]> git.ipfire.org Git - thirdparty/systemd.git/blame - units/systemd-nspawn@.service.in
Merge pull request #10495 from poettering/login-boot-hookup
[thirdparty/systemd.git] / units / systemd-nspawn@.service.in
CommitLineData
a7df2d1e
ZJS
1# SPDX-License-Identifier: LGPL-2.1+
2#
05947bef
LP
3# This file is part of systemd.
4#
5# systemd is free software; you can redistribute it and/or modify it
6# under the terms of the GNU Lesser General Public License as published by
7# the Free Software Foundation; either version 2.1 of the License, or
8# (at your option) any later version.
9
10[Unit]
7a8c9e44 11Description=Container %i
05947bef 12Documentation=man:systemd-nspawn(1)
6a140df0
LP
13PartOf=machines.target
14Before=machines.target
dec71806 15After=network.target systemd-resolved.service
be5bd2ec 16RequiresMountsFor=/var/lib/machines
05947bef
LP
17
18[Service]
af88764f 19ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
d8e40d62 20KillMode=mixed
05947bef 21Type=notify
ce38dbc8
LP
22RestartForceExitStatus=133
23SuccessExitStatus=133
8fd010bb 24WatchdogSec=3min
45d383a3 25Slice=machine.slice
a931ad47 26Delegate=yes
8d36b53a 27TasksMax=16384
05947bef 28
3982becc
LP
29# Enforce a strict device policy, similar to the one nspawn configures when it
30# allocates its own scope unit. Make sure to keep these policies in sync if you
31# change them!
54cd6556 32DevicePolicy=closed
773ce3d8 33DeviceAllow=/dev/net/tun rwm
773ce3d8
LP
34DeviceAllow=char-pts rw
35
3982becc
LP
36# nspawn itself needs access to /dev/loop-control and /dev/loop, to implement
37# the --image= option. Add these here, too.
988a4796
LP
38DeviceAllow=/dev/loop-control rw
39DeviceAllow=block-loop rw
a2c90f05 40DeviceAllow=block-blkext rw
988a4796 41
3982becc
LP
42# nspawn can set up LUKS encrypted loopback files, in which case it needs
43# access to /dev/mapper/control and the block devices /dev/mapper/*.
44DeviceAllow=/dev/mapper/control rw
45DeviceAllow=block-device-mapper rw
46
05947bef 47[Install]
6a140df0 48WantedBy=machines.target