[thirdparty/systemd.git] / man / systemd-nspawn.xml

<?xml version='1.0'?> <!--*-nxml-*-->
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
        "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">

<!--
  This file is part of systemd.

  Copyright 2010 Lennart Poettering

  systemd is free software; you can redistribute it and/or modify it
  under the terms of the GNU Lesser General Public License as published by
  the Free Software Foundation; either version 2.1 of the License, or
  (at your option) any later version.

  systemd is distributed in the hope that it will be useful, but
  WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  Lesser General Public License for more details.

  You should have received a copy of the GNU Lesser General Public License
  along with systemd; If not, see <http://www.gnu.org/licenses/>.
-->

<refentry id="systemd-nspawn">

        <refentryinfo>
                <title>systemd-nspawn</title>
                <productname>systemd</productname>

                <authorgroup>
                        <author>
                                <contrib>Developer</contrib>
                                <firstname>Lennart</firstname>
                                <surname>Poettering</surname>
                                <email>lennart@poettering.net</email>
                        </author>
                </authorgroup>
        </refentryinfo>

        <refmeta>
                <refentrytitle>systemd-nspawn</refentrytitle>
                <manvolnum>1</manvolnum>
        </refmeta>

        <refnamediv>
                <refname>systemd-nspawn</refname>
                <refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
        </refnamediv>

        <refsynopsisdiv>
                <cmdsynopsis>
                        <command>systemd-nspawn</command>
                        <arg choice="opt" rep="repeat">OPTIONS</arg>
                        <arg choice="opt"><replaceable>COMMAND</replaceable>
                        <arg choice="opt" rep="repeat">ARGS</arg>
                        </arg>
                </cmdsynopsis>
                <cmdsynopsis>
                        <command>systemd-nspawn</command>
                        <arg choice="plain">-b</arg>
                        <arg choice="opt" rep="repeat">OPTIONS</arg>
                        <arg choice="opt" rep="repeat">ARGS</arg>
                </cmdsynopsis>
        </refsynopsisdiv>

        <refsect1>
                <title>Description</title>

                <para><command>systemd-nspawn</command> may be used to
                run a command or OS in a light-weight namespace
                container. In many ways it is similar to
                <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                but more powerful since it fully virtualizes the file
                system hierarchy, as well as the process tree, the
                various IPC subsystems and the host and domain
                name.</para>

                <para><command>systemd-nspawn</command> limits access
                to various kernel interfaces in the container to
                read-only, such as <filename>/sys</filename>,
                <filename>/proc/sys</filename> or
                <filename>/sys/fs/selinux</filename>. Network
                interfaces and the system clock may not be changed
                from within the container. Device nodes may not be
                created. The host system cannot be rebooted and kernel
                modules may not be loaded from within the
                container.</para>

                <para>Note that even though these security precautions
                are taken <command>systemd-nspawn</command> is not
                suitable for secure container setups. Many of the
                security features may be circumvented and are hence
                primarily useful to avoid accidental changes to the
                host system from the container. The intended use of
                this program is debugging and testing as well as
                building of packages, distributions and software
                involved with boot and systems management.</para>

                <para>In contrast to
                <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
                <command>systemd-nspawn</command> may be used to boot
                full Linux-based operating systems in a
                container.</para>

                <para>Use a tool like
                <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                or
                <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                to set up an OS directory tree suitable as file system
                hierarchy for <command>systemd-nspawn</command>
                containers.</para>

                <para>Note that <command>systemd-nspawn</command> will
                mount file systems private to the container to
                <filename>/dev</filename>,
                <filename>/run</filename> and similar. These will
                not be visible outside of the container, and their
                contents will be lost when the container exits.</para>

                <para>Note that running two
                <command>systemd-nspawn</command> containers from the
                same directory tree will not make processes in them
                see each other. The PID namespace separation of the
                two containers is complete and the containers will
                share very few runtime objects except for the
                underlying file system. It is however possible to
                enter an existing container, see
                <link linkend='example-nsenter'>Example 4</link> below.
                </para>

                <para><command>systemd-nspawn</command> implements the
                <ulink
                url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
                Interface</ulink> specification.</para>
        </refsect1>

        <refsect1>
                <title>Options</title>

                <para>If option <option>-b</option> is specified, the
                arguments are used as arguments for the init
                binary. Otherwise, <replaceable>COMMAND</replaceable>
                specifies the program to launch in the container, and
                the remaining arguments are used as arguments for this
                program. If <option>-b</option> is not used and no
                arguments are specifed, a shell is launched in the
                container.</para>

                <para>The following options are understood:</para>

                <variablelist>
                        <varlistentry>
                                <term><option>-h</option></term>
                                <term><option>--help</option></term>

                                <listitem><para>Prints a short help
                                text and exits.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--version</option></term>

                                <listitem><para>Prints a version string
                                and exits.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-D</option></term>
                                <term><option>--directory=</option></term>

                                <listitem><para>Directory to use as
                                file system root for the namespace
                                container. If omitted the current
                                directory will be
                                used.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-b</option></term>
                                <term><option>--boot</option></term>

                                <listitem><para>Automatically search
                                for an init binary and invoke it
                                instead of a shell or a user supplied
                                program. If this option is used, arguments
                                specified on the command line are used
                                as arguments for the init binary.
                                </para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-u</option></term>
                                <term><option>--user=</option></term>

                                <listitem><para>Run the command
                                under specified user, create home
                                directory and cd into it. As rest
                                of systemd-nspawn, this is not
                                the security feature and limits
                                against accidental changes only.
                                </para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-M</option></term>
                                <term><option>--machine=</option></term>

                                <listitem><para>Sets the machine name
                                for this container. This name may be
                                used to identify this container on the
                                host, and is used to initialize the
                                container's hostname (which the
                                container can choose to override,
                                however). If not specified the last
                                component of the root directory of the
                                container is used.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--uuid=</option></term>

                                <listitem><para>Set the specified uuid
                                for the container. The init system
                                will initialize
                                <filename>/etc/machine-id</filename>
                                from this if this file is not set yet.
                                </para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-C</option></term>
                                <term><option>--controllers=</option></term>

                                <listitem><para>Makes the container appear in
                                other hierarchies than the name=systemd:/ one.
                                Takes a comma-separated list of controllers.
                                </para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--private-network</option></term>

                                <listitem><para>Turn off networking in
                                the container. This makes all network
                                interfaces unavailable in the
                                container, with the exception of the
                                loopback device.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--read-only</option></term>

                                <listitem><para>Mount the root file
                                system read only for the
                                container.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--capability=</option></term>

                                <listitem><para>List one or more
                                additional capabilities to grant the
                                container. Takes a comma separated
                                list of capability names, see
                                <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
                                for more information. Note that the
                                following capabilities will be granted
                                in any way: CAP_CHOWN,
                                CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
                                CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
                                CAP_KILL, CAP_LEASE,
                                CAP_LINUX_IMMUTABLE,
                                CAP_NET_BIND_SERVICE,
                                CAP_NET_BROADCAST, CAP_NET_RAW,
                                CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
                                CAP_SETUID, CAP_SYS_ADMIN,
                                CAP_SYS_CHROOT, CAP_SYS_NICE,
                                CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
                                CAP_SYS_RESOURCE, CAP_SYS_BOOT,
                                CAP_AUDIT_WRITE,
                                CAP_AUDIT_CONTROL.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--link-journal=</option></term>

                                <listitem><para>Control whether the
                                container's journal shall be made
                                visible to the host system. If enabled
                                allows viewing the container's journal
                                files from the host (but not vice
                                versa). Takes one of
                                <literal>no</literal>,
                                <literal>host</literal>,
                                <literal>guest</literal>,
                                <literal>auto</literal>. If
                                <literal>no</literal>, the journal is
                                not linked. If <literal>host</literal>,
                                the journal files are stored on the
                                host file system (beneath
                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
                                and the subdirectory is bind-mounted
                                into the container at the same
                                location. If <literal>guest</literal>,
                                the journal files are stored on the
                                guest file system (beneath
                                <filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
                                and the subdirectory is symlinked into the host
                                at the same location. If
                                <literal>auto</literal> (the default),
                                and the right subdirectory of
                                <filename>/var/log/journal</filename>
                                exists, it will be bind mounted
                                into the container. If the
                                subdirectory doesn't exist, no
                                linking is performed. Effectively,
                                booting a container once with
                                <literal>guest</literal> or
                                <literal>host</literal> will link the
                                journal persistently if further on
                                the default of <literal>auto</literal>
                                is used.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>-j</option></term>

                                <listitem><para>Equivalent to
                                <option>--link-journal=guest</option>.</para></listitem>
                        </varlistentry>

                        <varlistentry>
                                <term><option>--bind=</option></term>
                                <term><option>--bind-ro=</option></term>

                                <listitem><para>Bind mount a file or
                                directory from the host into the
                                container. Either takes a path
                                argument -- in which case the
                                specified path will be mounted from
                                the host to the same path in the
                                container --, or a colon-separated
                                pair of paths -- in which case the
                                first specified path is the source in
                                the host, and the second path is the
                                destination in the container. The
                                <option>--bind-ro=</option> option
                                creates read-only bind
                                mount.</para></listitem>
                        </varlistentry>
                </variablelist>

        </refsect1>

        <refsect1>
                <title>Example 1</title>

                <programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
# systemd-nspawn -bD /srv/mycontainer</programlisting>

                <para>This installs a minimal Fedora distribution into
                the directory <filename>/srv/mycontainer/</filename> and
                then boots an OS in a namespace container in
                it.</para>
        </refsect1>

        <refsect1>
                <title>Example 2</title>

                <programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
# systemd-nspawn -D ~/debian-tree/</programlisting>

                <para>This installs a minimal Debian unstable
                distribution into the directory
                <filename>~/debian-tree/</filename> and then spawns a
                shell in a namespace container in it.</para>
        </refsect1>

        <refsect1>
                <title>Example 3</title>

                <programlisting># pacstrap -c -d ~/arch-tree/ base
# systemd-nspawn -bD ~/arch-tree/</programlisting>

                <para>This installs a mimimal Arch Linux distribution into
                the directory <filename>~/arch-tree/</filename> and then
                boots an OS in a namespace container in it.</para>
        </refsect1>

        <refsect1 id='example-nsenter'>
                <title>Example 4</title>

                <para>To enter the container, PID of one of the
                processes sharing the new namespaces must be used.
                <command>systemd-nspawn</command> prints the PID
                (as viewed from the outside) of the launched process,
                and it can be used to enter the container.</para>

                <programlisting># nsenter -muinpt $PID</programlisting>

                <para><citerefentry><refentrytitle>nsenter</refentrytitle><manvolnum>1</manvolnum></citerefentry>
                is part of
                <ulink url="https://github.com/karelzak/util-linux">util-linux</ulink>.
                Kernel support for entering namespaces was added in
                Linux 3.8.</para>
        </refsect1>

        <refsect1>
                <title>Exit status</title>

                <para>The exit code of the program executed in the
                container is returned.</para>
        </refsect1>

        <refsect1>
                <title>See Also</title>
                <para>
                        <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>unshare</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
                        <citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
                </para>
        </refsect1>

</refentry>
Commit	Line	Data
8f7a3c14 LP	1	<?xml version='1.0'?> <!---nxml--->
	2	<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
	3	"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
	4
	5	<!--
	6	This file is part of systemd.
	7
	8	Copyright 2010 Lennart Poettering
	9
	10	systemd is free software; you can redistribute it and/or modify it
5430f7f2 LP	11	under the terms of the GNU Lesser General Public License as published by
5430f7f2 LP	12	the Free Software Foundation; either version 2.1 of the License, or
8f7a3c14 LP	13	(at your option) any later version.
	14
	15	systemd is distributed in the hope that it will be useful, but
	16	WITHOUT ANY WARRANTY; without even the implied warranty of
	17	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2	18	Lesser General Public License for more details.
8f7a3c14	19
5430f7f2	20	You should have received a copy of the GNU Lesser General Public License
8f7a3c14 LP	21	along with systemd; If not, see <http://www.gnu.org/licenses/>.
	22	-->
	23
	24	<refentry id="systemd-nspawn">
	25
	26	<refentryinfo>
	27	<title>systemd-nspawn</title>
	28	<productname>systemd</productname>
	29
	30	<authorgroup>
	31	<author>
	32	<contrib>Developer</contrib>
	33	<firstname>Lennart</firstname>
	34	<surname>Poettering</surname>
	35	<email>lennart@poettering.net</email>
	36	</author>
	37	</authorgroup>
	38	</refentryinfo>
	39
	40	<refmeta>
	41	<refentrytitle>systemd-nspawn</refentrytitle>
	42	<manvolnum>1</manvolnum>
	43	</refmeta>
	44
	45	<refnamediv>
	46	<refname>systemd-nspawn</refname>
	47	<refpurpose>Spawn a namespace container for debugging, testing and building</refpurpose>
	48	</refnamediv>
	49
	50	<refsynopsisdiv>
	51	<cmdsynopsis>
1fd96121 ZJS	52	<command>systemd-nspawn</command>
1fd96121 ZJS	53	<arg choice="opt" rep="repeat">OPTIONS</arg>
870c4365 ZJS	54	<arg choice="opt"><replaceable>COMMAND</replaceable>
	55	<arg choice="opt" rep="repeat">ARGS</arg>
	56	</arg>
	57	</cmdsynopsis>
	58	<cmdsynopsis>
	59	<command>systemd-nspawn</command>
	60	<arg choice="plain">-b</arg>
	61	<arg choice="opt" rep="repeat">OPTIONS</arg>
1fd96121	62	<arg choice="opt" rep="repeat">ARGS</arg>
8f7a3c14 LP	63	</cmdsynopsis>
	64	</refsynopsisdiv>
	65
	66	<refsect1>
	67	<title>Description</title>
	68
	69	<para><command>systemd-nspawn</command> may be used to
	70	run a command or OS in a light-weight namespace
	71	container. In many ways it is similar to
	72	<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
	73	but more powerful since it fully virtualizes the file
9f7dad77	74	system hierarchy, as well as the process tree, the
8f7a3c14 LP	75	various IPC subsystems and the host and domain
	76	name.</para>
	77
	78	<para><command>systemd-nspawn</command> limits access
	79	to various kernel interfaces in the container to
	80	read-only, such as <filename>/sys</filename>,
	81	<filename>/proc/sys</filename> or
4f755fc6 LP	82	<filename>/sys/fs/selinux</filename>. Network
	83	interfaces and the system clock may not be changed
	84	from within the container. Device nodes may not be
	85	created. The host system cannot be rebooted and kernel
	86	modules may not be loaded from within the
	87	container.</para>
8f7a3c14 LP	88
	89	<para>Note that even though these security precautions
	90	are taken <command>systemd-nspawn</command> is not
	91	suitable for secure container setups. Many of the
	92	security features may be circumvented and are hence
	93	primarily useful to avoid accidental changes to the
	94	host system from the container. The intended use of
	95	this program is debugging and testing as well as
	96	building of packages, distributions and software
	97	involved with boot and systems management.</para>
	98
	99	<para>In contrast to
	100	<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
	101	<command>systemd-nspawn</command> may be used to boot
	102	full Linux-based operating systems in a
	103	container.</para>
	104
	105	<para>Use a tool like
4d62fb42	106	<citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
25f5971b	107	<citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>
4d62fb42 LP	108	or
4d62fb42 LP	109	<citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
8f7a3c14	110	to set up an OS directory tree suitable as file system
25f5971b LP	111	hierarchy for <command>systemd-nspawn</command>
25f5971b LP	112	containers.</para>
8f7a3c14 LP	113
	114	<para>Note that <command>systemd-nspawn</command> will
	115	mount file systems private to the container to
	116	<filename>/dev</filename>,
2b583ce6	117	<filename>/run</filename> and similar. These will
8f7a3c14 LP	118	not be visible outside of the container, and their
	119	contents will be lost when the container exits.</para>
	120
	121	<para>Note that running two
	122	<command>systemd-nspawn</command> containers from the
	123	same directory tree will not make processes in them
9f7dad77	124	see each other. The PID namespace separation of the
8f7a3c14 LP	125	two containers is complete and the containers will
8f7a3c14 LP	126	share very few runtime objects except for the
1fd96121 ZJS	127	underlying file system. It is however possible to
	128	enter an existing container, see
	129	<link linkend='example-nsenter'>Example 4</link> below.
	130	</para>
99800333 LP	131
	132	<para><command>systemd-nspawn</command> implements the
	133	<ulink
	134	url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
	135	Interface</ulink> specification.</para>
8f7a3c14 LP	136	</refsect1>
	137
	138	<refsect1>
	139	<title>Options</title>
	140
870c4365 ZJS	141	<para>If option <option>-b</option> is specified, the
	142	arguments are used as arguments for the init
	143	binary. Otherwise, <replaceable>COMMAND</replaceable>
	144	specifies the program to launch in the container, and
	145	the remaining arguments are used as arguments for this
	146	program. If <option>-b</option> is not used and no
	147	arguments are specifed, a shell is launched in the
	148	container.</para>
	149
	150	<para>The following options are understood:</para>
8f7a3c14 LP	151
	152	<variablelist>
	153	<varlistentry>
a41fe3a2	154	<term><option>-h</option></term>
a7f5bb1e	155	<term><option>--help</option></term>
8f7a3c14 LP	156
	157	<listitem><para>Prints a short help
	158	text and exits.</para></listitem>
	159	</varlistentry>
	160
acbeb427 ZJS	161	<varlistentry>
	162	<term><option>--version</option></term>
	163
	164	<listitem><para>Prints a version string
	165	and exits.</para></listitem>
	166	</varlistentry>
	167
8f7a3c14	168	<varlistentry>
ab1f0633	169	<term><option>-D</option></term>
a7f5bb1e	170	<term><option>--directory=</option></term>
8f7a3c14 LP	171
	172	<listitem><para>Directory to use as
	173	file system root for the namespace
	174	container. If omitted the current
	175	directory will be
	176	used.</para></listitem>
	177	</varlistentry>
	178
0f0dbc46	179	<varlistentry>
0f0dbc46	180	<term><option>-b</option></term>
a7f5bb1e	181	<term><option>--boot</option></term>
0f0dbc46 LP	182
	183	<listitem><para>Automatically search
	184	for an init binary and invoke it
	185	instead of a shell or a user supplied
870c4365 ZJS	186	program. If this option is used, arguments
	187	specified on the command line are used
	188	as arguments for the init binary.
	189	</para></listitem>
0f0dbc46 LP	190	</varlistentry>
0f0dbc46 LP	191
687d0825	192	<varlistentry>
4f755fc6	193	<term><option>-u</option></term>
a7f5bb1e	194	<term><option>--user=</option></term>
687d0825 MV	195
	196	<listitem><para>Run the command
	197	under specified user, create home
	198	directory and cd into it. As rest
	199	of systemd-nspawn, this is not
	200	the security feature and limits
	201	against accidental changes only.
	202	</para></listitem>
	203	</varlistentry>
	204
7027ff61 LP	205	<varlistentry>
	206	<term><option>-M</option></term>
	207	<term><option>--machine=</option></term>
	208
	209	<listitem><para>Sets the machine name
	210	for this container. This name may be
	211	used to identify this container on the
	212	host, and is used to initialize the
	213	container's hostname (which the
	214	container can choose to override,
	215	however). If not specified the last
	216	component of the root directory of the
	217	container is used.</para></listitem>
	218	</varlistentry>
	219
144f0fc0 LP	220	<varlistentry>
	221	<term><option>--uuid=</option></term>
	222
	223	<listitem><para>Set the specified uuid
	224	for the container. The init system
	225	will initialize
	226	<filename>/etc/machine-id</filename>
	227	from this if this file is not set yet.
	228	</para></listitem>
	229	</varlistentry>
	230
40c32a4a	231	<varlistentry>
40c32a4a	232	<term><option>-C</option></term>
a7f5bb1e	233	<term><option>--controllers=</option></term>
40c32a4a LGL	234
40c32a4a LGL	235	<listitem><para>Makes the container appear in
0cd1fd43	236	other hierarchies than the name=systemd:/ one.
40c32a4a LGL	237	Takes a comma-separated list of controllers.
	238	</para></listitem>
	239	</varlistentry>
	240
a41fe3a2	241	<varlistentry>
ff01d048	242	<term><option>--private-network</option></term>
a41fe3a2 LP	243
	244	<listitem><para>Turn off networking in
	245	the container. This makes all network
	246	interfaces unavailable in the
	247	container, with the exception of the
	248	loopback device.</para></listitem>
	249	</varlistentry>
	250
bc2f673e LP	251	<varlistentry>
	252	<term><option>--read-only</option></term>
	253
	254	<listitem><para>Mount the root file
	255	system read only for the
	256	container.</para></listitem>
	257	</varlistentry>
	258
5076f0cc LP	259	<varlistentry>
	260	<term><option>--capability=</option></term>
	261
	262	<listitem><para>List one or more
	263	additional capabilities to grant the
	264	container. Takes a comma separated
	265	list of capability names, see
	266	<citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
	267	for more information. Note that the
88d04e31 LP	268	following capabilities will be granted
88d04e31 LP	269	in any way: CAP_CHOWN,
5076f0cc LP	270	CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH,
	271	CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER,
	272	CAP_KILL, CAP_LEASE,
	273	CAP_LINUX_IMMUTABLE,
	274	CAP_NET_BIND_SERVICE,
	275	CAP_NET_BROADCAST, CAP_NET_RAW,
	276	CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP,
	277	CAP_SETUID, CAP_SYS_ADMIN,
	278	CAP_SYS_CHROOT, CAP_SYS_NICE,
	279	CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG,
88d04e31 LP	280	CAP_SYS_RESOURCE, CAP_SYS_BOOT,
	281	CAP_AUDIT_WRITE,
	282	CAP_AUDIT_CONTROL.</para></listitem>
5076f0cc LP	283	</varlistentry>
5076f0cc LP	284
57fb9fb5 LP	285	<varlistentry>
	286	<term><option>--link-journal=</option></term>
	287
	288	<listitem><para>Control whether the
	289	container's journal shall be made
	290	visible to the host system. If enabled
	291	allows viewing the container's journal
	292	files from the host (but not vice
	293	versa). Takes one of
	294	<literal>no</literal>,
	295	<literal>host</literal>,
	296	<literal>guest</literal>,
	297	<literal>auto</literal>. If
27407a01 ZJS	298	<literal>no</literal>, the journal is
27407a01 ZJS	299	not linked. If <literal>host</literal>,
57fb9fb5	300	the journal files are stored on the
27407a01	301	host file system (beneath
e670b166	302	<filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01	303	and the subdirectory is bind-mounted
57fb9fb5	304	into the container at the same
27407a01	305	location. If <literal>guest</literal>,
57fb9fb5	306	the journal files are stored on the
27407a01	307	guest file system (beneath
e670b166	308	<filename>/var/log/journal/<replaceable>machine-id</replaceable></filename>)
27407a01	309	and the subdirectory is symlinked into the host
57fb9fb5	310	at the same location. If
27407a01 ZJS	311	<literal>auto</literal> (the default),
27407a01 ZJS	312	and the right subdirectory of
57fb9fb5	313	<filename>/var/log/journal</filename>
27407a01 ZJS	314	exists, it will be bind mounted
	315	into the container. If the
	316	subdirectory doesn't exist, no
	317	linking is performed. Effectively,
	318	booting a container once with
57fb9fb5 LP	319	<literal>guest</literal> or
57fb9fb5 LP	320	<literal>host</literal> will link the
27407a01	321	journal persistently if further on
57fb9fb5 LP	322	the default of <literal>auto</literal>
	323	is used.</para></listitem>
	324	</varlistentry>
	325
	326	<varlistentry>
	327	<term><option>-j</option></term>
	328
	329	<listitem><para>Equivalent to
	330	<option>--link-journal=guest</option>.</para></listitem>
	331	</varlistentry>
17fe0523 LP	332
	333	<varlistentry>
	334	<term><option>--bind=</option></term>
	335	<term><option>--bind-ro=</option></term>
	336
	337	<listitem><para>Bind mount a file or
	338	directory from the host into the
	339	container. Either takes a path
	340	argument -- in which case the
	341	specified path will be mounted from
	342	the host to the same path in the
	343	container --, or a colon-separated
	344	pair of paths -- in which case the
	345	first specified path is the source in
	346	the host, and the second path is the
	347	destination in the container. The
	348	<option>--bind-ro=</option> option
	349	creates read-only bind
	350	mount.</para></listitem>
	351	</varlistentry>
8f7a3c14 LP	352	</variablelist>
	353
	354	</refsect1>
	355
	356	<refsect1>
	357	<title>Example 1</title>
	358
2b3987a8 LP	359	<programlisting># yum -y --releasever=19 --nogpg --installroot=/srv/mycontainer --disablerepo='*' --enablerepo=fedora install systemd passwd yum fedora-release vim-minimal
2b3987a8 LP	360	# systemd-nspawn -bD /srv/mycontainer</programlisting>
8f7a3c14	361
25f5971b	362	<para>This installs a minimal Fedora distribution into
2b3987a8 LP	363	the directory <filename>/srv/mycontainer/</filename> and
	364	then boots an OS in a namespace container in
	365	it.</para>
8f7a3c14 LP	366	</refsect1>
	367
	368	<refsect1>
	369	<title>Example 2</title>
	370
25f5971b LP	371	<programlisting># debootstrap --arch=amd64 unstable ~/debian-tree/
25f5971b LP	372	# systemd-nspawn -D ~/debian-tree/</programlisting>
8f7a3c14	373
25f5971b LP	374	<para>This installs a minimal Debian unstable
	375	distribution into the directory
	376	<filename>~/debian-tree/</filename> and then spawns a
	377	shell in a namespace container in it.</para>
8f7a3c14 LP	378	</refsect1>
8f7a3c14 LP	379
68562936 WG	380	<refsect1>
	381	<title>Example 3</title>
	382
	383	<programlisting># pacstrap -c -d ~/arch-tree/ base
	384	# systemd-nspawn -bD ~/arch-tree/</programlisting>
	385
	386	<para>This installs a mimimal Arch Linux distribution into
	387	the directory <filename>~/arch-tree/</filename> and then
	388	boots an OS in a namespace container in it.</para>
	389	</refsect1>
	390
1fd96121 ZJS	391	<refsect1 id='example-nsenter'>
	392	<title>Example 4</title>
	393
	394	<para>To enter the container, PID of one of the
	395	processes sharing the new namespaces must be used.
	396	<command>systemd-nspawn</command> prints the PID
	397	(as viewed from the outside) of the launched process,
	398	and it can be used to enter the container.</para>
	399
	400	<programlisting># nsenter -muinpt $PID</programlisting>
	401
	402	<para><citerefentry><refentrytitle>nsenter</refentrytitle><manvolnum>1</manvolnum></citerefentry>
	403	is part of
	404	<ulink url="https://github.com/karelzak/util-linux">util-linux</ulink>.
	405	Kernel support for entering namespaces was added in
	406	Linux 3.8.</para>
	407	</refsect1>
	408
8f7a3c14 LP	409	<refsect1>
	410	<title>Exit status</title>
	411
	412	<para>The exit code of the program executed in the
	413	container is returned.</para>
	414	</refsect1>
	415
	416	<refsect1>
	417	<title>See Also</title>
	418	<para>
	419	<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
	420	<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1fd96121	421	<citerefentry><refentrytitle>unshare</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
25f5971b	422	<citerefentry><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
4d62fb42	423	<citerefentry><refentrytitle>debootstrap</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
68562936	424	<citerefentry><refentrytitle>pacman</refentrytitle><manvolnum>8</manvolnum></citerefentry>
8f7a3c14 LP	425	</para>
	426	</refsect1>
	427
	428	</refentry>