1 # This file is part of systemd.
3 # systemd is free software; you can redistribute it and/or modify it
4 # under the terms of the GNU Lesser General Public License as published by
5 # the Free Software Foundation; either version 2.1 of the License, or
6 # (at your option) any later version.
9 Description=Container %i
10 Documentation=man:systemd-nspawn(1)
11 PartOf=machines.target
12 Before=machines.target
13 After=network.target systemd-resolved.service
14 RequiresMountsFor=/var/lib/machines
17 ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
20 RestartForceExitStatus=133
26 ## Enforce a strict device policy, similar to the one nspawn configures
27 ## when it allocates its own scope unit. Make sure to keep these
28 ## policies in sync if you change them!
30 DeviceAllow=/dev/net/tun rwm
31 DeviceAllow=char-pts rw
33 # nspawn itself needs access to /dev/loop-control and /dev/loop, to
34 # implement the --image= option. Add these here, too.
35 DeviceAllow=/dev/loop-control rw
36 DeviceAllow=block-loop rw
37 DeviceAllow=block-blkext rw
40 WantedBy=machines.target