Contents
How to access USB device from systemd-nspawn container?
systemd-nspawn handles permissions for devices through cgroups. By default any container is granted with permissions only for common devices like /dev/null, /dev/zero, etc, and additionally to any device passed directly to –bind argument like –bind=/dev/vcs. This won’t work with USB because /dev/bus/usb is a directory.
Where to find service template in systemd nspawn?
The service template file is located at /lib/systemd/system/[email protected]. It is worth it to take a look inside, especially the specified executable: As you can see, there are already quite a few command line arguments specified by default when you use machinectl to start a container.
How to set up a container in systemd?
First, we need to set up an OS tree in an empty directory, which will serve as the container’s root directory. To achieve this, we will use debootstrap. systemd expects containers to be located inside the /var/lib/machines directory. They can be elsewhere, but then some tools won’t automatically recognize the container.
What is the user ID of a container?
Every user on a system has a user ID. The root user typically has ID 0, while normal user IDs start at 1000. User namespacing is mostly a precaution; should someone be able to break out of your container into the host system, he will not have the UID of an existing user on the host.
What happens when invoked with systemd-nspawn ( 1 )?
While running, containers invoked with systemd-nspawn are registered with the systemd-machined (8) service that keeps track of running containers, and provides programming interfaces to interact with them. If option -b is specified, the arguments are used as arguments for the init program.
How to bind host Socket in systemd nspawn?
When you start the container, you need to bind the host socket in the file system of the guest and pass an environment variable PULSE_SERVER that defines where the socket is in the guest. Example: $ systemd-nspawn -E PULSE_SERVER=”unix:/pulse-guest.socket” –bind=/pulse-host.socket:/pulse-guest.socket