nspawn: finish user namespace support

1 files changed, 36 insertions, 0 deletions

diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 3a2af2711c..6a5db86cec 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -321,6 +321,42 @@
       </varlistentry>
 
       <varlistentry>
+        <term><option>--private-users=</option></term>
+
+        <listitem><para>Enables user namespacing. If enabled the
+        container will run with its own private set of Unix user and
+        group ids (UIDs and GIDs). Takes none, one or two
+        colon-separated parameters: the first parameter specifies the
+        first host UID to assign to the container, the second
+        parameter specifies the number of host UIDs to assign to the
+        container. If the second parameter is omitted, 65536 UIDs are
+        assigned. If the first parameter is also ommitted (and hence
+        no parameter passed at all), the first UID assigned to the
+        container is read from the owner of the root directory of the
+        container's directory tree. By default no user namespacing is
+        applied.</para>
+
+        <para>Note that user namespacing currently requires OS trees
+        that are prepared for the UID shift that is being applied:
+        UIDs and GIDs used for file ownership or in file ACL entries
+        must be shifted to the container UID base that is
+        used during container runtime.</para>
+
+        <para>It is recommended to assign as least 65536 UIDs to each
+        container, so that the usable UID range in the container
+        covers 16bit. For best security do not assign overlapping UID
+        ranges to multiple containers. It is hence a good idea to use
+        the upper 16bit of the host 32bit UIDs as container
+        identifier, while the lower 16bit encode the container UID
+        used.</para>
+
+        <para>When user namespaces are used the GID range assigned to
+        each container is always chosen identical to the UID
+        range.</para></listitem>
+      </varlistentry>
+
+
+      <varlistentry>
         <term><option>--private-network</option></term>
 
         <listitem><para>Disconnect networking of the container from