summaryrefslogtreecommitdiff
path: root/man
diff options
context:
space:
mode:
Diffstat (limited to 'man')
-rw-r--r--man/systemd-nspawn.xml36
1 files changed, 36 insertions, 0 deletions
diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index 3a2af2711c..6a5db86cec 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -321,6 +321,42 @@
</varlistentry>
<varlistentry>
+ <term><option>--private-users=</option></term>
+
+ <listitem><para>Enables user namespacing. If enabled the
+ container will run with its own private set of Unix user and
+ group ids (UIDs and GIDs). Takes none, one or two
+ colon-separated parameters: the first parameter specifies the
+ first host UID to assign to the container, the second
+ parameter specifies the number of host UIDs to assign to the
+ container. If the second parameter is omitted, 65536 UIDs are
+ assigned. If the first parameter is also ommitted (and hence
+ no parameter passed at all), the first UID assigned to the
+ container is read from the owner of the root directory of the
+ container's directory tree. By default no user namespacing is
+ applied.</para>
+
+ <para>Note that user namespacing currently requires OS trees
+ that are prepared for the UID shift that is being applied:
+ UIDs and GIDs used for file ownership or in file ACL entries
+ must be shifted to the container UID base that is
+ used during container runtime.</para>
+
+ <para>It is recommended to assign as least 65536 UIDs to each
+ container, so that the usable UID range in the container
+ covers 16bit. For best security do not assign overlapping UID
+ ranges to multiple containers. It is hence a good idea to use
+ the upper 16bit of the host 32bit UIDs as container
+ identifier, while the lower 16bit encode the container UID
+ used.</para>
+
+ <para>When user namespaces are used the GID range assigned to
+ each container is always chosen identical to the UID
+ range.</para></listitem>
+ </varlistentry>
+
+
+ <varlistentry>
<term><option>--private-network</option></term>
<listitem><para>Disconnect networking of the container from