shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-02-02 13:47:27 +03:00
Code

doc: document new /run/host/ inodes in container interface doc

Browse Source
This commit is contained in:
Lennart Poettering 2024-01-05 18:34:01 +01:00
parent 613fb4b601
commit 62b3e5fd41
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
docs/CONTAINER_INTERFACE.md
View File

@ -273,6 +273,30 @@ care should be taken to avoid naming conflicts. `systemd` (and in particular
7. The `/run/host/credentials/` directory is a good place to pass credentials 7. The `/run/host/credentials/` directory is a good place to pass credentials
into the container, using the `$CREDENTIALS_DIRECTORY` protocol, see above. into the container, using the `$CREDENTIALS_DIRECTORY` protocol, see above.
8. The `/run/host/unix-export/` directory shall be writable from the container
payload, and is where container payload can bind `AF_UNIX` sockets in that
shall be *exported* to the host, so that the host can connect to them. The
container manager should bind mount this directory on the host side
(read-only ideally), so that the host can connect to contained sockets. This
is most prominently used by `systemd-ssh-generator` when run in such a
container to automatically bind an SSH socket into that directory, which
then can be used to connect to the container.
9. The `/run/host/unix-export/ssh` `AF_UNIX` socket will be automatically bound
by `systemd-ssh-generator` in the container if possible, and can be used to
connect to the container.
10. The `/run/host/userdb/` directory may be used to drop-in additional JSON
user records that `nss-systemd` inside the container shall include in the
system's user database. This is useful to make host users and their home
directories automatically accessible to containers in transitive
fashion. See `nss-systemd(8)` for details.
11. The `/run/host/home/` directory may be used to bind mount host home
directories of users that shall be made available in the container to. This
may be used in combination with `/run/host/userdb/` above: one defines the
user record, the other contains the user's home directory.
## What You Shouldn't Do ## What You Shouldn't Do
1. Do not drop `CAP_MKNOD` from the container. `PrivateDevices=` is a commonly 1. Do not drop `CAP_MKNOD` from the container. `PrivateDevices=` is a commonly