systemd/units/systemd-nspawn@.service.in

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Container %i
Documentation=man:systemd-nspawn(1)
PartOf=machines.target
Before=machines.target
After=network.target

[Service]
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
KillMode=mixed
Type=notify
RestartForceExitStatus=133
SuccessExitStatus=133
Slice=machine.slice
Delegate=yes
TasksMax=8192

# Enforce a strict device policy, similar to the one nspawn configures
# when it allocates its own scope unit. Make sure to keep these
# policies in sync if you change them!
DevicePolicy=strict
DeviceAllow=/dev/null rwm
DeviceAllow=/dev/zero rwm
DeviceAllow=/dev/full rwm
DeviceAllow=/dev/random rwm
DeviceAllow=/dev/urandom rwm
DeviceAllow=/dev/tty rwm
DeviceAllow=/dev/net/tun rwm
DeviceAllow=/dev/pts/ptmx rw
DeviceAllow=char-pts rw
DeviceAllow=/run/systemd/inaccessible/chr rwm
DeviceAllow=/run/systemd/inaccessible/blk rwm

# nspawn itself needs access to /dev/loop-control and /dev/loop, to
# implement the --image= option. Add these here, too.
DeviceAllow=/dev/loop-control rw
DeviceAllow=block-loop rw
DeviceAllow=block-blkext rw

[Install]
WantedBy=machines.target
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
Don't escape the name of the container in instances of When using `%I` for instances of `systemd-nspawn@.service`, the result will be `systemd-nspawn` trying to launch a container named e.g. `fedora/23` instead of `fedora-23`. Using `%i` instead prevents escaping `-` in a container name and uses the unmodified container name from the machine store. 2016-02-26 22:35:09 +03:00			`Description=Container %i`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Documentation=man:systemd-nspawn(1)`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`PartOf=machines.target`
			`Before=machines.target`
units: order nspawn containers after network.target This way we know that any bridges and other user-created network devices are in place, and can be properly added to the container. In the long run this should be dropped, and replaced by direct calls inside nspawn that cause the devices to be created when necessary. 2015-05-11 23:08:28 +03:00			`After=network.target`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
			`[Service]`
units: turn on user namespace by default in systemd-nspawn@.service Now that user namespacing is supported in a pretty automatic way, actually turn it on by default if the systemd-nspawn@.service template is used. 2016-04-22 15:12:27 +03:00			`ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i`
units: use KillMode=mixed for systemd-nspawn@.service This causes the container to shut down cleanly when the service is stopped. 2014-05-28 19:17:25 +04:00			`KillMode=mixed`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Type=notify`
nspawn: when running in a service unit, use systemd for restarts THis way we can remove cgroup priviliges after setup, but get them back for the next restart, as we need it. 2014-07-03 14:50:11 +04:00			`RestartForceExitStatus=133`
			`SuccessExitStatus=133`
units: make sure systemd-nspawn@.slice instances are actually located in machine.slice https://plus.google.com/112206451048767236518/posts/SYAueyXHeEX 2015-05-19 20:47:52 +03:00			`Slice=machine.slice`
core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine. 2014-11-05 19:57:23 +03:00			`Delegate=yes`
nspawn: set TasksMax= for containers to 8192 by default 2015-11-13 21:38:40 +03:00			`TasksMax=8192`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
nspawn: make sure we install the device policy if nspawn is run as unit as on the command line 2015-04-28 21:46:03 +03:00			`# Enforce a strict device policy, similar to the one nspawn configures`
			`# when it allocates its own scope unit. Make sure to keep these`
			`# policies in sync if you change them!`
			`DevicePolicy=strict`
			`DeviceAllow=/dev/null rwm`
			`DeviceAllow=/dev/zero rwm`
			`DeviceAllow=/dev/full rwm`
			`DeviceAllow=/dev/random rwm`
			`DeviceAllow=/dev/urandom rwm`
			`DeviceAllow=/dev/tty rwm`
			`DeviceAllow=/dev/net/tun rwm`
			`DeviceAllow=/dev/pts/ptmx rw`
			`DeviceAllow=char-pts rw`
nspawn: enable major=0/minor=0 devices inside the container (#3773) https://github.com/systemd/systemd/pull/3685 introduced /run/systemd/inaccessible/{chr,blk} to map inacessible devices, this patch allows systemd running inside a nspawn container to create /run/systemd/inaccessible/{chr,blk}. 2016-07-21 18:39:38 +03:00			`DeviceAllow=/run/systemd/inaccessible/chr rwm`
			`DeviceAllow=/run/systemd/inaccessible/blk rwm`
nspawn: make sure we install the device policy if nspawn is run as unit as on the command line 2015-04-28 21:46:03 +03:00
nspawn: fix --image= when nspawn is run as service nspawn needs access to /dev/loop to implement --image=, hence grant that in the service file. Fixes #1446. 2015-10-03 12:23:52 +03:00			`# nspawn itself needs access to /dev/loop-control and /dev/loop, to`
			`# implement the --image= option. Add these here, too.`
			`DeviceAllow=/dev/loop-control rw`
			`DeviceAllow=block-loop rw`
units: also whitelist "blkext" block devices for nspawn service /dev/loopp block devices are of the "blkext" subsystem, not of loop, hence whitelist this too. Fixes #1446 2015-10-22 01:39:57 +03:00			`DeviceAllow=block-blkext rw`
nspawn: fix --image= when nspawn is run as service nspawn needs access to /dev/loop to implement --image=, hence grant that in the service file. Fixes #1446. 2015-10-03 12:23:52 +03:00
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`[Install]`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`WantedBy=machines.target`