systemd/units/systemd-nspawn@.service.in

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Container %i
Documentation=man:systemd-nspawn(1)
Wants=modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
PartOf=machines.target
Before=machines.target
After=network.target systemd-resolved.service modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service
RequiresMountsFor=/var/lib/machines/%i

[Service]
# Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others)
ExecStart=systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
KillMode=mixed
Type=notify
RestartForceExitStatus=133
SuccessExitStatus=133
Slice=machine.slice
Delegate=yes
TasksMax=16384
@SERVICE_WATCHDOG@

# Enforce a strict device policy, similar to the one nspawn configures when it
# allocates its own scope unit. Make sure to keep these policies in sync if you
# change them!
DevicePolicy=closed
DeviceAllow=/dev/net/tun rwm
DeviceAllow=char-pts rw

# nspawn itself needs access to /dev/loop-control and /dev/loop, to implement
# the --image= option. Add these here, too.
DeviceAllow=/dev/loop-control rw
DeviceAllow=block-loop rw
DeviceAllow=block-blkext rw

# nspawn can set up LUKS encrypted loopback files, in which case it needs
# access to /dev/mapper/control and the block devices /dev/mapper/*.
DeviceAllow=/dev/mapper/control rw
DeviceAllow=block-device-mapper rw

[Install]
WantedBy=machines.target
license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 07:23:58 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
Add SPDX license headers to unit files 2017-11-18 19:35:03 +03:00			`#`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
Don't escape the name of the container in instances of When using `%I` for instances of `systemd-nspawn@.service`, the result will be `systemd-nspawn` trying to launch a container named e.g. `fedora/23` instead of `fedora-23`. Using `%i` instead prevents escaping `-` in a container name and uses the unmodified container name from the machine store. 2016-02-26 22:35:09 +03:00			`Description=Container %i`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Documentation=man:systemd-nspawn(1)`
units: Split modprobing out into a separate service unit Devices referred to by `DeviceAllow=` sandboxing are resolved into their corresponding major numbers when the unit is loaded by looking at `/proc/devices`. If a reference is made to a device which is not yet available, the `DeviceAllow` is ignored and the unit's processes cannot access that device. In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe` in `ExecStartPre=` to load some kernel modules. Those kernel modules cause device nodes to become available when they are loaded: the device nodes may not exist when the unit itself is loaded. This means that the unit's processes will not be able to access the device since the `DeviceAllow=` will have been resolved earlier and denied it. One way to fix this would be to re-evaluate the available devices and re-apply the policy to the cgroup, but this cannot work atomically on cgroupsv1. So we fall back to a second approach: instead of running `modprobe` via `ExecStartPre`, we move this out to a separate unit and order it before the units which want the module. Closes #14322. Fixes: #13943. 2020-01-07 17:33:29 +03:00			`Wants=modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`PartOf=machines.target`
			`Before=machines.target`
units: Split modprobing out into a separate service unit Devices referred to by `DeviceAllow=` sandboxing are resolved into their corresponding major numbers when the unit is loaded by looking at `/proc/devices`. If a reference is made to a device which is not yet available, the `DeviceAllow` is ignored and the unit's processes cannot access that device. In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe` in `ExecStartPre=` to load some kernel modules. Those kernel modules cause device nodes to become available when they are loaded: the device nodes may not exist when the unit itself is loaded. This means that the unit's processes will not be able to access the device since the `DeviceAllow=` will have been resolved earlier and denied it. One way to fix this would be to re-evaluate the available devices and re-apply the policy to the cgroup, but this cannot work atomically on cgroupsv1. So we fall back to a second approach: instead of running `modprobe` via `ExecStartPre`, we move this out to a separate unit and order it before the units which want the module. Closes #14322. Fixes: #13943. 2020-01-07 17:33:29 +03:00			`After=network.target systemd-resolved.service modprobe@tun.service modprobe@loop.service modprobe@dm-mod.service`
RequireMountsFor in systemd-nspawn should wait for machine mount This patch modifies the RequireMountsFor setting in systemd-nspawn@.service to wait for the machine instance directory to be mounted, not just /var/lib/machines. Closes #14931 2020-02-24 17:54:35 +03:00			`RequiresMountsFor=/var/lib/machines/%i`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
			`[Service]`
nspawn: explicitly load units beforehand so that DeviceAllow= syntax works Yuck, but I don't see any prettier solution. Fixes: #13130 2019-07-23 14:11:09 +03:00			`# Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others)`
units: drop full paths for utilities in $PATH This makes things a bit simpler and the build a bit faster, because we don't have to rewrite files to do the trivial substitution. @rootbindir@ is always in our internal $PATH that we use for non-absolute paths, so there should be no functional change. 2019-12-18 11:14:57 +03:00			`ExecStart=systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i`
units: use KillMode=mixed for systemd-nspawn@.service This causes the container to shut down cleanly when the service is stopped. 2014-05-28 19:17:25 +04:00			`KillMode=mixed`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Type=notify`
nspawn: when running in a service unit, use systemd for restarts THis way we can remove cgroup priviliges after setup, but get them back for the next restart, as we need it. 2014-07-03 14:50:11 +04:00			`RestartForceExitStatus=133`
			`SuccessExitStatus=133`
units: make sure systemd-nspawn@.slice instances are actually located in machine.slice https://plus.google.com/112206451048767236518/posts/SYAueyXHeEX 2015-05-19 20:47:52 +03:00			`Slice=machine.slice`
core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine. 2014-11-05 19:57:23 +03:00			`Delegate=yes`
units: fix TasksMax=16384 for systemd-nspawn@.service When a container scope is allocated via machined it gets 16K set already since cf7d1a30e44bf380027a2e73f9bf13f423a33cc1. Make sure when a container is run as system service it gets the same values. 2016-07-14 13:20:29 +03:00			`TasksMax=16384`
meson: allow WatchdogSec= in services to be configured As discussed on systemd-devel [1], in Fedora we get lots of abrt reports about the watchdog firing [2], but 100% of them seem to be caused by resource starvation in the machine, and never actual deadlocks in the services being monitored. Killing the services not only does not improve anything, but it makes the resource starvation worse, because the service needs cycles to restart, and coredump processing is also fairly expensive. This adds a configuration option to allow the value to be changed. If the setting is not set, there is no change. My plan is to set it to some ridiculusly high value, maybe 1h, to catch cases where a service is actually hanging. [1] https://lists.freedesktop.org/archives/systemd-devel/2019-October/043618.html [2] https://bugzilla.redhat.com/show_bug.cgi?id=1300212 2019-10-25 13:17:24 +03:00			`@SERVICE_WATCHDOG@`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
units: include DM devices in DeviceAllow fpor systemd-nspawn@.service We need it to make LUKS devices work. Fixes: #6525 2017-08-09 19:19:00 +03:00			`# Enforce a strict device policy, similar to the one nspawn configures when it`
			`# allocates its own scope unit. Make sure to keep these policies in sync if you`
			`# change them!`
nspawn: set DevicesPolicy closed and clean up duplicated devices 2016-07-22 12:58:03 +03:00			`DevicePolicy=closed`
nspawn: make sure we install the device policy if nspawn is run as unit as on the command line 2015-04-28 21:46:03 +03:00			`DeviceAllow=/dev/net/tun rwm`
			`DeviceAllow=char-pts rw`

units: include DM devices in DeviceAllow fpor systemd-nspawn@.service We need it to make LUKS devices work. Fixes: #6525 2017-08-09 19:19:00 +03:00			`# nspawn itself needs access to /dev/loop-control and /dev/loop, to implement`
			`# the --image= option. Add these here, too.`
nspawn: fix --image= when nspawn is run as service nspawn needs access to /dev/loop to implement --image=, hence grant that in the service file. Fixes #1446. 2015-10-03 12:23:52 +03:00			`DeviceAllow=/dev/loop-control rw`
			`DeviceAllow=block-loop rw`
units: also whitelist "blkext" block devices for nspawn service /dev/loopp block devices are of the "blkext" subsystem, not of loop, hence whitelist this too. Fixes #1446 2015-10-22 01:39:57 +03:00			`DeviceAllow=block-blkext rw`
nspawn: fix --image= when nspawn is run as service nspawn needs access to /dev/loop to implement --image=, hence grant that in the service file. Fixes #1446. 2015-10-03 12:23:52 +03:00
units: include DM devices in DeviceAllow fpor systemd-nspawn@.service We need it to make LUKS devices work. Fixes: #6525 2017-08-09 19:19:00 +03:00			`# nspawn can set up LUKS encrypted loopback files, in which case it needs`
			`# access to /dev/mapper/control and the block devices /dev/mapper/*.`
			`DeviceAllow=/dev/mapper/control rw`
			`DeviceAllow=block-device-mapper rw`

units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`[Install]`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`WantedBy=machines.target`