/usr/bin/systemd-nspawn

> systemd-nspawn [OPTION…] [PATH] [ARGUMENTS…]

Spawn a command or OS in a lightweight container.

Options:
  -h --help                                     Show this help
     --version                                  Show package version
  -q --quiet                                    Do not show status information
     --no-pager                                 Do not start a pager
     --settings=BOOLEAN                         Load additional settings from .nspawn file
     --cleanup                                  Clean up left-over mounts and underlying mount
                                                points used by the container
     --no-ask-password                          Do not prompt for password

Image:
  -D --directory=PATH                           Root directory for the container
     --template=PATH                            Initialize root directory from template directory,
                                                if missing
  -x --ephemeral                                Run container with snapshot of root directory, and
                                                remove it after exit
  -i --image=PATH                               Root file system disk image (or device node) for the
                                                container
     --image-policy=POLICY                      Specify disk image dissection policy
     --oci-bundle=PATH                          OCI bundle directory
     --read-only                                Mount the root directory read-only
     --volatile[=MODE]                          Run the system in volatile mode
     --root-hash=HASH                           Specify verity root hash for root disk image
     --root-hash-sig=SIG                        Specify pkcs7 signature of root hash for verity
     --verity-data=PATH                         Specify hash device for verity
     --pivot-root=PATH[:PATH]                   Pivot root to given directory in the container

Execution:
  -a --as-pid2                                  Maintain a stub init as PID1, invoke binary as PID2
  -b --boot                                     Boot up full system (i.e. invoke init)
     --chdir=PATH                               Set working directory in the container
  -E --setenv=NAME[=VALUE]                      Pass an environment variable to PID 1
  -u --uid=USER                                 Run the command under specified user or UID
     --kill-signal=SIGNAL                       Select signal to use for shutting down PID 1
     --notify-ready=BOOLEAN                     Receive notifications from the child init process
     --suppress-sync=BOOLEAN                    Suppress any form of disk data synchronization

System Identity:
  -M --machine=NAME                             Set the machine name for the container
     --hostname=NAME                            Override the hostname for the container
     --uuid=UUID                                Set a specific machine UUID for the container

Properties:
  -S --slice=SLICE                              Place the container in the specified slice
     --property=NAME=VALUE                      Set scope unit property
     --register=BOOLEAN                         Register container as machine
     --keep-unit                                Do not register a scope for the machine, reuse the
                                                service unit nspawn is running in

User Namespacing:
     --private-users[=MODE]                     Run within user namespace, configure UID/GID range
     --private-users-ownership=MODE             Adjust ('chown') or map ('map') OS tree ownership to
                                                private UID/GID range
     --private-users-delegate=N                 Delegate N additional 64K UID/GID ranges for use by
                                                nested containers
  -U                                            Equivalent to --private-users=pick and
                                                --private-users-ownership=auto

Networking:
     --private-network                          Disable network in container
     --network-interface=HOSTIF[:CONTAINERIF]   Assign an existing network interface to the
                                                container
     --network-macvlan=HOSTIF[:CONTAINERIF]     Create a macvlan network interface based on an
                                                existing network interface to the container
     --network-ipvlan=HOSTIF[:CONTAINERIF]      Create an ipvlan network interface based on an
                                                existing network interface to the container
  -n --network-veth                             Add a virtual Ethernet connection between host and
                                                container
     --network-veth-extra=HOSTIF[:CONTAINERIF]  Add an additional virtual Ethernet link between host
                                                and container
     --network-bridge=INTERFACE                 Add a virtual Ethernet connection to the container
                                                and attach it to an existing bridge on the host
     --network-zone=NAME                        Similar, but attach the new interface to an
                                                automatically managed bridge interface
     --network-namespace-path=PATH              Set network namespace to the one represented by the
                                                specified kernel namespace file node
  -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT] Expose a container IP port on the host

Security:
     --capability=CAP                           In addition to the default, retain specified
                                                capability
     --drop-capability=CAP                      Drop the specified capability from the default set
     --ambient-capability=CAP                   Sets the specified capability for the started
                                                process
     --no-new-privileges=BOOL                   Set PR_SET_NO_NEW_PRIVS flag for container payload
     --system-call-filter=LIST|~LIST            Permit/prohibit specific system calls
     --restrict-address-families=LIST           Restrict socket address families to the given
                                                allowlist
  -Z --selinux-context=SECLABEL                 Set the SELinux security context to be used by
                                                processes in the container
  -L --selinux-apifs-context=SECLABEL           Set the SELinux security context to be used by
                                                API/tmpfs file systems in the container

Resources:
     --rlimit=NAME=LIMIT                        Set a resource limit for the payload
     --oom-score-adjust=VALUE                   Adjust the OOM score value for the payload
     --cpu-affinity=CPUS                        Adjust the CPU affinity of the container
     --personality=ARCH                         Pick personality for this container

Integration:
     --resolv-conf=MODE                         Select mode of /etc/resolv.conf initialization
     --timezone=MODE                            Select mode of /etc/localtime initialization
     --link-journal=MODE                        Link up guest journal, one of no, auto, guest, host,
                                                try-guest, try-host
  -j                                            Equivalent to --link-journal=try-guest
     --forward-journal=FILE|DIR                 Forward the container's journal to the host
     --forward-journal-max-use=BYTES            Maximum disk space for forwarded journal
     --forward-journal-keep-free=BYTES          Minimum disk space to keep free
     --forward-journal-max-file-size=BYTES      Maximum size of individual journal files
     --forward-journal-max-files=N              Maximum number of journal files to keep

Mounts:
     --bind=PATH[:PATH[:OPTIONS]]               Bind mount a file or directory from the host into
                                                the container
     --bind-ro=PATH[:PATH[:OPTIONS]]            Similar, but creates a read-only bind mount
     --inaccessible=PATH                        Over-mount file node with inaccessible node to mask
                                                it
     --tmpfs=PATH:[OPTIONS]                     Mount an empty tmpfs to the specified directory
     --overlay=PATH[:PATH...]:PATH              Create an overlay mount from the host to the
                                                container
     --overlay-ro=PATH[:PATH...]:PATH           Similar, but creates a read-only overlay mount
     --bind-user=NAME                           Bind user from host to container
     --bind-user-shell=BOOL|PATH                Configure the shell to use for --bind-user= users
     --bind-user-group=GROUP                    Add an auxiliary group to --bind-user= users

Input/Output:
     --console=MODE                             Select how stdin/stdout/stderr and /dev/console are
                                                set up for the container
  -P --pipe                                     Equivalent to --console=pipe
     --background=COLOR                         Set ANSI color for background

Credentials:
     --set-credential=ID:VALUE                  Pass a credential with literal value to container
     --load-credential=ID:PATH                  Load credential to pass to container from file or
                                                AF_UNIX stream socket

Other:
     --user[=NAME]                              Run in the user service manager scope
     --system                                   Run in the system service manager scope

See the systemd-nspawn(1) man page for details.