shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 23:51:28 +03:00
Code
9b1cbdc6e1
systemd/units/systemd-nspawn@.service.in

40 lines
1.1 KiB
SYSTEMD
Raw Normal View History

units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services
2013-04-30 04:11:37 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container
2014-12-29 14:38:26 +03:00
Description=Container %I
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services
2013-04-30 04:11:37 +04:00
Documentation=man:systemd-nspawn(1)
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container
2014-12-29 14:38:26 +03:00
PartOf=machines.target
Before=machines.target
units: order nspawn containers after network.target This way we know that any bridges and other user-created network devices are in place, and can be properly added to the container. In the long run this should be dropped, and replaced by direct calls inside nspawn that cause the devices to be created when necessary.
2015-05-11 23:08:28 +03:00
After=network.target
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services
2013-04-30 04:11:37 +04:00
[Service]
units: turn on --network-veth by default for systemd-nspawn@.service Given the recent improvements in networkd, it's probably the better default now.
2015-02-13 16:35:50 +03:00
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth --machine=%I
units: use KillMode=mixed for systemd-nspawn@.service This causes the container to shut down cleanly when the service is stopped.
2014-05-28 19:17:25 +04:00
KillMode=mixed
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services
2013-04-30 04:11:37 +04:00
Type=notify
nspawn: when running in a service unit, use systemd for restarts THis way we can remove cgroup priviliges after setup, but get them back for the next restart, as we need it.
2014-07-03 14:50:11 +04:00
RestartForceExitStatus=133
SuccessExitStatus=133
units: make sure systemd-nspawn@.slice instances are actually located in machine.slice https://plus.google.com/112206451048767236518/posts/SYAueyXHeEX
2015-05-19 20:47:52 +03:00
Slice=machine.slice
core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine.
2014-11-05 19:57:23 +03:00
Delegate=yes
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services
2013-04-30 04:11:37 +04:00
nspawn: make sure we install the device policy if nspawn is run as unit as on the command line
2015-04-28 21:46:03 +03:00
# Enforce a strict device policy, similar to the one nspawn configures
# when it allocates its own scope unit. Make sure to keep these
# policies in sync if you change them!
DevicePolicy=strict
DeviceAllow=/dev/null rwm
DeviceAllow=/dev/zero rwm
DeviceAllow=/dev/full rwm
DeviceAllow=/dev/random rwm
DeviceAllow=/dev/urandom rwm
DeviceAllow=/dev/tty rwm
DeviceAllow=/dev/net/tun rwm
DeviceAllow=/dev/pts/ptmx rw
DeviceAllow=char-pts rw
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services
2013-04-30 04:11:37 +04:00
[Install]
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container
2014-12-29 14:38:26 +03:00
WantedBy=machines.target
Copy Permalink