man/systemd.nspawn.xml

   1 <?xml version='1.0'?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   4 <!ENTITY % entities SYSTEM "custom-entities.ent" >
   5 %entities;
   6 ]>
   7 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   8
   9 <refentry id="systemd.nspawn">
  10
  11   <refentryinfo>
  12     <title>systemd.nspawn</title>
  13     <productname>systemd</productname>
  14   </refentryinfo>
  15
  16   <refmeta>
  17     <refentrytitle>systemd.nspawn</refentrytitle>
  18     <manvolnum>5</manvolnum>
  19   </refmeta>
  20
  21   <refnamediv>
  22     <refname>systemd.nspawn</refname>
  23     <refpurpose>Container settings</refpurpose>
  24   </refnamediv>
  25
  26   <refsynopsisdiv>
  27     <para><filename>/etc/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  28     <para><filename>/run/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  29     <para><filename>/var/lib/machines/<replaceable>machine</replaceable>.nspawn</filename></para>
  30   </refsynopsisdiv>
  31
  32   <refsect1>
  33     <title>Description</title>
  34
  35     <para>An nspawn container settings file (suffix
  36     <filename>.nspawn</filename>) encodes additional runtime
  37     information about a local container, and is searched, read and
  38     used by
  39     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  40     when starting a container. Files of this type are named after the
  41     containers they define settings for. They are optional, and only
  42     required for containers whose execution environment shall differ
  43     from the defaults. Files of this type mostly contain settings that
  44     may also be set on the <command>systemd-nspawn</command> command
  45     line, and make it easier to persistently attach specific settings
  46     to specific containers. The syntax of these files is inspired by
  47     <filename>.desktop</filename> files following the <ulink
  48     url="http://standards.freedesktop.org/desktop-entry-spec/latest/">XDG
  49     Desktop Entry Specification</ulink>, which in turn are inspired by
  50     Microsoft Windows <filename>.ini</filename> files.</para>
  51
  52     <para>Boolean arguments used in these settings files can be
  53     written in various formats. For positive settings, the strings
  54     <option>1</option>, <option>yes</option>, <option>true</option>
  55     and <option>on</option> are equivalent. For negative settings, the
  56     strings <option>0</option>, <option>no</option>,
  57     <option>false</option> and <option>off</option> are
  58     equivalent.</para>
  59
  60     <para>Empty lines and lines starting with # or ; are
  61     ignored. This may be used for commenting. Lines ending
  62     in a backslash are concatenated with the following
  63     line while reading and the backslash is replaced by a
  64     space character. This may be used to wrap long lines.</para>
  65
  66   </refsect1>
  67
  68   <refsect1>
  69     <title><filename>.nspawn</filename> File Discovery</title>
  70
  71     <para>Files are searched by appending the
  72     <filename>.nspawn</filename> suffix to the machine name of the
  73     container, as specified with the <option>--machine=</option>
  74     switch of <command>systemd-nspawn</command>, or derived from the
  75     directory or image file name. This file is first searched in
  76     <filename>/etc/systemd/nspawn/</filename> and
  77     <filename>/run/systemd/nspawn/</filename>. If found in these
  78     directories, its settings are read and all of them take full effect
  79     (but are possibly overridden by corresponding command line
  80     arguments). If not found, the file will then be searched next to
  81     the image file or in the immediate parent of the root directory of
  82     the container. If the file is found there, only a subset of the
  83     settings will take effect however. All settings that possibly
  84     elevate privileges or grant additional access to resources of the
  85     host (such as files or directories) are ignored. To which options
  86     this applies is documented below.</para>
  87
  88     <para>Persistent settings files created and maintained by the
  89     administrator (and thus trusted) should be placed in
  90     <filename>/etc/systemd/nspawn/</filename>, while automatically
  91     downloaded (and thus potentially untrusted) settings files are
  92     placed in <filename>/var/lib/machines/</filename> instead (next to
  93     the container images), where their security impact is limited. In
  94     order to add privileged settings to <filename>.nspawn</filename>
  95     files acquired from the image vendor, it is recommended to copy the
  96     settings files into <filename>/etc/systemd/nspawn/</filename> and
  97     edit them there, so that the privileged options become
  98     available. The precise algorithm for how the files are searched and
  99     interpreted may be configured with
 100     <command>systemd-nspawn</command>'s <option>--settings=</option>
 101     switch, see
 102     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 103     for details.</para>
 104   </refsect1>
 105
 106   <refsect1>
 107     <title>[Exec] Section Options</title>
 108
 109     <para>Settings files may include an <literal>[Exec]</literal>
 110     section, which carries various execution parameters:</para>
 111
 112     <variablelist class='nspawn-directives'>
 113
 114       <varlistentry>
 115         <term><varname>Boot=</varname></term>
 116
 117         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, <command>systemd-nspawn</command>
 118         will automatically search for an <filename>init</filename> executable and invoke it. In this case, the
 119         specified parameters using <varname>Parameters=</varname> are passed as additional arguments to the
 120         <filename>init</filename> process. This setting corresponds to the <option>--boot</option> switch on the
 121         <command>systemd-nspawn</command> command line. This option may not be combined with
 122         <varname>ProcessTwo=yes</varname>. This option is the default if the
 123         <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
 124       </varlistentry>
 125
 126       <varlistentry>
 127         <term><varname>Ephemeral=</varname></term>
 128
 129         <listitem><para>Takes a boolean argument, which defaults to off, If enabled, the container is run with
 130         a temporary snapshot of its file system that is removed immediately when the container terminates.
 131         This is equivalent to the <option>--ephemeral</option> command line switch. See
 132         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 133         about the specific options supported.</para></listitem>
 134       </varlistentry>
 135
 136       <varlistentry>
 137         <term><varname>ProcessTwo=</varname></term>
 138
 139         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, the specified program is run as
 140         PID 2. A stub init process is run as PID 1. This setting corresponds to the <option>--as-pid2</option> switch
 141         on the <command>systemd-nspawn</command> command line. This option may not be combined with
 142         <varname>Boot=yes</varname>.</para></listitem>
 143       </varlistentry>
 144
 145       <varlistentry>
 146         <term><varname>Parameters=</varname></term>
 147
 148         <listitem><para>Takes a space-separated list of
 149         arguments. This is either a command line, beginning with the
 150         binary name to execute, or – if <varname>Boot=</varname> is
 151         enabled – the list of arguments to pass to the init
 152         process. This setting corresponds to the command line
 153         parameters passed on the <command>systemd-nspawn</command>
 154         command line.</para></listitem>
 155       </varlistentry>
 156
 157       <varlistentry>
 158         <term><varname>Environment=</varname></term>
 159
 160         <listitem><para>Takes an environment variable assignment
 161         consisting of key and value, separated by
 162         <literal>=</literal>. Sets an environment variable for the
 163         main process invoked in the container. This setting may be
 164         used multiple times to set multiple environment variables. It
 165         corresponds to the <option>--setenv=</option> command line
 166         switch.</para></listitem>
 167       </varlistentry>
 168
 169       <varlistentry>
 170         <term><varname>User=</varname></term>
 171
 172         <listitem><para>Takes a UNIX user name. Specifies the user
 173         name to invoke the main process of the container as. This user
 174         must be known in the container's user database. This
 175         corresponds to the <option>--user=</option> command line
 176         switch.</para></listitem>
 177       </varlistentry>
 178
 179       <varlistentry>
 180         <term><varname>WorkingDirectory=</varname></term>
 181
 182         <listitem><para>Selects the working directory for the process invoked in the container. Expects an absolute
 183         path in the container's file system namespace. This corresponds to the <option>--chdir=</option> command line
 184         switch.</para></listitem>
 185       </varlistentry>
 186
 187       <varlistentry>
 188         <term><varname>PivotRoot=</varname></term>
 189
 190         <listitem><para>Selects a directory to pivot to <filename>/</filename> inside the container when starting up.
 191         Takes a single path, or a pair of two paths separated by a colon. Both paths must be absolute, and are resolved
 192         in the container's file system namespace. This corresponds to the <option>--pivot-root=</option> command line
 193         switch.</para></listitem>
 194       </varlistentry>
 195
 196       <varlistentry>
 197         <term><varname>Capability=</varname></term>
 198         <term><varname>DropCapability=</varname></term>
 199
 200         <listitem><para>Takes a space-separated list of Linux process
 201         capabilities (see
 202         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 203         for details). The <varname>Capability=</varname> setting
 204         specifies additional capabilities to pass on top of the
 205         default set of capabilities. The
 206         <varname>DropCapability=</varname> setting specifies
 207         capabilities to drop from the default set. These settings
 208         correspond to the <option>--capability=</option> and
 209         <option>--drop-capability=</option> command line
 210         switches. Note that <varname>Capability=</varname> is a
 211         privileged setting, and only takes effect in
 212         <filename>.nspawn</filename> files in
 213         <filename>/etc/systemd/nspawn/</filename> and
 214         <filename>/run/system/nspawn/</filename> (see above). On the
 215         other hand, <varname>DropCapability=</varname> takes effect in
 216         all cases.</para></listitem>
 217       </varlistentry>
 218
 219       <varlistentry>
 220         <term><varname>NoNewPrivileges=</varname></term>
 221
 222         <listitem><para>Takes a boolean argument that controls the <constant>PR_SET_NO_NEW_PRIVS</constant> flag for
 223         the container payload. This is equivalent to the
 224         <option>--no-new-privileges=</option> command line switch. See
 225         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 226         details.</para>
 227         </listitem>
 228       </varlistentry>
 229
 230       <varlistentry>
 231         <term><varname>KillSignal=</varname></term>
 232
 233         <listitem><para>Specify the process signal to send to the
 234         container's PID 1 when nspawn itself receives SIGTERM, in
 235         order to trigger an orderly shutdown of the container.
 236         Defaults to SIGRTMIN+3 if <option>Boot=</option> is used
 237         (on systemd-compatible init systems SIGRTMIN+3 triggers an
 238         orderly shutdown). For a list of valid signals, see
 239         <citerefentry project='man-pages'><refentrytitle>signal</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para></listitem>
 240       </varlistentry>
 241
 242       <varlistentry>
 243         <term><varname>Personality=</varname></term>
 244
 245         <listitem><para>Configures the kernel personality for the
 246         container. This is equivalent to the
 247         <option>--personality=</option> switch.</para></listitem>
 248       </varlistentry>
 249
 250       <varlistentry>
 251         <term><varname>MachineID=</varname></term>
 252
 253         <listitem><para>Configures the 128-bit machine ID (UUID) to pass to
 254         the container. This is equivalent to the
 255         <option>--uuid=</option> command line switch. This option is
 256         privileged (see above). </para></listitem>
 257       </varlistentry>
 258
 259       <varlistentry>
 260         <term><varname>PrivateUsers=</varname></term>
 261
 262         <listitem><para>Configures support for usernamespacing. This is equivalent to the
 263         <option>--private-users=</option> command line switch, and takes the same options. This option is privileged
 264         (see above). This option is the default if the <filename>systemd-nspawn@.service</filename> template unit file
 265         is used.</para></listitem>
 266       </varlistentry>
 267
 268       <varlistentry>
 269         <term><varname>NotifyReady=</varname></term>
 270
 271         <listitem><para>Configures support for notifications from the container's init process.  This is equivalent to
 272         the <option>--notify-ready=</option> command line switch, and takes the same parameters. See
 273         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 274         about the specific options supported.</para></listitem>
 275       </varlistentry>
 276
 277       <varlistentry>
 278         <term><varname>SystemCallFilter=</varname></term>
 279
 280         <listitem><para>Configures the system call filter applied to containers. This is equivalent to the
 281         <option>--system-call-filter=</option> command line switch, and takes the same list parameter. See
 282         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 283         details.</para></listitem>
 284       </varlistentry>
 285
 286       <varlistentry>
 287         <term><varname>LimitCPU=</varname></term>
 288         <term><varname>LimitFSIZE=</varname></term>
 289         <term><varname>LimitDATA=</varname></term>
 290         <term><varname>LimitSTACK=</varname></term>
 291         <term><varname>LimitCORE=</varname></term>
 292         <term><varname>LimitRSS=</varname></term>
 293         <term><varname>LimitNOFILE=</varname></term>
 294         <term><varname>LimitAS=</varname></term>
 295         <term><varname>LimitNPROC=</varname></term>
 296         <term><varname>LimitMEMLOCK=</varname></term>
 297         <term><varname>LimitLOCKS=</varname></term>
 298         <term><varname>LimitSIGPENDING=</varname></term>
 299         <term><varname>LimitMSGQUEUE=</varname></term>
 300         <term><varname>LimitNICE=</varname></term>
 301         <term><varname>LimitRTPRIO=</varname></term>
 302         <term><varname>LimitRTTIME=</varname></term>
 303
 304         <listitem><para>Configures various types of resource limits applied to containers. This is equivalent to the
 305         <option>--rlimit=</option> command line switch, and takes the same arguments. See
 306         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 307         details.</para></listitem>
 308       </varlistentry>
 309
 310       <varlistentry>
 311         <term><varname>OOMScoreAdjust=</varname></term>
 312
 313         <listitem><para>Configures the OOM score adjustment value. This is equivalent to the
 314         <option>--oom-score-adjust=</option> command line switch, and takes the same argument. See
 315         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 316         details.</para></listitem>
 317       </varlistentry>
 318
 319       <varlistentry>
 320         <term><varname>CPUAffinity=</varname></term>
 321
 322         <listitem><para>Configures the CPU affinity. This is equivalent to the <option>--cpu-affinity=</option> command
 323         line switch, and takes the same argument. See
 324         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 325         details.</para></listitem>
 326       </varlistentry>
 327
 328       <varlistentry>
 329         <term><varname>Hostname=</varname></term>
 330
 331         <listitem><para>Configures the kernel hostname set for the container. This is equivalent to the
 332         <option>--hostname=</option> command line switch, and takes the same argument. See
 333         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 334         details.</para></listitem>
 335       </varlistentry>
 336
 337       <varlistentry>
 338         <term><varname>ResolvConf=</varname></term>
 339
 340         <listitem><para>Configures how <filename>/etc/resolv.conf</filename> in the container shall be handled. This is
 341         equivalent to the <option>--resolv-conf=</option> command line switch, and takes the same argument. See
 342         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 343         details.</para></listitem>
 344       </varlistentry>
 345
 346       <varlistentry>
 347         <term><varname>Timezone=</varname></term>
 348
 349         <listitem><para>Configures how <filename>/etc/localtime</filename> in the container shall be handled. This is
 350         equivalent to the <option>--timezone=</option> command line switch, and takes the same argument. See
 351         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 352         details.</para></listitem>
 353       </varlistentry>
 354
 355       <varlistentry>
 356         <term><varname>LinkJournal=</varname></term>
 357
 358         <listitem><para>Configures how to link host and container journal setups. This is equivalent to the
 359         <option>--link-journal=</option> command line switch, and takes the same parameter. See
 360         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 361         details.</para></listitem>
 362       </varlistentry>
 363
 364     </variablelist>
 365   </refsect1>
 366
 367   <refsect1>
 368     <title>[Files] Section Options</title>
 369
 370     <para>Settings files may include a <literal>[Files]</literal>
 371     section, which carries various parameters configuring the file
 372     system of the container:</para>
 373
 374     <variablelist class='nspawn-directives'>
 375
 376       <varlistentry>
 377         <term><varname>ReadOnly=</varname></term>
 378
 379         <listitem><para>Takes a boolean argument, which defaults to off. If
 380         specified, the container will be run with a read-only file
 381         system. This setting corresponds to the
 382         <option>--read-only</option> command line
 383         switch.</para></listitem>
 384       </varlistentry>
 385
 386       <varlistentry>
 387         <term><varname>Volatile=</varname></term>
 388
 389         <listitem><para>Takes a boolean argument, or the special value
 390         <literal>state</literal>. This configures whether to run the
 391         container with volatile state and/or configuration. This
 392         option is equivalent to <option>--volatile=</option>, see
 393         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 394         for details about the specific options
 395         supported.</para></listitem>
 396       </varlistentry>
 397
 398       <varlistentry>
 399         <term><varname>Bind=</varname></term>
 400         <term><varname>BindReadOnly=</varname></term>
 401
 402         <listitem><para>Adds a bind mount from the host into the
 403         container. Takes a single path, a pair of two paths separated
 404         by a colon, or a triplet of two paths plus an option string
 405         separated by colons. This option may be used multiple times to
 406         configure multiple bind mounts. This option is equivalent to
 407         the command line switches <option>--bind=</option> and
 408         <option>--bind-ro=</option>, see
 409         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 410         for details about the specific options supported. This setting
 411         is privileged (see above).</para></listitem>
 412       </varlistentry>
 413
 414       <varlistentry>
 415         <term><varname>TemporaryFileSystem=</varname></term>
 416
 417         <listitem><para>Adds a <literal>tmpfs</literal> mount to the
 418         container. Takes a path or a pair of path and option string,
 419         separated by a colon. This option may be used multiple times to
 420         configure multiple <literal>tmpfs</literal> mounts. This
 421         option is equivalent to the command line switch
 422         <option>--tmpfs=</option>, see
 423         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 424         for details about the specific options supported. This setting
 425         is privileged (see above).</para></listitem>
 426       </varlistentry>
 427
 428       <varlistentry>
 429         <term><varname>Inaccessible=</varname></term>
 430
 431         <listitem><para>Masks the specified file or directly in the container, by over-mounting it with an empty file
 432         node of the same type with the most restrictive access mode. Takes a file system path as argument. This option
 433         may be used multiple times to mask multiple files or directories. This option is equivalent to the command line
 434         switch <option>--inaccessible=</option>, see
 435         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 436         about the specific options supported. This setting is privileged (see above).</para></listitem>
 437       </varlistentry>
 438
 439       <varlistentry>
 440         <term><varname>Overlay=</varname></term>
 441         <term><varname>OverlayReadOnly=</varname></term>
 442
 443         <listitem><para>Adds an overlay mount point. Takes a colon-separated list of paths.  This option may be used
 444         multiple times to configure multiple overlay mounts. This option is equivalent to the command line switches
 445         <option>--overlay=</option> and <option>--overlay-ro=</option>, see
 446         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 447         about the specific options supported. This setting is privileged (see above).</para></listitem>
 448       </varlistentry>
 449
 450       <varlistentry>
 451         <term><varname>PrivateUsersChown=</varname></term>
 452
 453         <listitem><para>Configures whether the ownership of the files and directories in the container tree shall be
 454         adjusted to the UID/GID range used, if necessary and user namespacing is enabled. This is equivalent to the
 455         <option>--private-users-chown</option> command line switch. This option is privileged (see
 456         above). </para></listitem>
 457       </varlistentry>
 458
 459     </variablelist>
 460   </refsect1>
 461
 462   <refsect1>
 463     <title>[Network] Section Options</title>
 464
 465     <para>Settings files may include a <literal>[Network]</literal>
 466     section, which carries various parameters configuring the network
 467     connectivity of the container:</para>
 468
 469     <variablelist class='nspawn-directives'>
 470
 471       <varlistentry>
 472         <term><varname>Private=</varname></term>
 473
 474         <listitem><para>Takes a boolean argument, which defaults to off. If
 475         enabled, the container will run in its own network namespace
 476         and not share network interfaces and configuration with the
 477         host. This setting corresponds to the
 478         <option>--private-network</option> command line
 479         switch.</para></listitem>
 480       </varlistentry>
 481
 482       <varlistentry>
 483         <term><varname>VirtualEthernet=</varname></term>
 484
 485         <listitem><para>Takes a boolean argument. Configures whether to create a virtual Ethernet connection
 486         (<literal>veth</literal>) between host and the container. This setting implies
 487         <varname>Private=yes</varname>. This setting corresponds to the <option>--network-veth</option> command line
 488         switch. This option is privileged (see above). This option is the default if the
 489         <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
 490       </varlistentry>
 491
 492       <varlistentry>
 493         <term><varname>VirtualEthernetExtra=</varname></term>
 494
 495         <listitem><para>Takes a colon-separated pair of interface
 496         names. Configures an additional virtual Ethernet connection
 497         (<literal>veth</literal>) between host and the container. The
 498         first specified name is the interface name on the host, the
 499         second the interface name in the container. The latter may be
 500         omitted in which case it is set to the same name as the host
 501         side interface. This setting implies
 502         <varname>Private=yes</varname>. This setting corresponds to
 503         the <option>--network-veth-extra=</option> command line
 504         switch, and maybe be used multiple times. It is independent of
 505         <varname>VirtualEthernet=</varname>. This option is privileged
 506         (see above).</para></listitem>
 507       </varlistentry>
 508
 509       <varlistentry>
 510         <term><varname>Interface=</varname></term>
 511
 512         <listitem><para>Takes a space-separated list of interfaces to
 513         add to the container. This option corresponds to the
 514         <option>--network-interface=</option> command line switch and
 515         implies <varname>Private=yes</varname>. This option is
 516         privileged (see above).</para></listitem>
 517       </varlistentry>
 518
 519       <varlistentry>
 520         <term><varname>MACVLAN=</varname></term>
 521         <term><varname>IPVLAN=</varname></term>
 522
 523         <listitem><para>Takes a space-separated list of interfaces to
 524         add MACLVAN or IPVLAN interfaces to, which are then added to
 525         the container. These options correspond to the
 526         <option>--network-macvlan=</option> and
 527         <option>--network-ipvlan=</option> command line switches and
 528         imply <varname>Private=yes</varname>. These options are
 529         privileged (see above).</para></listitem>
 530       </varlistentry>
 531
 532       <varlistentry>
 533         <term><varname>Bridge=</varname></term>
 534
 535         <listitem><para>Takes an interface name. This setting implies
 536         <varname>VirtualEthernet=yes</varname> and
 537         <varname>Private=yes</varname> and has the effect that the
 538         host side of the created virtual Ethernet link is connected to
 539         the specified bridge interface. This option corresponds to the
 540         <option>--network-bridge=</option> command line switch. This
 541         option is privileged (see above).</para></listitem>
 542       </varlistentry>
 543
 544       <varlistentry>
 545         <term><varname>Zone=</varname></term>
 546
 547         <listitem><para>Takes a network zone name. This setting implies <varname>VirtualEthernet=yes</varname> and
 548         <varname>Private=yes</varname> and has the effect that the host side of the created virtual Ethernet link is
 549         connected to an automatically managed bridge interface named after the passed argument, prefixed with
 550         <literal>vz-</literal>. This option corresponds to the <option>--network-zone=</option> command line
 551         switch. This option is privileged (see above).</para></listitem>
 552       </varlistentry>
 553
 554       <varlistentry>
 555         <term><varname>Port=</varname></term>
 556
 557         <listitem><para>Exposes a TCP or UDP port of the container on
 558         the host. This option corresponds to the
 559         <option>--port=</option> command line switch, see
 560         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 561         for the precise syntax of the argument this option takes. This
 562         option is privileged (see above).</para></listitem>
 563       </varlistentry>
 564     </variablelist>
 565   </refsect1>
 566
 567   <refsect1>
 568     <title>See Also</title>
 569     <para>
 570       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 571       <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 572       <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 573     </para>
 574   </refsect1>
 575
 576 </refentry>