systemd/units/systemd-nspawn@.service.in

#  SPDX-License-Identifier: LGPL-2.1+
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Container %i
Documentation=man:systemd-nspawn(1)
PartOf=machines.target
Before=machines.target
After=network.target systemd-resolved.service
RequiresMountsFor=/var/lib/machines

[Service]
ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
KillMode=mixed
Type=notify
RestartForceExitStatus=133
SuccessExitStatus=133
WatchdogSec=3min
Slice=machine.slice
Delegate=yes
TasksMax=16384

# Enforce a strict device policy, similar to the one nspawn configures when it
# allocates its own scope unit. Make sure to keep these policies in sync if you
# change them!
DevicePolicy=closed
DeviceAllow=/dev/net/tun rwm
DeviceAllow=char-pts rw

# nspawn itself needs access to /dev/loop-control and /dev/loop, to implement
# the --image= option. Add these here, too.
DeviceAllow=/dev/loop-control rw
DeviceAllow=block-loop rw
DeviceAllow=block-blkext rw

# nspawn can set up LUKS encrypted loopback files, in which case it needs
# access to /dev/mapper/control and the block devices /dev/mapper/*.
DeviceAllow=/dev/mapper/control rw
DeviceAllow=block-device-mapper rw

[Install]
WantedBy=machines.target
Add SPDX license headers to unit files 2017-11-18 19:35:03 +03:00			`# SPDX-License-Identifier: LGPL-2.1+`
			`#`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
Don't escape the name of the container in instances of When using `%I` for instances of `systemd-nspawn@.service`, the result will be `systemd-nspawn` trying to launch a container named e.g. `fedora/23` instead of `fedora-23`. Using `%i` instead prevents escaping `-` in a container name and uses the unmodified container name from the machine store. 2016-02-26 22:35:09 +03:00			`Description=Container %i`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Documentation=man:systemd-nspawn(1)`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`PartOf=machines.target`
			`Before=machines.target`
units: order systemd-nspawn@.service after systemd-resolved.service This way, the nspawn internal check whether resolved is running will succeed if it is enabled. Fixes: #4649 2017-02-16 19:57:30 +03:00			`After=network.target systemd-resolved.service`
systemd-nspawn@.service: start after /var/lib/machines is mounted (#6079) This fixes a race condition during boot, where an nspawn container would start before /var/lib/machines got mounted resulting in a failure. 2017-06-06 18:18:22 +03:00			`RequiresMountsFor=/var/lib/machines`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
			`[Service]`
units: turn on user namespace by default in systemd-nspawn@.service Now that user namespacing is supported in a pretty automatic way, actually turn it on by default if the systemd-nspawn@.service template is used. 2016-04-22 15:12:27 +03:00			`ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i`
units: use KillMode=mixed for systemd-nspawn@.service This causes the container to shut down cleanly when the service is stopped. 2014-05-28 19:17:25 +04:00			`KillMode=mixed`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`Type=notify`
nspawn: when running in a service unit, use systemd for restarts THis way we can remove cgroup priviliges after setup, but get them back for the next restart, as we need it. 2014-07-03 14:50:11 +04:00			`RestartForceExitStatus=133`
			`SuccessExitStatus=133`
nspawn: turn on watchdog logic for nspawn too It's a long-running daemon, and it's easy to enable, hence do it. 2017-12-07 13:58:25 +03:00			`WatchdogSec=3min`
units: make sure systemd-nspawn@.slice instances are actually located in machine.slice https://plus.google.com/112206451048767236518/posts/SYAueyXHeEX 2015-05-19 20:47:52 +03:00			`Slice=machine.slice`
core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies For priviliged units this resource control property ensures that the processes have all controllers systemd manages enabled. For unpriviliged services (those with User= set) this ensures that access rights to the service cgroup is granted to the user in question, to create further subgroups. Note that this only applies to the name=systemd hierarchy though, as access to other controllers is not safe for unpriviliged processes. Delegate=yes should be set for container scopes where a systemd instance inside the container shall manage the hierarchies below its own cgroup and have access to all controllers. Delegate=yes should also be set for user@.service, so that systemd --user can run, controlling its own cgroup tree. This commit changes machined, systemd-nspawn@.service and user@.service to set this boolean, in order to ensure that container management will just work, and the user systemd instance can run fine. 2014-11-05 19:57:23 +03:00			`Delegate=yes`
units: fix TasksMax=16384 for systemd-nspawn@.service When a container scope is allocated via machined it gets 16K set already since cf7d1a30e44bf380027a2e73f9bf13f423a33cc1. Make sure when a container is run as system service it gets the same values. 2016-07-14 13:20:29 +03:00			`TasksMax=16384`
units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00
units: include DM devices in DeviceAllow fpor systemd-nspawn@.service We need it to make LUKS devices work. Fixes: #6525 2017-08-09 19:19:00 +03:00			`# Enforce a strict device policy, similar to the one nspawn configures when it`
			`# allocates its own scope unit. Make sure to keep these policies in sync if you`
			`# change them!`
nspawn: set DevicesPolicy closed and clean up duplicated devices 2016-07-22 12:58:03 +03:00			`DevicePolicy=closed`
nspawn: make sure we install the device policy if nspawn is run as unit as on the command line 2015-04-28 21:46:03 +03:00			`DeviceAllow=/dev/net/tun rwm`
			`DeviceAllow=char-pts rw`

units: include DM devices in DeviceAllow fpor systemd-nspawn@.service We need it to make LUKS devices work. Fixes: #6525 2017-08-09 19:19:00 +03:00			`# nspawn itself needs access to /dev/loop-control and /dev/loop, to implement`
			`# the --image= option. Add these here, too.`
nspawn: fix --image= when nspawn is run as service nspawn needs access to /dev/loop to implement --image=, hence grant that in the service file. Fixes #1446. 2015-10-03 12:23:52 +03:00			`DeviceAllow=/dev/loop-control rw`
			`DeviceAllow=block-loop rw`
units: also whitelist "blkext" block devices for nspawn service /dev/loopp block devices are of the "blkext" subsystem, not of loop, hence whitelist this too. Fixes #1446 2015-10-22 01:39:57 +03:00			`DeviceAllow=block-blkext rw`
nspawn: fix --image= when nspawn is run as service nspawn needs access to /dev/loop to implement --image=, hence grant that in the service file. Fixes #1446. 2015-10-03 12:23:52 +03:00
units: include DM devices in DeviceAllow fpor systemd-nspawn@.service We need it to make LUKS devices work. Fixes: #6525 2017-08-09 19:19:00 +03:00			`# nspawn can set up LUKS encrypted loopback files, in which case it needs`
			`# access to /dev/mapper/control and the block devices /dev/mapper/*.`
			`DeviceAllow=/dev/mapper/control rw`
			`DeviceAllow=block-device-mapper rw`

units: add an easy-to-use unit template file systemd-nspawn@.service for running containers as system services 2013-04-30 04:11:37 +04:00			`[Install]`
units: rework systemd-nspawn@.service unit - Unescape instance name so that we can take almost anything as instance name. - Introduce "machines.target" which consists of all enabled nspawns and can be used to start/stop them altogether - Look for container directory using -M instead of harcoding the path in /var/lib/container 2014-12-29 14:38:26 +03:00			`WantedBy=machines.target`