Skip to content

Commit f757855

Browse files
poetteringpoettering
committed
nspawn: add new .nspawn files for container settings
.nspawn fiels are simple settings files that may accompany container images and directories and contain settings otherwise passed on the nspawn command line. This provides an efficient way to attach execution data directly to containers.
1 parent 5f430ff commit f757855

17 files changed

+1544
-299
lines changed

‎Makefile-man.am‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ MANPAGES += \
130130
man/systemd.kill.5 \
131131
man/systemd.link.5 \
132132
man/systemd.mount.5 \
133+
man/systemd.nspawn.5 \
133134
man/systemd.path.5 \
134135
man/systemd.preset.5 \
135136
man/systemd.resource-control.5 \
@@ -2382,6 +2383,7 @@ EXTRA_DIST += \
23822383
man/systemd.mount.xml \
23832384
man/systemd.netdev.xml \
23842385
man/systemd.network.xml \
2386+
man/systemd.nspawn.xml \
23852387
man/systemd.path.xml \
23862388
man/systemd.preset.xml \
23872389
man/systemd.resource-control.xml \

‎Makefile.am‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ noinst_PROGRAMS =
155155
TESTS =
156156
endif
157157
udevlibexec_PROGRAMS =
158+
gperf_gperf_sources =
158159

159160
in_files = $(filter %.in,$(EXTRA_DIST))
160161
in_in_files = $(filter %.in.in, $(in_files))
@@ -220,6 +221,7 @@ AM_CPPFLAGS = \
220221
-I $(top_builddir)/src/journal \
221222
-I $(top_srcdir)/src/timedate \
222223
-I $(top_srcdir)/src/timesync \
224+
-I $(top_srcdir)/src/nspawn \
223225
-I $(top_srcdir)/src/resolve \
224226
-I $(top_builddir)/src/resolve \
225227
-I $(top_srcdir)/src/systemd \
@@ -2776,11 +2778,20 @@ systemd_cgtop_LDADD = \
27762778
# ------------------------------------------------------------------------------
27772779
systemd_nspawn_SOURCES = \
27782780
src/nspawn/nspawn.c \
2781+
src/nspawn/nspawn.h \
2782+
src/nspawn/nspawn-settings.c \
2783+
src/nspawn/nspawn-settings.h \
27792784
src/core/mount-setup.c \
27802785
src/core/mount-setup.h \
27812786
src/core/loopback-setup.c \
27822787
src/core/loopback-setup.h
27832788

2789+
nodist_systemd_nspawn_SOURCES = \
2790+
src/nspawn/nspawn-gperf.c
2791+
2792+
gperf_gperf_sources += \
2793+
src/nspawn/nspawn-gperf.gperf
2794+
27842795
systemd_nspawn_CFLAGS = \
27852796
$(AM_CFLAGS) \
27862797
$(BLKID_CFLAGS) \
@@ -3486,7 +3497,7 @@ nodist_libudev_core_la_SOURCES = \
34863497
src/udev/keyboard-keys-to-name.h \
34873498
src/udev/net/link-config-gperf.c
34883499

3489-
gperf_gperf_sources = \
3500+
gperf_gperf_sources += \
34903501
src/udev/net/link-config-gperf.gperf
34913502

34923503
libudev_core_la_CFLAGS = \

‎man/systemd-nspawn.xml‎

Lines changed: 60 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<?xml version='1.0'?> <!--*-nxml-*-->
1+
<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
22
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
33
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
44

@@ -748,34 +748,86 @@
748748
</varlistentry>
749749

750750
<varlistentry>
751-
<term><option>--volatile</option><replaceable>=MODE</replaceable></term>
751+
<term><option>--volatile</option></term>
752+
<term><option>--volatile=</option><replaceable>MODE</replaceable></term>
752753

753754
<listitem><para>Boots the container in volatile mode. When no
754755
mode parameter is passed or when mode is specified as
755-
<literal>yes</literal> full volatile mode is enabled. This
756+
<option>yes</option> full volatile mode is enabled. This
756757
means the root directory is mounted as mostly unpopulated
757758
<literal>tmpfs</literal> instance, and
758759
<filename>/usr</filename> from the OS tree is mounted into it,
759760
read-only (the system thus starts up with read-only OS
760761
resources, but pristine state and configuration, any changes
761762
to the either are lost on shutdown). When the mode parameter
762-
is specified as <literal>state</literal> the OS tree is
763+
is specified as <option>state</option> the OS tree is
763764
mounted read-only, but <filename>/var</filename> is mounted as
764765
<literal>tmpfs</literal> instance into it (the system thus
765766
starts up with read-only OS resources and configuration, but
766767
pristine state, any changes to the latter are lost on
767768
shutdown). When the mode parameter is specified as
768-
<literal>no</literal> (the default) the whole OS tree is made
769+
<option>no</option> (the default) the whole OS tree is made
769770
available writable.</para>
770771

771-
<para>Note that setting this to <literal>yes</literal> or
772-
<literal>state</literal> will only work correctly with
772+
<para>Note that setting this to <option>yes</option> or
773+
<option>state</option> will only work correctly with
773774
operating systems in the container that can boot up with only
774775
<filename>/usr</filename> mounted, and are able to populate
775776
<filename>/var</filename> automatically, as
776777
needed.</para></listitem>
777778
</varlistentry>
778779

780+
<varlistentry>
781+
<term><option>--settings=</option><replaceable>MODE</replaceable></term>
782+
783+
<listitem><para>Controls whether
784+
<command>systemd-nspawn</command> shall search for and use
785+
additional per-container settings from
786+
<filename>.nspawn</filename> files. Takes a boolean or the
787+
special values <option>override</option> or
788+
<option>trusted</option>.</para>
789+
790+
<para>If enabled (the default) a settings file named after the
791+
machine (as specified with the <option>--machine=</option>
792+
setting, or derived from the directory or image file name)
793+
with the suffix <filename>.nspawn</filename> is searched in
794+
<filename>/etc/systemd/nspawn/</filename> and
795+
<filename>/run/systemd/nspawn/</filename>. If it is found
796+
there, its settings are read and used. If it is not found
797+
there it is subequently searched in the same directory as the
798+
image file or in the immediate parent of the root directory of
799+
the container. In this case, if the file is found its settings
800+
will be also read and used, but potentially unsafe settings
801+
are ignored. Note that in both these cases settings on the
802+
command line take precendence over the corresponding settings
803+
from loaded <filename>.nspawn</filename> files, if both are
804+
specified. Unsafe settings are considered all settings that
805+
elevate the container's privileges or grant access to
806+
additional resources such as files or directories of the
807+
host. For details about the format and contents of
808+
<filename>.nspawn</filename> files consult
809+
<citerefentry><refentrytitle>systemd.nspawn</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
810+
811+
<para>If this option is set to <option>override</option> the
812+
file is searched, read and used the same way, however the order of
813+
precedence is reversed: settings read from the
814+
<filename>.nspawn</filename> file will take precedence over
815+
the corresponding command line options, if both are
816+
specified.</para>
817+
818+
<para>If this option is set to <option>trusted</option> the
819+
file is searched, read and used the same way, but regardless
820+
if found in <filename>/etc/systemd/nspawn/</filename>,
821+
<filename>/run/systemd/nspawn/</filename> or next to the image
822+
file or container root directory, all settings will take
823+
effect, however command line arguments still take precedence
824+
over corresponding settings.</para>
825+
826+
<para>If disabled no <filename>.nspawn</filename> file is read
827+
and no settings except the ones on the command line are in
828+
effect.</para></listitem>
829+
</varlistentry>
830+
779831
<xi:include href="standard-options.xml" xpointer="help" />
780832
<xi:include href="standard-options.xml" xpointer="version" />
781833
</variablelist>
@@ -859,6 +911,7 @@
859911
<title>See Also</title>
860912
<para>
861913
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
914+
<citerefentry><refentrytitle>systemd.nspawn</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
862915
<citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
863916
<citerefentry project='mankier'><refentrytitle>dnf</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
864917
<citerefentry project='die-net'><refentrytitle>yum</refentrytitle><manvolnum>8</manvolnum></citerefentry>,

0 commit comments

Comments
 (0)