[thirdparty/systemd.git] / man / systemd-nspawn.xml

<?xml version='1.0'?> <!--*-nxml-*-->
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
        "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">

<!--
  This file is part of systemd.

  Copyright 2010 Lennart Poettering

  systemd is free software; you can redistribute it and/or modify it
  under the terms of the GNU Lesser General Public License as published by
  the Free Software Foundation; either version 2.1 of the License, or
  (at your option) any later version.

  systemd is distributed in the hope that it will be useful, but
  WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  Lesser General Public License for more details.

  You should have received a copy of the GNU Lesser General Public License
  along with systemd; If not, see <http://www.gnu.org/licenses/>.
-->

<refentry id="systemd-nspawn">

        <refentryinfo>
                <title>systemd-nspawn</title>
                <productname>systemd</productname>

                <authorgroup>
                        <author>
                                <contrib>Developer</contrib>
                                <firstname>Lennart</firstname>
                                <surname>Poettering</surname>
                                <email>lennart@poettering.net</email>
                        </author>
                </authorgroup>
        </refentryinfo>

        <refmeta>
                <refentrytitle>systemd-nspawn</refentrytitle>
                <manvolnum>1</manvolnum>
        </refmeta>

        <refnamediv>
                <refname>systemd-nspawn</refname>
                <refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
        </refnamediv>

        <refsynopsisdiv>
                <cmdsynopsis>
                        <command>systemd-nspawn</command>
                        <arg choice="opt" rep="repeat">OPTIONS</arg>
                        <arg choice="opt"><replaceable>COMMAND</replaceable>
                        <arg choice="opt" rep="repeat">ARGS</arg>
                        </arg>
                </cmdsynopsis>
                <cmdsynopsis>
                        <command>systemd-nspawn</command>
                        <arg choice="plain">-b</arg>
                        <arg choice="opt" rep="repeat">OPTIONS</arg>
                        <arg choice="opt" rep="repeat">ARGS</arg>
                </cmdsynopsis>
        </refsynopsisdiv>

        <refsect1>
                <title>Description</title>

                <para><command>systemd-nspawn</command> may be used to
                run a command or OS in a light-weight namespace
                container. In many ways it is similar to
                <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                but more powerful since it fully virtualizes the file
                system hierarchy, as well as the process tree, the
                various IPC subsystems and the host and domain
                name.</para>

                <para><command>systemd-nspawn</command> limits access
                to various kernel interfaces in the container to
                read-only, such as <filename>/sys</filename>,
                <filename>/proc/sys</filename> or
                <filename>/sys/fs/selinux</filename>. Network
                interfaces and the system clock may not be changed
                from within the container. Device nodes may not be
                created. The host system cannot be rebooted and kernel
                modules may not be loaded from within the
                container.</para>

                <para>Note that even though these security precautions
                are taken <command>systemd-nspawn</command> is not
                suitable for secure container setups. Many of the
                security features may be circumvented and are hence
                primarily useful to avoid accidental changes to the
                host system from the container. The intended use of
                this program is debugging and testing as well as
                building of packages, distributions and software
                involved with boot and systems management.</para>

                <para>In contrast to
                <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
                <command>systemd-nspawn</command> may be used to boot
                full Linux-based operating systems in a
                container.</para>

                <para>Use a tool like
                <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                or
                <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                to set up an OS directory tree suitable as file system
                hierarchy for <command>systemd-nspawn</command>
                containers.</para>

                <para>Note that <command>systemd-nspawn</command> will
                mount file systems private to the container to
                <filename>/dev</filename>,
                <filename>/run</filename> and similar. These will
                not be visible outside of the container, and their
                contents will be lost when the container exits.</para>

                <para>Note that running two
                <command>systemd-nspawn</command> containers from the
                same directory tree will not make processes in them
                see each other. The PID namespace separation of the
                two containers is complete and the containers will
                share very few runtime objects except for the
                underlying file system. It is however possible to
                enter an existing container, see
                <link linkend='example-nsenter'>Example 4</link> below.
                </para>

                <para><command>systemd-nspawn</command> implements the
                <ulink
                url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
                Interface</ulink> specification.</para>

                <para>As a safety check
                <command>systemd-nspawn</command> will verify the
                existence of <filename>/etc/os-release</filename> in
                the container tree before starting the container (see
                <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>). It
                might be necessary to add this file to the container
                tree manually if the OS of the container is too old to
                contain this file out-of-the-box.</para>
        </refsect1>

        <refsect1>
                <title>Incompatibility with Auditing</title>

                <para>Note that the kernel auditing subsystem is
                currently broken when used together with
                containers. We hence recommend turning it off entirely
                by booting with <literal>audit=0</literal> on the
                kernel command line, or by turning it off at kernel
                build time. If auditing is enabled in the kernel
                operating systems booted in an nspawn container might
                refuse log-in attempts.</para>
        </refsect1>

        <refsect1>
                <title>Options</title>

                <para>If option <option>-b</option> is specified, the
                arguments are used as arguments for the init
                binary. Otherwise, <replaceable>COMMAND</replaceable>
                specifies the program to launch in the container, and
                the remaining arguments are used as arguments for this
                program. If <option>-b</option> is not used and no
                arguments are specifed, a shell is launched in the
                container.</para>

                <para>The following options are understood:</para>

                <variablelist>
                        <varlistentry>
                                <term><option>-h</option></term>
                                <term><option>--help</option></term>

                                <listitem><para>Prints a short help
                                text and exits.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--version</option></term>

                                <listitem><para>Prints a version string
                                and exits.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-D</option></term>
                                <term><option>--directory=</option></term>

                                <listitem><para>Directory to use as
                                file system root for the namespace
                                container. If omitted the current
                                directory will be
                                used.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-b</option></term>
                                <term><option>--boot</option></term>

                                <listitem><para>Automatically search
                                for an init binary and invoke it
                                instead of a shell or a user supplied
                                program. If this option is used, arguments
                                specified on the command line are used
                                as arguments for the init binary.
                                </para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-u</option></term>
                                <term><option>--user=</option></term>

                                <listitem><para>Run the command
                                under specified user, create home
                                directory and cd into it. As rest
                                of systemd-nspawn, this is not
                                the security feature and limits
                                against accidental changes only.
                                </para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-M</option></term>
                                <term><option>--machine=</option></term>

                                <listitem><para>Sets the machine name
                                for this container. This name may be
                                used to identify this container on the
                                host, and is used to initialize the
                                container's hostname (which the
                                container can choose to override,
                                however). If not specified the last
                                component of the root directory of the
                                container is used.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--slice=</option></term>

                                <listitem><para>Make the container
                                part of the specified slice, instead
                                of the
                                <filename>machine.slice</filename>.</para>
                                </listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--uuid=</option></term>

                                <listitem><para>Set the specified UUID
                                for the container. The init system
                                will initialize
                                <filename>/etc/machine-id</filename>
                                from this if this file is not set yet.
                                </para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--private-network</option></term>

                                <listitem><para>Turn off networking in
                                the container. This makes all network
                                interfaces unavailable in the
                                container, with the exception of the
                                loopback device.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--read-only</option></term>

                                <listitem><para>Mount the root file
                                system read-only for the
                                container.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--capability=</option></term>

                                <listitem><para>List one or more
                                additional capabilities to grant the
                                container. Takes a comma-separated
                                list of capability names, see
                                <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
                                for more information. Note that the
                                following capabilities will be granted
                                in any way: CAP_CHOWN,
                                CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
                                CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
                                CAP_KILL, CAP_LEASE,
                                CAP_LINUX_IMMUTABLE,
                                CAP_NET_BIND_SERVICE,
                                CAP_NET_BROADCAST, CAP_NET_RAW,
                                CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
                                CAP_SETUID, CAP_SYS_ADMIN,
                                CAP_SYS_CHROOT, CAP_SYS_NICE,
                                CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
                                CAP_SYS_RESOURCE, CAP_SYS_BOOT,
                                CAP_AUDIT_WRITE,
                                CAP_AUDIT_CONTROL.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--link-journal=</option></term>

                                <listitem><para>Control whether the
                                container's journal shall be made
                                visible to the host system. If enabled
                                allows viewing the container's journal
                                files from the host (but not vice
                                versa). Takes one of
                                <literal>no</literal>,
                                <literal>host</literal>,
                                <literal>guest</literal>,
                                <literal>auto</literal>. If
                                <literal>no</literal>, the journal is
                                not linked. If <literal>host</literal>,
                                the journal files are stored on the
                                host file system (beneath
                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
                                and the subdirectory is bind-mounted
                                into the container at the same
                                location. If <literal>guest</literal>,
                                the journal files are stored on the
                                guest file system (beneath
                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
                                and the subdirectory is symlinked into the host
                                at the same location. If
                                <literal>auto</literal> (the default),
                                and the right subdirectory of
                                <filename>/var/log/journal</filename>
                                exists, it will be bind mounted
                                into the container. If the
                                subdirectory doesn't exist, no
                                linking is performed. Effectively,
                                booting a container once with
                                <literal>guest</literal> or
                                <literal>host</literal> will link the
                                journal persistently if further on
                                the default of <literal>auto</literal>
                                is used.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-j</option></term>

                                <listitem><para>Equivalent to
                                <option>--link-journal=guest</option>.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--bind=</option></term>
                                <term><option>--bind-ro=</option></term>

                                <listitem><para>Bind mount a file or
                                directory from the host into the
                                container. Either takes a path
                                argument -- in which case the
                                specified path will be mounted from
                                the host to the same path in the
                                container --, or a colon-separated
                                pair of paths -- in which case the
                                first specified path is the source in
                                the host, and the second path is the
                                destination in the container. The
                                <option>--bind-ro=</option> option
                                creates read-only bind
                                mount.</para></listitem>
                        </varlistentry>
                </variablelist>

        </refsect1>

        <refsect1>
                <title>Example 1</title>

                <programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
# systemd-nspawn -bD /srv/mycontainer</programlisting>

                <para>This installs a minimal Fedora distribution into
                the directory <filename noindex='true'>/srv/mycontainer/</filename> and
                then boots an OS in a namespace container in
                it.</para>
        </refsect1>

        <refsect1>
                <title>Example 2</title>

                <programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
# systemd-nspawn -D ~/debian-tree/</programlisting>

                <para>This installs a minimal Debian unstable
                distribution into the directory
                <filename>~/debian-tree/</filename> and then spawns a
                shell in a namespace container in it.</para>
        </refsect1>

        <refsect1>
                <title>Example 3</title>

                <programlisting># pacstrap -c -d ~/arch-tree/ base
# systemd-nspawn -bD ~/arch-tree/</programlisting>

                <para>This installs a mimimal Arch Linux distribution into
                the directory <filename>~/arch-tree/</filename> and then
                boots an OS in a namespace container in it.</para>
        </refsect1>

        <refsect1 id='example-nsenter'>
                <title>Example 4</title>

                <para>To enter the container, PID of one of the
                processes sharing the new namespaces must be used.
                <command>systemd-nspawn</command> prints the PID
                (as viewed from the outside) of the launched process,
                and it can be used to enter the container.</para>

                <programlisting># nsenter -m -u -i -n -p -t $PID</programlisting>

                <para><citerefentry><refentrytitle>nsenter</refentrytitle><manvolnum>1</manvolnum></citerefentry>
                is part of
                <ulink url="https://github.com/karelzak/util-linux">util-linux</ulink>.
                Kernel support for entering namespaces was added in
                Linux 3.8.</para>
        </refsect1>

        <refsect1>
                <title>Exit status</title>

                <para>The exit code of the program executed in the
                container is returned.</para>
        </refsect1>

        <refsect1>
                <title>See Also</title>
                <para>
                        <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>unshare</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>
                </para>
        </refsect1>

</refentry>
Commit	Line	Data
8f7a3c14 LP	1	<?xml version='1.0'?> <!---nxml--->
	2	<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
	3	"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
	4
	5	<!--
	6	This file is part of systemd.
	7
	8	Copyright 2010 Lennart Poettering
	9
	10	systemd is free software; you can redistribute it and/or modify it
5430f7f2 LP	11	under the terms of the GNU Lesser General Public License as published by
5430f7f2 LP	12	the Free Software Foundation; either version 2.1 of the License, or
8f7a3c14 LP	13	(at your option) any later version.
	14
	15	systemd is distributed in the hope that it will be useful, but
	16	WITHOUT ANY WARRANTY; without even the implied warranty of
	17	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2	18	Lesser General Public License for more details.
8f7a3c14	19
5430f7f2	20	You should have received a copy of the GNU Lesser General Public License
8f7a3c14 LP	21	along with systemd; If not, see <http://www.gnu.org/licenses/>.
	22	-->
	23
	24	<refentry id="systemd-nspawn">
	25
	26	<refentryinfo>
	27	<title>systemd-nspawn</title>
	28	<productname>systemd</productname>
	29
	30	<authorgroup>
	31	<author>
	32	<contrib>Developer</contrib>
	33	<firstname>Lennart</firstname>
	34	<surname>Poettering</surname>
	35	<email>lennart@poettering.net</email>
	36	</author>
	37	</authorgroup>
	38	</refentryinfo>
	39
	40	<refmeta>
	41	<refentrytitle>systemd-nspawn</refentrytitle>
	42	<manvolnum>1</manvolnum>
	43	</refmeta>
	44
	45	<refnamediv>
	46	<refname>systemd-nspawn</refname>
	47	<refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
	48	</refnamediv>
	49
	50	<refsynopsisdiv>
	51	<cmdsynopsis>
1fd96121 ZJS	52	<command>systemd-nspawn</command>
1fd96121 ZJS	53	<arg choice="opt" rep="repeat">OPTIONS</arg>
870c4365 ZJS	54	<arg choice="opt"><replaceable>COMMAND</replaceable>
	55	<arg choice="opt" rep="repeat">ARGS</arg>
	56	</arg>
	57	</cmdsynopsis>
	58	<cmdsynopsis>
	59	<command>systemd-nspawn</command>
	60	<arg choice="plain">-b</arg>
	61	<arg choice="opt" rep="repeat">OPTIONS</arg>
1fd96121	62	<arg choice="opt" rep="repeat">ARGS</arg>
8f7a3c14 LP	63	</cmdsynopsis>
	64	</refsynopsisdiv>
	65
	66	<refsect1>
	67	<title>Description</title>
	68
	69	<para><command>systemd-nspawn</command> may be used to
	70	run a command or OS in a light-weight namespace
	71	container. In many ways it is similar to
	72	<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
	73	but more powerful since it fully virtualizes the file
9f7dad77	74	system hierarchy, as well as the process tree, the
8f7a3c14 LP	75	various IPC subsystems and the host and domain
	76	name.</para>
	77
	78	<para><command>systemd-nspawn</command> limits access
	79	to various kernel interfaces in the container to
	80	read-only, such as <filename>/sys</filename>,
	81	<filename>/proc/sys</filename> or
4f755fc6 LP	82	<filename>/sys/fs/selinux</filename>. Network
	83	interfaces and the system clock may not be changed
	84	from within the container. Device nodes may not be
	85	created. The host system cannot be rebooted and kernel
	86	modules may not be loaded from within the
	87	container.</para>
8f7a3c14 LP	88
	89	<para>Note that even though these security precautions
	90	are taken <command>systemd-nspawn</command> is not
	91	suitable for secure container setups. Many of the
	92	security features may be circumvented and are hence
	93	primarily useful to avoid accidental changes to the
	94	host system from the container. The intended use of
	95	this program is debugging and testing as well as
	96	building of packages, distributions and software
	97	involved with boot and systems management.</para>
	98
	99	<para>In contrast to
	100	<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
	101	<command>systemd-nspawn</command> may be used to boot
	102	full Linux-based operating systems in a
	103	container.</para>
	104
	105	<para>Use a tool like
4d62fb42	106	<citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
25f5971b	107	<citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
4d62fb42 LP	108	or
4d62fb42 LP	109	<citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
8f7a3c14	110	to set up an OS directory tree suitable as file system
25f5971b LP	111	hierarchy for <command>systemd-nspawn</command>
25f5971b LP	112	containers.</para>
8f7a3c14 LP	113
	114	<para>Note that <command>systemd-nspawn</command> will
	115	mount file systems private to the container to
	116	<filename>/dev</filename>,
2b583ce6	117	<filename>/run</filename> and similar. These will
8f7a3c14 LP	118	not be visible outside of the container, and their
	119	contents will be lost when the container exits.</para>
	120
	121	<para>Note that running two
	122	<command>systemd-nspawn</command> containers from the
	123	same directory tree will not make processes in them
9f7dad77	124	see each other. The PID namespace separation of the
8f7a3c14 LP	125	two containers is complete and the containers will
8f7a3c14 LP	126	share very few runtime objects except for the
1fd96121 ZJS	127	underlying file system. It is however possible to
	128	enter an existing container, see
	129	<link linkend='example-nsenter'>Example 4</link> below.
	130	</para>
99800333 LP	131
	132	<para><command>systemd-nspawn</command> implements the
	133	<ulink
	134	url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
	135	Interface</ulink> specification.</para>
f8964235 LP	136
	137	<para>As a safety check
	138	<command>systemd-nspawn</command> will verify the
fb69ed55	139	existence of <filename>/etc/os-release</filename> in
f8964235 LP	140	the container tree before starting the container (see
	141	<citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>). It
	142	might be necessary to add this file to the container
	143	tree manually if the OS of the container is too old to
	144	contain this file out-of-the-box.</para>
77b6e194 LP	145	</refsect1>
	146
	147	<refsect1>
	148	<title>Incompatibility with Auditing</title>
2aba426f LP	149
	150	<para>Note that the kernel auditing subsystem is
	151	currently broken when used together with
	152	containers. We hence recommend turning it off entirely
77b6e194 LP	153	by booting with <literal>audit=0</literal> on the
	154	kernel command line, or by turning it off at kernel
	155	build time. If auditing is enabled in the kernel
	156	operating systems booted in an nspawn container might
	157	refuse log-in attempts.</para>
8f7a3c14 LP	158	</refsect1>
	159
	160	<refsect1>
	161	<title>Options</title>
	162
870c4365 ZJS	163	<para>If option <option>-b</option> is specified, the
	164	arguments are used as arguments for the init
	165	binary. Otherwise, <replaceable>COMMAND</replaceable>
	166	specifies the program to launch in the container, and
	167	the remaining arguments are used as arguments for this
	168	program. If <option>-b</option> is not used and no
	169	arguments are specifed, a shell is launched in the
	170	container.</para>
	171
	172	<para>The following options are understood:</para>
8f7a3c14 LP	173
	174	<variablelist>
	175	<varlistentry>
a41fe3a2	176	<term><option>-h</option></term>
a7f5bb1e	177	<term><option>--help</option></term>
8f7a3c14 LP	178
	179	<listitem><para>Prints a short help
	180	text and exits.</para></listitem>
	181	</varlistentry>
	182
acbeb427 ZJS	183	<varlistentry>
	184	<term><option>--version</option></term>
	185
	186	<listitem><para>Prints a version string
	187	and exits.</para></listitem>
	188	</varlistentry>
	189
8f7a3c14	190	<varlistentry>
ab1f0633	191	<term><option>-D</option></term>
a7f5bb1e	192	<term><option>--directory=</option></term>
8f7a3c14 LP	193
	194	<listitem><para>Directory to use as
	195	file system root for the namespace
	196	container. If omitted the current
	197	directory will be
	198	used.</para></listitem>
	199	</varlistentry>
	200
0f0dbc46	201	<varlistentry>
0f0dbc46	202	<term><option>-b</option></term>
a7f5bb1e	203	<term><option>--boot</option></term>
0f0dbc46 LP	204
	205	<listitem><para>Automatically search
	206	for an init binary and invoke it
	207	instead of a shell or a user supplied
870c4365 ZJS	208	program. If this option is used, arguments
	209	specified on the command line are used
	210	as arguments for the init binary.
	211	</para></listitem>
0f0dbc46 LP	212	</varlistentry>
0f0dbc46 LP	213
687d0825	214	<varlistentry>
4f755fc6	215	<term><option>-u</option></term>
a7f5bb1e	216	<term><option>--user=</option></term>
687d0825 MV	217
	218	<listitem><para>Run the command
	219	under specified user, create home
	220	directory and cd into it. As rest
	221	of systemd-nspawn, this is not
	222	the security feature and limits
	223	against accidental changes only.
	224	</para></listitem>
	225	</varlistentry>
	226
7027ff61 LP	227	<varlistentry>
	228	<term><option>-M</option></term>
	229	<term><option>--machine=</option></term>
	230
	231	<listitem><para>Sets the machine name
	232	for this container. This name may be
	233	used to identify this container on the
	234	host, and is used to initialize the
	235	container's hostname (which the
	236	container can choose to override,
	237	however). If not specified the last
	238	component of the root directory of the
	239	container is used.</para></listitem>
	240	</varlistentry>
	241
431c72dc LP	242	<varlistentry>
	243	<term><option>--slice=</option></term>
	244
	245	<listitem><para>Make the container
	246	part of the specified slice, instead
	247	of the
	248	<filename>machine.slice</filename>.</para>
	249	</listitem>
	250	</varlistentry>
	251
144f0fc0 LP	252	<varlistentry>
	253	<term><option>--uuid=</option></term>
	254
e9dd9f95	255	<listitem><para>Set the specified UUID
144f0fc0 LP	256	for the container. The init system
	257	will initialize
	258	<filename>/etc/machine-id</filename>
	259	from this if this file is not set yet.
	260	</para></listitem>
	261	</varlistentry>
	262
a41fe3a2	263	<varlistentry>
ff01d048	264	<term><option>--private-network</option></term>
a41fe3a2 LP	265
	266	<listitem><para>Turn off networking in
	267	the container. This makes all network
	268	interfaces unavailable in the
	269	container, with the exception of the
	270	loopback device.</para></listitem>
	271	</varlistentry>
	272
bc2f673e LP	273	<varlistentry>
	274	<term><option>--read-only</option></term>
	275
	276	<listitem><para>Mount the root file
e9dd9f95	277	system read-only for the
bc2f673e LP	278	container.</para></listitem>
	279	</varlistentry>
	280
5076f0cc LP	281	<varlistentry>
	282	<term><option>--capability=</option></term>
	283
	284	<listitem><para>List one or more
	285	additional capabilities to grant the
e9dd9f95	286	container. Takes a comma-separated
5076f0cc LP	287	list of capability names, see
	288	<citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
	289	for more information. Note that the
88d04e31 LP	290	following capabilities will be granted
88d04e31 LP	291	in any way: CAP_CHOWN,
5076f0cc LP	292	CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
	293	CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
	294	CAP_KILL, CAP_LEASE,
	295	CAP_LINUX_IMMUTABLE,
	296	CAP_NET_BIND_SERVICE,
	297	CAP_NET_BROADCAST, CAP_NET_RAW,
	298	CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
	299	CAP_SETUID, CAP_SYS_ADMIN,
	300	CAP_SYS_CHROOT, CAP_SYS_NICE,
	301	CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
88d04e31 LP	302	CAP_SYS_RESOURCE, CAP_SYS_BOOT,
	303	CAP_AUDIT_WRITE,
	304	CAP_AUDIT_CONTROL.</para></listitem>
5076f0cc LP	305	</varlistentry>
5076f0cc LP	306
57fb9fb5 LP	307	<varlistentry>
	308	<term><option>--link-journal=</option></term>
	309
	310	<listitem><para>Control whether the
	311	container's journal shall be made
	312	visible to the host system. If enabled
	313	allows viewing the container's journal
	314	files from the host (but not vice
	315	versa). Takes one of
	316	<literal>no</literal>,
	317	<literal>host</literal>,
	318	<literal>guest</literal>,
	319	<literal>auto</literal>. If
27407a01 ZJS	320	<literal>no</literal>, the journal is
27407a01 ZJS	321	not linked. If <literal>host</literal>,
57fb9fb5	322	the journal files are stored on the
27407a01	323	host file system (beneath
e670b166	324	<filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01	325	and the subdirectory is bind-mounted
57fb9fb5	326	into the container at the same
27407a01	327	location. If <literal>guest</literal>,
57fb9fb5	328	the journal files are stored on the
27407a01	329	guest file system (beneath
e670b166	330	<filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01	331	and the subdirectory is symlinked into the host
57fb9fb5	332	at the same location. If
27407a01 ZJS	333	<literal>auto</literal> (the default),
27407a01 ZJS	334	and the right subdirectory of
57fb9fb5	335	<filename>/var/log/journal</filename>
27407a01 ZJS	336	exists, it will be bind mounted
	337	into the container. If the
	338	subdirectory doesn't exist, no
	339	linking is performed. Effectively,
	340	booting a container once with
57fb9fb5 LP	341	<literal>guest</literal> or
57fb9fb5 LP	342	<literal>host</literal> will link the
27407a01	343	journal persistently if further on
57fb9fb5 LP	344	the default of <literal>auto</literal>
	345	is used.</para></listitem>
	346	</varlistentry>
	347
	348	<varlistentry>
	349	<term><option>-j</option></term>
	350
	351	<listitem><para>Equivalent to
	352	<option>--link-journal=guest</option>.</para></listitem>
	353	</varlistentry>
17fe0523 LP	354
	355	<varlistentry>
	356	<term><option>--bind=</option></term>
	357	<term><option>--bind-ro=</option></term>
	358
	359	<listitem><para>Bind mount a file or
	360	directory from the host into the
	361	container. Either takes a path
	362	argument -- in which case the
	363	specified path will be mounted from
	364	the host to the same path in the
	365	container --, or a colon-separated
	366	pair of paths -- in which case the
	367	first specified path is the source in
	368	the host, and the second path is the
	369	destination in the container. The
	370	<option>--bind-ro=</option> option
	371	creates read-only bind
	372	mount.</para></listitem>
	373	</varlistentry>
8f7a3c14 LP	374	</variablelist>
	375
	376	</refsect1>
	377
	378	<refsect1>
	379	<title>Example 1</title>
	380
2b3987a8 LP	381	<programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
2b3987a8 LP	382	# systemd-nspawn -bD /srv/mycontainer</programlisting>
8f7a3c14	383
25f5971b	384	<para>This installs a minimal Fedora distribution into
845c5324	385	the directory <filename noindex='true'>/srv/mycontainer/</filename> and
2b3987a8 LP	386	then boots an OS in a namespace container in
2b3987a8 LP	387	it.</para>
8f7a3c14 LP	388	</refsect1>
	389
	390	<refsect1>
	391	<title>Example 2</title>
	392
25f5971b LP	393	<programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
25f5971b LP	394	# systemd-nspawn -D ~/debian-tree/</programlisting>
8f7a3c14	395
25f5971b LP	396	<para>This installs a minimal Debian unstable
	397	distribution into the directory
	398	<filename>~/debian-tree/</filename> and then spawns a
	399	shell in a namespace container in it.</para>
8f7a3c14 LP	400	</refsect1>
8f7a3c14 LP	401
68562936 WG	402	<refsect1>
	403	<title>Example 3</title>
	404
	405	<programlisting># pacstrap -c -d ~/arch-tree/ base
	406	# systemd-nspawn -bD ~/arch-tree/</programlisting>
	407
	408	<para>This installs a mimimal Arch Linux distribution into
	409	the directory <filename>~/arch-tree/</filename> and then
	410	boots an OS in a namespace container in it.</para>
	411	</refsect1>
	412
1fd96121 ZJS	413	<refsect1 id='example-nsenter'>
	414	<title>Example 4</title>
	415
	416	<para>To enter the container, PID of one of the
	417	processes sharing the new namespaces must be used.
	418	<command>systemd-nspawn</command> prints the PID
	419	(as viewed from the outside) of the launched process,
	420	and it can be used to enter the container.</para>
	421
f03dc7c0	422	<programlisting># nsenter -m -u -i -n -p -t $PID</programlisting>
1fd96121 ZJS	423
	424	<para><citerefentry><refentrytitle>nsenter</refentrytitle><manvolnum>1</manvolnum></citerefentry>
	425	is part of
	426	<ulink url="https://github.com/karelzak/util-linux">util-linux</ulink>.
	427	Kernel support for entering namespaces was added in
	428	Linux 3.8.</para>
	429	</refsect1>
	430
8f7a3c14 LP	431	<refsect1>
	432	<title>Exit status</title>
	433
	434	<para>The exit code of the program executed in the
	435	container is returned.</para>
	436	</refsect1>
	437
	438	<refsect1>
	439	<title>See Also</title>
	440	<para>
	441	<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
	442	<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1fd96121	443	<citerefentry><refentrytitle>unshare</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
25f5971b	444	<citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
4d62fb42	445	<citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
431c72dc LP	446	<citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
431c72dc LP	447	<citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>
8f7a3c14 LP	448	</para>
	449	</refsect1>
	450
	451	</refentry>