[thirdparty/systemd.git] / units / systemd-nspawn@.service.in

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Container %i
Documentation=man:systemd-nspawn(1)
PartOf=machines.target
Before=machines.target
After=network.target

[Service]
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
KillMode=mixed
Type=notify
RestartForceExitStatus=133
SuccessExitStatus=133
Slice=machine.slice
Delegate=yes
TasksMax=16384

## Enforce a strict device policy, similar to the one nspawn configures
## when it allocates its own scope unit. Make sure to keep these
## policies in sync if you change them!
DevicePolicy=closed
DeviceAllow=/dev/net/tun rwm
DeviceAllow=char-pts rw

# nspawn itself needs access to /dev/loop-control and /dev/loop, to
# implement the --image= option. Add these here, too.
DeviceAllow=/dev/loop-control rw
DeviceAllow=block-loop rw
DeviceAllow=block-blkext rw

[Install]
WantedBy=machines.target
Commit	Line	Data
05947bef LP	1	# This file is part of systemd.
	2	#
	3	# systemd is free software; you can redistribute it and/or modify it
	4	# under the terms of the GNU Lesser General Public License as published by
	5	# the Free Software Foundation; either version 2.1 of the License, or
	6	# (at your option) any later version.
	7
	8	[Unit]
7a8c9e44	9	Description=Container %i
05947bef	10	Documentation=man:systemd-nspawn(1)
6a140df0 LP	11	PartOf=machines.target
6a140df0 LP	12	Before=machines.target
d3650f0c	13	After=network.target
05947bef LP	14
05947bef LP	15	[Service]
af88764f	16	ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
d8e40d62	17	KillMode=mixed
05947bef	18	Type=notify
ce38dbc8 LP	19	RestartForceExitStatus=133
ce38dbc8 LP	20	SuccessExitStatus=133
45d383a3	21	Slice=machine.slice
a931ad47	22	Delegate=yes
8d36b53a	23	TasksMax=16384
05947bef	24
9c0f732c ZJS	25	## Enforce a strict device policy, similar to the one nspawn configures
	26	## when it allocates its own scope unit. Make sure to keep these
	27	## policies in sync if you change them!
54cd6556	28	DevicePolicy=closed
773ce3d8	29	DeviceAllow=/dev/net/tun rwm
773ce3d8 LP	30	DeviceAllow=char-pts rw
773ce3d8 LP	31
988a4796 LP	32	# nspawn itself needs access to /dev/loop-control and /dev/loop, to
	33	# implement the --image= option. Add these here, too.
	34	DeviceAllow=/dev/loop-control rw
	35	DeviceAllow=block-loop rw
a2c90f05	36	DeviceAllow=block-blkext rw
988a4796	37
05947bef	38	[Install]
6a140df0	39	WantedBy=machines.target