systemd-nspawn — Spawn a namespace container for debugging, testing and building
systemd-nspawn [OPTIONS...] [COMMAND] [ARGS...]
systemd-nspawn may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to chroot(1), but more powerful since it fully virtualizes the file system hierarchy, as well as the process tree, the various IPC subsystems and the host and domain name.
systemd-nspawn limits access
to various kernel interfaces in the container to
read-only, such as /sys
,
/proc/sys
or
/sys/fs/selinux
. Network
interfaces and the system clock may not be changed
from within the container. Device nodes may not be
created. The host system cannot be rebooted and kernel
modules may not be loaded from within the
container.
Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security features may be circumvented and are hence primarily useful to avoid accidental changes to the host system from the container. The intended use of this program is debugging and testing as well as building of packages, distributions and software involved with boot and systems management.
In contrast to chroot(1) systemd-nspawn may be used to boot full Linux-based operating systems in a container.
Use a tool like yum(8) or debootstrap(8) to set up an OS directory tree suitable as file system hierarchy for systemd-nspawn containers.
Note that systemd-nspawn will
mount file systems private to the container to
/dev
,
/run
and similar. These will
not be visible outside of the container, and their
contents will be lost when the container exits.
Note that running two systemd-nspawn containers from the same directory tree will not make processes in them see each other. The PID namespace separation of the two containers is complete and the containers will share very few runtime objects except for the underlying file system.
systemd-nspawn implements the Container Interface specification.
If no arguments are passed the container is set up and a shell started in it, otherwise the passed command and arguments are executed in it. The following options are understood:
--help
, -h
Prints a short help text and exits.
--directory=
, -D
Directory to use as file system root for the namespace container. If omitted the current directory will be used.
--boot
, -b
Automatically search for an init binary and invoke it instead of a shell or a user supplied program.
--user=
, -u
Run the command under specified user, create home directory and cd into it. As rest of systemd-nspawn, this is not the security feature and limits against accidental changes only.
--uuid=
Set the specified uuid
for the container. The init system
will initialize
/etc/machine-id
from this if this file is not set yet.
--controllers=
, -C
Makes the container appear in other hierarchies than the name=systemd:/ one. Takes a comma-separated list of controllers.
--private-network
Turn off networking in the container. This makes all network interfaces unavailable in the container, with the exception of the loopback device.
--read-only
Mount the root file system read only for the container.
--capability=
List one or more additional capabilities to grant the container. Takes a comma separated list of capability names, see capabilities(7) for more information. Note that the following capabilities will be granted in any way: CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_FSETID, CAP_IPC_OWNER, CAP_KILL, CAP_LEASE, CAP_LINUX_IMMUTABLE, CAP_NET_BIND_SERVICE, CAP_NET_BROADCAST, CAP_NET_RAW, CAP_SETGID, CAP_SETFCAP, CAP_SETPCAP, CAP_SETUID, CAP_SYS_ADMIN, CAP_SYS_CHROOT, CAP_SYS_NICE, CAP_SYS_PTRACE, CAP_SYS_TTY_CONFIG, CAP_SYS_RESOURCE, CAP_SYS_BOOT.
--link-journal=
Control whether the
container's journal shall be made
visible to the host system. If enabled
allows viewing the container's journal
files from the host (but not vice
versa). Takes one of
no
,
host
,
guest
,
auto
. If
no
, the journal is
not linked. If host
,
the journal files are stored on the
host file system (beneath
/var/log/journal/<machine-id>
)
and the subdirectory is bind-mounted
into the container at the same
location. If guest
,
the journal files are stored on the
guest file system (beneath
/var/log/journal/<machine-id>
)
and the subdirectory is symlinked into the host
at the same location. If
auto
(the default),
and the right subdirectory of
/var/log/journal
exists, it will be bind mounted
into the container. If the
subdirectory doesn't exist, no
linking is performed. Effectively,
booting a container once with
guest
or
host
will link the
journal persistently if further on
the default of auto
is used.
-j
Equivalent to
--link-journal=guest
.
# yum --releasever=17 --nogpgcheck --installroot ~/fedora-tree/ install yum passwd vim-minimal rootfiles systemd # systemd-nspawn -D ~/fedora-tree /usr/lib/systemd/systemd
This installs a minimal Fedora distribution into
the directory ~/fedora-tree/
and then boots an OS in a namespace container in it,
with systemd as init system.