units/systemd-nspawn@.service.in

   1 #  This file is part of systemd.
   2 #
   3 #  systemd is free software; you can redistribute it and/or modify it
   4 #  under the terms of the GNU Lesser General Public License as published by
   5 #  the Free Software Foundation; either version 2.1 of the License, or
   6 #  (at your option) any later version.
   7
   8 [Unit]
   9 Description=Container %i
  10 Documentation=man:systemd-nspawn(1)
  11 PartOf=machines.target
  12 Before=machines.target
  13 After=network.target systemd-resolved.service
  14 RequiresMountsFor=/var/lib/machines
  15
  16 [Service]
  17 ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
  18 KillMode=mixed
  19 Type=notify
  20 RestartForceExitStatus=133
  21 SuccessExitStatus=133
  22 Slice=machine.slice
  23 Delegate=yes
  24 TasksMax=16384
  25
  26 # Enforce a strict device policy, similar to the one nspawn configures when it
  27 # allocates its own scope unit. Make sure to keep these policies in sync if you
  28 # change them!
  29 DevicePolicy=closed
  30 DeviceAllow=/dev/net/tun rwm
  31 DeviceAllow=char-pts rw
  32
  33 # nspawn itself needs access to /dev/loop-control and /dev/loop, to implement
  34 # the --image= option. Add these here, too.
  35 DeviceAllow=/dev/loop-control rw
  36 DeviceAllow=block-loop rw
  37 DeviceAllow=block-blkext rw
  38
  39 # nspawn can set up LUKS encrypted loopback files, in which case it needs
  40 # access to /dev/mapper/control and the block devices /dev/mapper/*.
  41 DeviceAllow=/dev/mapper/control rw
  42 DeviceAllow=block-device-mapper rw
  43
  44 [Install]
  45 WantedBy=machines.target