1 # SPDX-License-Identifier: LGPL-2.1+
3 # This file is part of systemd.
5 # systemd is free software; you can redistribute it and/or modify it
6 # under the terms of the GNU Lesser General Public License as published by
7 # the Free Software Foundation; either version 2.1 of the License, or
8 # (at your option) any later version.
11 Description=Container %i
12 Documentation=man:systemd-nspawn(1)
13 PartOf=machines.target
14 Before=machines.target
15 After=network.target systemd-resolved.service
16 RequiresMountsFor=/var/lib/machines
19 ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
22 RestartForceExitStatus=133
29 # Enforce a strict device policy, similar to the one nspawn configures when it
30 # allocates its own scope unit. Make sure to keep these policies in sync if you
33 DeviceAllow=/dev/net/tun rwm
34 DeviceAllow=char-pts rw
36 # nspawn itself needs access to /dev/loop-control and /dev/loop, to implement
37 # the --image= option. Add these here, too.
38 DeviceAllow=/dev/loop-control rw
39 DeviceAllow=block-loop rw
40 DeviceAllow=block-blkext rw
42 # nspawn can set up LUKS encrypted loopback files, in which case it needs
43 # access to /dev/mapper/control and the block devices /dev/mapper/*.
44 DeviceAllow=/dev/mapper/control rw
45 DeviceAllow=block-device-mapper rw
48 WantedBy=machines.target