systemd/units/systemd-nspawn@.service.in

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Container %I
Documentation=man:systemd-nspawn(1)
PartOf=machines.target
Before=machines.target
After=network.target

[Service]
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth --machine=%I
KillMode=mixed
Type=notify
RestartForceExitStatus=133
SuccessExitStatus=133
Delegate=yes

# Enforce a strict device policy, similar to the one nspawn configures
# when it allocates its own scope unit. Make sure to keep these
# policies in sync if you change them!
DevicePolicy=strict
DeviceAllow=/dev/null rwm
DeviceAllow=/dev/zero rwm
DeviceAllow=/dev/full rwm
DeviceAllow=/dev/random rwm
DeviceAllow=/dev/urandom rwm
DeviceAllow=/dev/tty rwm
DeviceAllow=/dev/net/tun rwm
DeviceAllow=/dev/pts/ptmx rw
DeviceAllow=char-pts rw

[Install]
WantedBy=machines.target
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`Description=Container %I`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Documentation=man:systemd-nspawn(1)`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`PartOf=machines.target`
			`Before=machines.target`
units: order nspawn containers after network.target This way we know that any bridges and other user-created network devices are in place, and can be properly added to the container. In the long run this should be dropped, and replaced by direct calls inside nspawn that cause the devices to be created when necessary. 2015-05-11 23:08:28 +03:00			`After=network.target`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
			`[Service]`
units: turn on --network-veth by default for systemd-nspawn@.service Given the recent improvements in networkd, it's probably the better default now. 2015-02-13 16:35:50 +03:00			`ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth --machine=%I`
units: use KillMode=mixed for systemd-nspawn@.service This causes the container to shut down cleanly when the service is stopped. 2014-05-28 19:17:25 +04:00			`KillMode=mixed`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Type=notify`
nspawn: when running in a service unit, use systemd for restarts THis way we can remove cgroup priviliges after setup, but get them back for the next restart, as we need it. 2014-07-03 14:50:11 +04:00			`RestartForceExitStatus=133`
			`SuccessExitStatus=133`
core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine. 2014-11-05 19:57:23 +03:00			`Delegate=yes`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
nspawn: make sure we install the device policy if nspawn is run as unit as on the command line 2015-04-28 21:46:03 +03:00			`# Enforce a strict device policy, similar to the one nspawn configures`
			`# when it allocates its own scope unit. Make sure to keep these`
			`# policies in sync if you change them!`
			`DevicePolicy=strict`
			`DeviceAllow=/dev/null rwm`
			`DeviceAllow=/dev/zero rwm`
			`DeviceAllow=/dev/full rwm`
			`DeviceAllow=/dev/random rwm`
			`DeviceAllow=/dev/urandom rwm`
			`DeviceAllow=/dev/tty rwm`
			`DeviceAllow=/dev/net/tun rwm`
			`DeviceAllow=/dev/pts/ptmx rw`
			`DeviceAllow=char-pts rw`

units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`[Install]`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`WantedBy=machines.target`