875f | 788 | <filename>.raw-</filename>, and thus not shown by |
798d3a52 ZJS |
789 | <command>list-images</command>, unless <option>--all</option> |
790 | is passed.</para> | |
791 | ||
792 | <para>Note that pressing C-c during execution of this command | |
793 | will not abort the download. Use | |
794 | <command>cancel-transfer</command>, described | |
795 | below.</para></listitem> | |
796 | </varlistentry> | |
797 | ||
af40e5d3 LP |
798 | <varlistentry> |
799 | <term><command>import-tar</command> <replaceable>FILE</replaceable> [<replaceable>NAME</replaceable>]</term> | |
800 | <term><command>import-raw</command> <replaceable>FILE</replaceable> [<replaceable>NAME</replaceable>]</term> | |
801 | <listitem><para>Imports a TAR or RAW container or VM image, | |
802 | and places it under the specified name in | |
803 | <filename>/var/lib/machines/</filename>. When | |
b938cb90 | 804 | <command>import-tar</command> is used, the file specified as |
a8eaaee7 | 805 | the first argument should be a tar archive, possibly compressed |
af40e5d3 LP |
806 | with xz, gzip or bzip2. It will then be unpacked into its own |
807 | subvolume in <filename>/var/lib/machines</filename>. When | |
b938cb90 | 808 | <command>import-raw</command> is used, the file should be a |
af40e5d3 LP |
809 | qcow2 or raw disk image, possibly compressed with xz, gzip or |
810 | bzip2. If the second argument (the resulting image name) is | |
b938cb90 JE |
811 | not specified, it is automatically derived from the file |
812 | name. If the file name is passed as <literal>-</literal>, the | |
af40e5d3 LP |
813 | image is read from standard input, in which case the second |
814 | argument is mandatory.</para> | |
815 | ||
ace483c4 JE |
816 | <para>Both <command>pull-tar</command> and <command>pull-raw</command> |
817 | will resize <filename>/var/lib/machines.raw</filename> and the | |
818 | filesystem therein as necessary. Optionally, the | |
af40e5d3 LP |
819 | <option>--read-only</option> switch may be used to create a |
820 | read-only container or VM image. No cryptographic validation | |
821 | is done when importing the images.</para> | |
822 | ||
823 | <para>Much like image downloads, ongoing imports may be listed | |
824 | with <command>list-transfers</command> and aborted with | |
825 | <command>cancel-transfer</command>.</para></listitem> | |
826 | </varlistentry> | |
827 | ||
6e9efa59 LP |
828 | <varlistentry> |
829 | <term><command>export-tar</command> <replaceable>NAME</replaceable> [<replaceable>FILE</replaceable>]</term> | |
830 | <term><command>export-raw</command> <replaceable>NAME</replaceable> [<replaceable>FILE</replaceable>]</term> | |
831 | <listitem><para>Exports a TAR or RAW container or VM image and | |
832 | stores it in the specified file. The first parameter should be | |
833 | a VM or container image name. The second parameter should be a | |
834 | file path the TAR or RAW image is written to. If the path ends | |
b938cb90 JE |
835 | in <literal>.gz</literal>, the file is compressed with gzip, if |
836 | it ends in <literal>.xz</literal>, with xz, and if it ends in | |
837 | <literal>.bz2</literal>, with bzip2. If the path ends in | |
838 | neither, the file is left uncompressed. If the second argument | |
839 | is missing, the image is written to standard output. The | |
6e9efa59 LP |
840 | compression may also be explicitly selected with the |
841 | <option>--format=</option> switch. This is in particular | |
842 | useful if the second parameter is left unspecified.</para> | |
843 | ||
844 | <para>Much like image downloads and imports, ongoing exports | |
845 | may be listed with <command>list-transfers</command> and | |
846 | aborted with | |
847 | <command>cancel-transfer</command>.</para> | |
848 | ||
b938cb90 | 849 | <para>Note that, currently, only directory and subvolume images |
6e9efa59 LP |
850 | may be exported as TAR images, and only raw disk images as RAW |
851 | images.</para></listitem> | |
852 | </varlistentry> | |
853 | ||
798d3a52 ZJS |
854 | <varlistentry> |
855 | <term><command>list-transfers</command></term> | |
856 | ||
857 | <listitem><para>Shows a list of container or VM image | |
6e9efa59 | 858 | downloads, imports and exports that are currently in |
af40e5d3 | 859 | progress.</para></listitem> |
798d3a52 ZJS |
860 | </varlistentry> |
861 | ||
862 | <varlistentry> | |
1eecafb8 | 863 | <term><command>cancel-transfers</command> <replaceable>ID</replaceable>…</term> |
798d3a52 | 864 | |
6e9efa59 LP |
865 | <listitem><para>Aborts a download, import or export of the |
866 | container or VM image with the specified ID. To list ongoing | |
867 | transfers and their IDs, use | |
af40e5d3 | 868 | <command>list-transfers</command>. </para></listitem> |
798d3a52 ZJS |
869 | </varlistentry> |
870 | ||
871 | </variablelist></refsect2> | |
872 | ||
873 | </refsect1> | |
874 | ||
91913f58 LP |
875 | <refsect1> |
876 | <title>Machine and Image Names</title> | |
877 | ||
878 | <para>The <command>machinectl</command> tool operates on machines | |
b938cb90 | 879 | and images whose names must be chosen following strict |
91913f58 LP |
880 | rules. Machine names must be suitable for use as host names |
881 | following a conservative subset of DNS and UNIX/Linux | |
882 | semantics. Specifically, they must consist of one or more | |
883 | non-empty label strings, separated by dots. No leading or trailing | |
884 | dots are allowed. No sequences of multiple dots are allowed. The | |
a8eaaee7 | 885 | label strings may only consist of alphanumeric characters as well |
91913f58 LP |
886 | as the dash and underscore. The maximum length of a machine name |
887 | is 64 characters.</para> | |
888 | ||
889 | <para>A special machine with the name <literal>.host</literal> | |
890 | refers to the running host system itself. This is useful for execution | |
a8eaaee7 | 891 | operations or inspecting the host system as well. Note that |
91913f58 LP |
892 | <command>machinectl list</command> will not show this special |
893 | machine unless the <option>--all</option> switch is specified.</para> | |
894 | ||
a8eaaee7 | 895 | <para>Requirements on image names are less strict, however, they must be |
91913f58 LP |
896 | valid UTF-8, must be suitable as file names (hence not be the |
897 | single or double dot, and not include a slash), and may not | |
898 | contain control characters. Since many operations search for an | |
b938cb90 | 899 | image by the name of a requested machine, it is recommended to name |
91913f58 LP |
900 | images in the same strict fashion as machines.</para> |
901 | ||
902 | <para>A special image with the name <literal>.host</literal> | |
a8eaaee7 | 903 | refers to the image of the running host system. It hence |
91913f58 LP |
904 | conceptually maps to the special <literal>.host</literal> machine |
905 | name described above. Note that <command>machinectl | |
7ca41557 | 906 | list-images</command> will not show this special image either, unless |
91913f58 LP |
907 | <option>--all</option> is specified.</para> |
908 | </refsect1> | |
909 | ||
798d3a52 ZJS |
910 | <refsect1> |
911 | <title>Files and Directories</title> | |
912 | ||
913 | <para>Machine images are preferably stored in | |
914 | <filename>/var/lib/machines/</filename>, but are also searched for | |
915 | in <filename>/usr/local/lib/machines/</filename> and | |
b938cb90 | 916 | <filename>/usr/lib/machines/</filename>. For compatibility reasons, |
798d3a52 ZJS |
917 | the directory <filename>/var/lib/container/</filename> is |
918 | searched, too. Note that images stored below | |
919 | <filename>/usr</filename> are always considered read-only. It is | |
920 | possible to symlink machines images from other directories into | |
921 | <filename>/var/lib/machines/</filename> to make them available for | |
922 | control with <command>machinectl</command>.</para> | |
923 | ||
17cbb288 | 924 | <para>Note that some image operations are only supported, |
7de30452 LP |
925 | efficient or atomic on btrfs file systems. Due to this, if the |
926 | <command>pull-tar</command>, <command>pull-raw</command>, | |
b43d75c3 LP |
927 | <command>import-tar</command>, <command>import-raw</command> and |
928 | <command>set-limit</command> commands notice that | |
929 | <filename>/var/lib/machines</filename> is empty and not located on | |
930 | btrfs, they will implicitly set up a loopback file | |
931 | <filename>/var/lib/machines.raw</filename> containing a btrfs file | |
932 | system that is mounted to | |
7de30452 | 933 | <filename>/var/lib/machines</filename>. The size of this loopback |
af40e5d3 LP |
934 | file may be controlled dynamically with |
935 | <command>set-limit</command>.</para> | |
7de30452 | 936 | |
798d3a52 ZJS |
937 | <para>Disk images are understood by |
938 | <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
939 | and <command>machinectl</command> in three formats:</para> | |
940 | ||
941 | <itemizedlist> | |
942 | <listitem><para>A simple directory tree, containing the files | |
943 | and directories of the container to boot.</para></listitem> | |
944 | ||
a8eaaee7 | 945 | <listitem><para>Subvolumes (on btrfs file systems), which are |
798d3a52 ZJS |
946 | similar to the simple directories, described above. However, |
947 | they have additional benefits, such as efficient cloning and | |
948 | quota reporting.</para></listitem> | |
949 | ||
950 | <listitem><para>"Raw" disk images, i.e. binary images of disks | |
951 | with a GPT or MBR partition table. Images of this type are | |
952 | regular files with the suffix | |
953 | <literal>.raw</literal>.</para></listitem> | |
954 | </itemizedlist> | |
955 | ||
956 | <para>See | |
957 | <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
a8eaaee7 | 958 | for more information on image formats, in particular its |
798d3a52 ZJS |
959 | <option>--directory=</option> and <option>--image=</option> |
960 | options.</para> | |
961 | </refsect1> | |
962 | ||
963 | <refsect1> | |
964 | <title>Examples</title> | |
965 | <example> | |
966 | <title>Download an Ubuntu image and open a shell in it</title> | |
967 | ||
968 | <programlisting># machinectl pull-tar https://cloud-images.ubuntu.com/trusty/current/trusty-server-cloudimg-amd64-root.tar.gz | |
e0ea94c1 LP |
969 | # systemd-nspawn -M trusty-server-cloudimg-amd64-root</programlisting> |
970 | ||
798d3a52 ZJS |
971 | <para>This downloads and verifies the specified |
972 | <filename>.tar</filename> image, and then uses | |
973 | <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
974 | to open a shell in it.</para> | |
975 | </example> | |
976 | ||
977 | <example> | |
978 | <title>Download a Fedora image, set a root password in it, start | |
979 | it as service</title> | |
980 | ||
1328bd9c | 981 | <programlisting># machinectl pull-raw --verify=no https://dl.fedoraproject.org/pub/fedora/linux/releases/23/Cloud/x86_64/Images/Fedora-Cloud-Base-23-20151030.x86_64.raw.xz |
f479d3ba | 982 | # systemd-nspawn -M Fedora-Cloud-Base-23-20151030 |
ac92ced5 BF |
983 | # passwd |
984 | # exit | |
f479d3ba LP |
985 | # machinectl start Fedora-Cloud-Base-23-20151030 |
986 | # machinectl login Fedora-Cloud-Base-23-20151030</programlisting> | |
798d3a52 ZJS |
987 | |
988 | <para>This downloads the specified <filename>.raw</filename> | |
b938cb90 | 989 | image with verification disabled. Then, a shell is opened in it |
798d3a52 ZJS |
990 | and a root password is set. Afterwards the shell is left, and |
991 | the machine started as system service. With the last command a | |
992 | login prompt into the container is requested.</para> | |
993 | </example> | |
994 | ||
6e9efa59 LP |
995 | <example> |
996 | <title>Exports a container image as tar file</title> | |
997 | ||
998 | <programlisting># machinectl export-tar fedora myfedora.tar.xz</programlisting> | |
999 | ||
a8eaaee7 JE |
1000 | <para>Exports the container <literal>fedora</literal> as an |
1001 | xz-compressed tar file <filename>myfedora.tar.xz</filename> into the | |
6e9efa59 LP |
1002 | current directory.</para> |
1003 | </example> | |
1004 | ||
ef3100e9 LP |
1005 | <example> |
1006 | <title>Create a new shell session</title> | |
1007 | ||
1008 | <programlisting># machinectl shell --uid=lennart</programlisting> | |
1009 | ||
b938cb90 | 1010 | <para>This creates a new shell session on the local host for |
ef3100e9 LP |
1011 | the user ID <literal>lennart</literal>, in a <citerefentry |
1012 | project='die-net'><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry>-like | |
1013 | fashion.</para> | |
1014 | </example> | |
1015 | ||
798d3a52 ZJS |
1016 | </refsect1> |
1017 | ||
1018 | <refsect1> | |
1019 | <title>Exit status</title> | |
1020 | ||
1021 | <para>On success, 0 is returned, a non-zero failure code | |
1022 | otherwise.</para> | |
1023 | </refsect1> | |
1024 | ||
1025 | <xi:include href="less-variables.xml" /> | |
1026 | ||
1027 | <refsect1> | |
1028 | <title>See Also</title> | |
1029 | <para> | |
1030 | <citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>, | |
1031 | <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
6e9efa59 | 1032 | <citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry>, |
16eb4024 ZJS |
1033 | <citerefentry project='die-net'><refentrytitle>tar</refentrytitle><manvolnum>1</manvolnum></citerefentry>, |
1034 | <citerefentry project='die-net'><refentrytitle>xz</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
1035 | <citerefentry project='die-net'><refentrytitle>gzip</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
1036 | <citerefentry project='die-net'><refentrytitle>bzip2</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
798d3a52 ZJS |
1037 | </para> |
1038 | </refsect1> | |
19887cd0 ZJS |
1039 | |
1040 | </refentry> |