man/systemd.nspawn.xml

   1 <?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   4 <!ENTITY % entities SYSTEM "custom-entities.ent" >
   5 %entities;
   6 ]>
   7
   8 <!--
   9   SPDX-License-Identifier: LGPL-2.1+
  10
  11   Copyright 2015 Lennart Poettering
  12 -->
  13
  14 <refentry id="systemd.nspawn">
  15
  16   <refentryinfo>
  17     <title>systemd.nspawn</title>
  18     <productname>systemd</productname>
  19
  20     <authorgroup>
  21       <author>
  22         <contrib>Developer</contrib>
  23         <firstname>Lennart</firstname>
  24         <surname>Poettering</surname>
  25         <email>lennart@poettering.net</email>
  26       </author>
  27     </authorgroup>
  28   </refentryinfo>
  29
  30   <refmeta>
  31     <refentrytitle>systemd.nspawn</refentrytitle>
  32     <manvolnum>5</manvolnum>
  33   </refmeta>
  34
  35   <refnamediv>
  36     <refname>systemd.nspawn</refname>
  37     <refpurpose>Container settings</refpurpose>
  38   </refnamediv>
  39
  40   <refsynopsisdiv>
  41     <para><filename>/etc/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  42     <para><filename>/run/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  43     <para><filename>/var/lib/machines/<replaceable>machine</replaceable>.nspawn</filename></para>
  44   </refsynopsisdiv>
  45
  46   <refsect1>
  47     <title>Description</title>
  48
  49     <para>An nspawn container settings file (suffix
  50     <filename>.nspawn</filename>) encodes additional runtime
  51     information about a local container, and is searched, read and
  52     used by
  53     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  54     when starting a container. Files of this type are named after the
  55     containers they define settings for. They are optional, and only
  56     required for containers whose execution environment shall differ
  57     from the defaults. Files of this type mostly contain settings that
  58     may also be set on the <command>systemd-nspawn</command> command
  59     line, and make it easier to persistently attach specific settings
  60     to specific containers. The syntax of these files is inspired by
  61     <filename>.desktop</filename> files following the <ulink
  62     url="http://standards.freedesktop.org/desktop-entry-spec/latest/">XDG
  63     Desktop Entry Specification</ulink>, which in turn are inspired by
  64     Microsoft Windows <filename>.ini</filename> files.</para>
  65
  66     <para>Boolean arguments used in these settings files can be
  67     written in various formats. For positive settings, the strings
  68     <option>1</option>, <option>yes</option>, <option>true</option>
  69     and <option>on</option> are equivalent. For negative settings, the
  70     strings <option>0</option>, <option>no</option>,
  71     <option>false</option> and <option>off</option> are
  72     equivalent.</para>
  73
  74     <para>Empty lines and lines starting with # or ; are
  75     ignored. This may be used for commenting. Lines ending
  76     in a backslash are concatenated with the following
  77     line while reading and the backslash is replaced by a
  78     space character. This may be used to wrap long lines.</para>
  79
  80   </refsect1>
  81
  82   <refsect1>
  83     <title><filename>.nspawn</filename> File Discovery</title>
  84
  85     <para>Files are searched by appending the
  86     <filename>.nspawn</filename> suffix to the machine name of the
  87     container, as specified with the <option>--machine=</option>
  88     switch of <command>systemd-nspawn</command>, or derived from the
  89     directory or image file name. This file is first searched in
  90     <filename>/etc/systemd/nspawn/</filename> and
  91     <filename>/run/systemd/nspawn/</filename>. If found in these
  92     directories, its settings are read and all of them take full effect
  93     (but are possibly overridden by corresponding command line
  94     arguments). If not found, the file will then be searched next to
  95     the image file or in the immediate parent of the root directory of
  96     the container. If the file is found there, only a subset of the
  97     settings will take effect however. All settings that possibly
  98     elevate privileges or grant additional access to resources of the
  99     host (such as files or directories) are ignored. To which options
 100     this applies is documented below.</para>
 101
 102     <para>Persistent settings files created and maintained by the
 103     administrator (and thus trusted) should be placed in
 104     <filename>/etc/systemd/nspawn/</filename>, while automatically
 105     downloaded (and thus potentially untrusted) settings files are
 106     placed in <filename>/var/lib/machines/</filename> instead (next to
 107     the container images), where their security impact is limited. In
 108     order to add privileged settings to <filename>.nspawn</filename>
 109     files acquired from the image vendor, it is recommended to copy the
 110     settings files into <filename>/etc/systemd/nspawn/</filename> and
 111     edit them there, so that the privileged options become
 112     available. The precise algorithm for how the files are searched and
 113     interpreted may be configured with
 114     <command>systemd-nspawn</command>'s <option>--settings=</option>
 115     switch, see
 116     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 117     for details.</para>
 118   </refsect1>
 119
 120   <refsect1>
 121     <title>[Exec] Section Options</title>
 122
 123     <para>Settings files may include an <literal>[Exec]</literal>
 124     section, which carries various execution parameters:</para>
 125
 126     <variablelist>
 127
 128       <varlistentry>
 129         <term><varname>Boot=</varname></term>
 130
 131         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, <command>systemd-nspawn</command>
 132         will automatically search for an <filename>init</filename> executable and invoke it. In this case, the
 133         specified parameters using <varname>Parameters=</varname> are passed as additional arguments to the
 134         <filename>init</filename> process. This setting corresponds to the <option>--boot</option> switch on the
 135         <command>systemd-nspawn</command> command line. This option may not be combined with
 136         <varname>ProcessTwo=yes</varname>. This option is the default if the
 137         <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
 138       </varlistentry>
 139
 140       <varlistentry>
 141         <term><varname>ProcessTwo=</varname></term>
 142
 143         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, the specified program is run as
 144         PID 2. A stub init process is run as PID 1. This setting corresponds to the <option>--as-pid2</option> switch
 145         on the <command>systemd-nspawn</command> command line. This option may not be combined with
 146         <varname>Boot=yes</varname>.</para></listitem>
 147       </varlistentry>
 148
 149       <varlistentry>
 150         <term><varname>Parameters=</varname></term>
 151
 152         <listitem><para>Takes a space-separated list of
 153         arguments. This is either a command line, beginning with the
 154         binary name to execute, or – if <varname>Boot=</varname> is
 155         enabled – the list of arguments to pass to the init
 156         process. This setting corresponds to the command line
 157         parameters passed on the <command>systemd-nspawn</command>
 158         command line.</para></listitem>
 159       </varlistentry>
 160
 161       <varlistentry>
 162         <term><varname>Environment=</varname></term>
 163
 164         <listitem><para>Takes an environment variable assignment
 165         consisting of key and value, separated by
 166         <literal>=</literal>. Sets an environment variable for the
 167         main process invoked in the container. This setting may be
 168         used multiple times to set multiple environment variables. It
 169         corresponds to the <option>--setenv=</option> command line
 170         switch.</para></listitem>
 171       </varlistentry>
 172
 173       <varlistentry>
 174         <term><varname>User=</varname></term>
 175
 176         <listitem><para>Takes a UNIX user name. Specifies the user
 177         name to invoke the main process of the container as. This user
 178         must be known in the container's user database. This
 179         corresponds to the <option>--user=</option> command line
 180         switch.</para></listitem>
 181       </varlistentry>
 182
 183       <varlistentry>
 184         <term><varname>WorkingDirectory=</varname></term>
 185
 186         <listitem><para>Selects the working directory for the process invoked in the container. Expects an absolute
 187         path in the container's file system namespace. This corresponds to the <option>--chdir=</option> command line
 188         switch.</para></listitem>
 189       </varlistentry>
 190
 191       <varlistentry>
 192         <term><varname>PivotRoot=</varname></term>
 193
 194         <listitem><para>Selects a directory to pivot to <filename>/</filename> inside the container when starting up.
 195         Takes a single path, or a pair of two paths separated by a colon. Both paths must be absolute, and are resolved
 196         in the container's file system namespace. This corresponds to the <option>--pivot-root=</option> command line
 197         switch.</para></listitem>
 198       </varlistentry>
 199
 200       <varlistentry>
 201         <term><varname>Capability=</varname></term>
 202         <term><varname>DropCapability=</varname></term>
 203
 204         <listitem><para>Takes a space-separated list of Linux process
 205         capabilities (see
 206         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 207         for details). The <varname>Capability=</varname> setting
 208         specifies additional capabilities to pass on top of the
 209         default set of capabilities. The
 210         <varname>DropCapability=</varname> setting specifies
 211         capabilities to drop from the default set. These settings
 212         correspond to the <option>--capability=</option> and
 213         <option>--drop-capability=</option> command line
 214         switches. Note that <varname>Capability=</varname> is a
 215         privileged setting, and only takes effect in
 216         <filename>.nspawn</filename> files in
 217         <filename>/etc/systemd/nspawn/</filename> and
 218         <filename>/run/system/nspawn/</filename> (see above). On the
 219         other hand, <varname>DropCapability=</varname> takes effect in
 220         all cases.</para></listitem>
 221       </varlistentry>
 222
 223       <varlistentry>
 224         <term><varname>NoNewPrivileges=</varname></term>
 225
 226         <listitem><para>Takes a boolean argument that controls the <constant>PR_SET_NO_NEW_PRIVS</constant> flag for
 227         the container payload. This is equivalent to the
 228         <option>--no-new-privileges=</option> command line switch. See
 229         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 230         details.</para>
 231         </listitem>
 232       </varlistentry>
 233
 234       <varlistentry>
 235         <term><varname>KillSignal=</varname></term>
 236
 237         <listitem><para>Specify the process signal to send to the
 238         container's PID 1 when nspawn itself receives SIGTERM, in
 239         order to trigger an orderly shutdown of the container.
 240         Defaults to SIGRTMIN+3 if <option>Boot=</option> is used
 241         (on systemd-compatible init systems SIGRTMIN+3 triggers an
 242         orderly shutdown). For a list of valid signals, see
 243         <citerefentry project='man-pages'><refentrytitle>signal</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para></listitem>
 244       </varlistentry>
 245
 246       <varlistentry>
 247         <term><varname>Personality=</varname></term>
 248
 249         <listitem><para>Configures the kernel personality for the
 250         container. This is equivalent to the
 251         <option>--personality=</option> switch.</para></listitem>
 252       </varlistentry>
 253
 254       <varlistentry>
 255         <term><varname>MachineID=</varname></term>
 256
 257         <listitem><para>Configures the 128-bit machine ID (UUID) to pass to
 258         the container. This is equivalent to the
 259         <option>--uuid=</option> command line switch. This option is
 260         privileged (see above). </para></listitem>
 261       </varlistentry>
 262
 263       <varlistentry>
 264         <term><varname>PrivateUsers=</varname></term>
 265
 266         <listitem><para>Configures support for usernamespacing. This is equivalent to the
 267         <option>--private-users=</option> command line switch, and takes the same options. This option is privileged
 268         (see above). This option is the default if the <filename>systemd-nspawn@.service</filename> template unit file
 269         is used.</para></listitem>
 270       </varlistentry>
 271
 272       <varlistentry>
 273         <term><varname>NotifyReady=</varname></term>
 274
 275         <listitem><para>Configures support for notifications from the container's init process.  This is equivalent to
 276         the <option>--notify-ready=</option> command line switch, and takes the same parameters. See
 277         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 278         about the specific options supported.</para></listitem>
 279       </varlistentry>
 280
 281       <varlistentry>
 282         <term><varname>SystemCallFilter=</varname></term>
 283
 284         <listitem><para>Configures the system call filter applied to containers. This is equivalent to the
 285         <option>--system-call-filter=</option> command line switch, and takes the same list parameter. See
 286         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 287         details.</para></listitem>
 288       </varlistentry>
 289
 290       <varlistentry>
 291         <term><varname>LimitCPU=</varname></term>
 292         <term><varname>LimitFSIZE=</varname></term>
 293         <term><varname>LimitDATA=</varname></term>
 294         <term><varname>LimitSTACK=</varname></term>
 295         <term><varname>LimitCORE=</varname></term>
 296         <term><varname>LimitRSS=</varname></term>
 297         <term><varname>LimitNOFILE=</varname></term>
 298         <term><varname>LimitAS=</varname></term>
 299         <term><varname>LimitNPROC=</varname></term>
 300         <term><varname>LimitMEMLOCK=</varname></term>
 301         <term><varname>LimitLOCKS=</varname></term>
 302         <term><varname>LimitSIGPENDING=</varname></term>
 303         <term><varname>LimitMSGQUEUE=</varname></term>
 304         <term><varname>LimitNICE=</varname></term>
 305         <term><varname>LimitRTPRIO=</varname></term>
 306         <term><varname>LimitRTTIME=</varname></term>
 307
 308         <listitem><para>Configures various types of resource limits applied to containers. This is equivalent to the
 309         <option>--rlimit=</option> command line switch, and takes the same arguments. See
 310         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 311         details.</para></listitem>
 312       </varlistentry>
 313
 314       <varlistentry>
 315         <term><varname>OOMScoreAdjust=</varname></term>
 316
 317         <listitem><para>Configures the OOM score adjustment value. This is equivalent to the
 318         <option>--oom-score-adjust=</option> command line switch, and takes the same argument. See
 319         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 320         details.</para></listitem>
 321       </varlistentry>
 322
 323       <varlistentry>
 324         <term><varname>CPUAffinity=</varname></term>
 325
 326         <listitem><para>Configures the CPU affinity. This is equivalent to the <option>--cpu-affinity=</option> command
 327         line switch, and takes the same argument. See
 328         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 329         details.</para></listitem>
 330       </varlistentry>
 331
 332       <varlistentry>
 333         <term><varname>Hostname=</varname></term>
 334
 335         <listitem><para>Configures the kernel hostname set for the container. This is equivalent to the
 336         <option>--hostname=</option> command line switch, and takes the same argument. See
 337         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 338         details.</para></listitem>
 339       </varlistentry>
 340
 341       <varlistentry>
 342         <term><varname>ResolvConf=</varname></term>
 343
 344         <listitem><para>Configures how <filename>/etc/resolv.conf</filename> in the container shall be handled. This is
 345         equivalent to the <option>--resolv-conf=</option> command line switch, and takes the same argument. See
 346         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 347         details.</para></listitem>
 348       </varlistentry>
 349
 350       <varlistentry>
 351         <term><varname>Timezone=</varname></term>
 352
 353         <listitem><para>Configures how <filename>/etc/localtime</filename> in the container shall be handled. This is
 354         equivalent to the <option>--localtime=</option> command line switch, and takes the same argument. See
 355         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 356         details.</para></listitem>
 357       </varlistentry>
 358
 359       <varlistentry>
 360         <term><varname>LinkJournal=</varname></term>
 361
 362         <listitem><para>Configures how to link host and container journal setups. This is equivalent to the
 363         <option>--link-journal=</option> command line switch, and takes the same parameter. See
 364         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 365         details.</para></listitem>
 366       </varlistentry>
 367
 368     </variablelist>
 369   </refsect1>
 370
 371   <refsect1>
 372     <title>[Files] Section Options</title>
 373
 374     <para>Settings files may include a <literal>[Files]</literal>
 375     section, which carries various parameters configuring the file
 376     system of the container:</para>
 377
 378     <variablelist>
 379
 380       <varlistentry>
 381         <term><varname>ReadOnly=</varname></term>
 382
 383         <listitem><para>Takes a boolean argument, which defaults to off. If
 384         specified, the container will be run with a read-only file
 385         system. This setting corresponds to the
 386         <option>--read-only</option> command line
 387         switch.</para></listitem>
 388       </varlistentry>
 389
 390       <varlistentry>
 391         <term><varname>Volatile=</varname></term>
 392
 393         <listitem><para>Takes a boolean argument, or the special value
 394         <literal>state</literal>. This configures whether to run the
 395         container with volatile state and/or configuration. This
 396         option is equivalent to <option>--volatile=</option>, see
 397         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 398         for details about the specific options
 399         supported.</para></listitem>
 400       </varlistentry>
 401
 402       <varlistentry>
 403         <term><varname>Bind=</varname></term>
 404         <term><varname>BindReadOnly=</varname></term>
 405
 406         <listitem><para>Adds a bind mount from the host into the
 407         container. Takes a single path, a pair of two paths separated
 408         by a colon, or a triplet of two paths plus an option string
 409         separated by colons. This option may be used multiple times to
 410         configure multiple bind mounts. This option is equivalent to
 411         the command line switches <option>--bind=</option> and
 412         <option>--bind-ro=</option>, see
 413         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 414         for details about the specific options supported. This setting
 415         is privileged (see above).</para></listitem>
 416       </varlistentry>
 417
 418       <varlistentry>
 419         <term><varname>TemporaryFileSystem=</varname></term>
 420
 421         <listitem><para>Adds a <literal>tmpfs</literal> mount to the
 422         container. Takes a path or a pair of path and option string,
 423         separated by a colon. This option may be used multiple times to
 424         configure multiple <literal>tmpfs</literal> mounts. This
 425         option is equivalent to the command line switch
 426         <option>--tmpfs=</option>, see
 427         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 428         for details about the specific options supported. This setting
 429         is privileged (see above).</para></listitem>
 430       </varlistentry>
 431
 432       <varlistentry>
 433         <term><varname>Overlay=</varname></term>
 434         <term><varname>OverlayReadOnly=</varname></term>
 435
 436         <listitem><para>Adds an overlay mount point. Takes a colon-separated list of paths.  This option may be used
 437         multiple times to configure multiple overlay mounts. This option is equivalent to the command line switches
 438         <option>--overlay=</option> and <option>--overlay-ro=</option>, see
 439         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 440         about the specific options supported. This setting is privileged (see above).</para></listitem>
 441       </varlistentry>
 442
 443       <varlistentry>
 444         <term><varname>PrivateUsersChown=</varname></term>
 445
 446         <listitem><para>Configures whether the ownership of the files and directories in the container tree shall be
 447         adjusted to the UID/GID range used, if necessary and user namespacing is enabled. This is equivalent to the
 448         <option>--private-users-chown</option> command line switch. This option is privileged (see
 449         above). </para></listitem>
 450       </varlistentry>
 451
 452     </variablelist>
 453   </refsect1>
 454
 455   <refsect1>
 456     <title>[Network] Section Options</title>
 457
 458     <para>Settings files may include a <literal>[Network]</literal>
 459     section, which carries various parameters configuring the network
 460     connectivity of the container:</para>
 461
 462     <variablelist>
 463
 464       <varlistentry>
 465         <term><varname>Private=</varname></term>
 466
 467         <listitem><para>Takes a boolean argument, which defaults to off. If
 468         enabled, the container will run in its own network namespace
 469         and not share network interfaces and configuration with the
 470         host. This setting corresponds to the
 471         <option>--private-network</option> command line
 472         switch.</para></listitem>
 473       </varlistentry>
 474
 475       <varlistentry>
 476         <term><varname>VirtualEthernet=</varname></term>
 477
 478         <listitem><para>Takes a boolean argument. Configures whether to create a virtual Ethernet connection
 479         (<literal>veth</literal>) between host and the container. This setting implies
 480         <varname>Private=yes</varname>. This setting corresponds to the <option>--network-veth</option> command line
 481         switch. This option is privileged (see above). This option is the default if the
 482         <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
 483       </varlistentry>
 484
 485       <varlistentry>
 486         <term><varname>VirtualEthernetExtra=</varname></term>
 487
 488         <listitem><para>Takes a colon-separated pair of interface
 489         names. Configures an additional virtual Ethernet connection
 490         (<literal>veth</literal>) between host and the container. The
 491         first specified name is the interface name on the host, the
 492         second the interface name in the container. The latter may be
 493         omitted in which case it is set to the same name as the host
 494         side interface. This setting implies
 495         <varname>Private=yes</varname>. This setting corresponds to
 496         the <option>--network-veth-extra=</option> command line
 497         switch, and maybe be used multiple times. It is independent of
 498         <varname>VirtualEthernet=</varname>. This option is privileged
 499         (see above).</para></listitem>
 500       </varlistentry>
 501
 502       <varlistentry>
 503         <term><varname>Interface=</varname></term>
 504
 505         <listitem><para>Takes a space-separated list of interfaces to
 506         add to the container. This option corresponds to the
 507         <option>--network-interface=</option> command line switch and
 508         implies <varname>Private=yes</varname>. This option is
 509         privileged (see above).</para></listitem>
 510       </varlistentry>
 511
 512       <varlistentry>
 513         <term><varname>MACVLAN=</varname></term>
 514         <term><varname>IPVLAN=</varname></term>
 515
 516         <listitem><para>Takes a space-separated list of interfaces to
 517         add MACLVAN or IPVLAN interfaces to, which are then added to
 518         the container. These options correspond to the
 519         <option>--network-macvlan=</option> and
 520         <option>--network-ipvlan=</option> command line switches and
 521         imply <varname>Private=yes</varname>. These options are
 522         privileged (see above).</para></listitem>
 523       </varlistentry>
 524
 525       <varlistentry>
 526         <term><varname>Bridge=</varname></term>
 527
 528         <listitem><para>Takes an interface name. This setting implies
 529         <varname>VirtualEthernet=yes</varname> and
 530         <varname>Private=yes</varname> and has the effect that the
 531         host side of the created virtual Ethernet link is connected to
 532         the specified bridge interface. This option corresponds to the
 533         <option>--network-bridge=</option> command line switch. This
 534         option is privileged (see above).</para></listitem>
 535       </varlistentry>
 536
 537       <varlistentry>
 538         <term><varname>Zone=</varname></term>
 539
 540         <listitem><para>Takes a network zone name. This setting implies <varname>VirtualEthernet=yes</varname> and
 541         <varname>Private=yes</varname> and has the effect that the host side of the created virtual Ethernet link is
 542         connected to an automatically managed bridge interface named after the passed argument, prefixed with
 543         <literal>vz-</literal>. This option corresponds to the <option>--network-zone=</option> command line
 544         switch. This option is privileged (see above).</para></listitem>
 545       </varlistentry>
 546
 547       <varlistentry>
 548         <term><varname>Port=</varname></term>
 549
 550         <listitem><para>Exposes a TCP or UDP port of the container on
 551         the host. This option corresponds to the
 552         <option>--port=</option> command line switch, see
 553         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 554         for the precise syntax of the argument this option takes. This
 555         option is privileged (see above).</para></listitem>
 556       </varlistentry>
 557     </variablelist>
 558   </refsect1>
 559
 560   <refsect1>
 561     <title>See Also</title>
 562     <para>
 563       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 564       <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 565       <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 566     </para>
 567   </refsect1>
 568
 569 </refentry>