From 47f6145c47fb9588cc562beb4cb9300f41e5c719 Mon Sep 17 00:00:00 2001 From: Luke Shumaker Date: Sat, 20 May 2017 20:13:09 -0400 Subject: systemd-nspawn: Improve documentation. The `--help` text lies about what the `-U` flag does, and under-documents the `--private-users` values. Fix that. The man page is a bit vague about the `--keep-unit` option. Don't entirely fix it, but at least clarify the mechanics a bit. --- src/systemd-nspawn/nspawn.c | 8 ++++++-- src/systemd-nspawn/systemd-nspawn.xml | 7 +++++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/src/systemd-nspawn/nspawn.c b/src/systemd-nspawn/nspawn.c index 25376d0b28..5f5e21c0f4 100644 --- a/src/systemd-nspawn/nspawn.c +++ b/src/systemd-nspawn/nspawn.c @@ -217,9 +217,13 @@ static void help(void) { " --uuid=UUID Set a specific machine UUID for the container\n" " -S --slice=SLICE Place the container in the specified slice\n" " --property=NAME=VALUE Set scope unit property\n" - " -U --private-users=pick Run within user namespace, autoselect UID/GID range\n" - " --private-users[=UIDBASE[:NUIDS]]\n" + " --private-users[=yes] Run within user namespace, detect UID/GID range\n" + " --private-users=UIDBASE[:NUIDS]\n" " Similar, but with user configured UID/GID range\n" + " --private-users=pick Similar, but autoselect an unused UID/GID range,\n" + " implies --private-users-chown" + " -U If the kernel supports the user namespaces feature,\n" + " equivalent to --private-users=pick; otherwise ignored\n" " --private-users-chown Adjust OS tree ownership to private UID/GID range\n" " --private-network Disable network in container\n" " --network-interface=INTERFACE\n" diff --git a/src/systemd-nspawn/systemd-nspawn.xml b/src/systemd-nspawn/systemd-nspawn.xml index c449edee89..0019f948b1 100644 --- a/src/systemd-nspawn/systemd-nspawn.xml +++ b/src/systemd-nspawn/systemd-nspawn.xml @@ -881,8 +881,11 @@ systemd-nspawn is invoked from within a service unit, and the service unit's sole purpose is to run a single systemd-nspawn container. This - option is not available if run from a user - session. + option is not available if run from a user session. If using + the cgroup v2 unified hierarchy, this assumes that + systemd-nspawn has the control group all to + itself; that it is the only process in the + group. -- cgit v1.2.3