systemd-nspawn — Spawn a namespace container for debugging, testing and building
systemd-nspawn [OPTIONS...] [COMMAND] [ARGS...]
systemd-nspawn may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to chroot(1), but more powerful since it fully virtualizes the file system hierachy, as well as the process tree, the various IPC subsystems and the host and domain name.
systemd-nspawn limits access
to various kernel interfaces in the container to
read-only, such as /sys
,
/proc/sys
or
/selinux
. Network interfaces and
the system clock may not be changed from within the
container. Device nodes may not be created. The host
system cannot be rebooted and kernel modules may not
be loaded from within the container.
Note that even though these security precautions are taken systemd-nspawn is not suitable for secure container setups. Many of the security features may be circumvented and are hence primarily useful to avoid accidental changes to the host system from the container. The intended use of this program is debugging and testing as well as building of packages, distributions and software involved with boot and systems management.
In contrast to chroot(1) systemd-nspawn may be used to boot full Linux-based operating systems in a container.
Use a tool like debootstrap(8) or mock(1) to set up an OS directory tree suitable as file system hierarchy for systemd-nspawn containers.
Note that systemd-nspawn will
mount file systems private to the container to
/dev
,
/run
and similar. These will
not be visible outside of the container, and their
contents will be lost when the container exits.
Note that running two systemd-nspawn containers from the same directory tree will not make processes in them see each other. The PID namespace seperation of the two containers is complete and the containers will share very few runtime objects except for the underlying file system.
If no arguments are passed the container is set up and a shell started in it, otherwise the passed command and arguments are executed in it. The following options are understood:
--help
Prints a short help text and exits.
--directory=
, --D
Directory to use as file system root for the namespace container. If omitted the current directory will be used.
# debootstrap --arch=amd64 unstable debian-tree/ # systemd-nspawn -D debian-tree/
This installs a minimal Debian unstable
distribution into the directory
debian-tree/
and then spawns a
shell in a namespace container in it.
# mock --init # systemd-nspawn -D /var/lib/mock/fedora-rawhide-x86_64/root/ /bin/systemd systemd.log_level=debug
This installs a minimal Fedora distribution into
a subdirectory of /var/lib/mock/
and then boots an OS in a namespace container in it,
with systemd as init system, configured for debug
logging.