> systemd-nspawn [OPTION…] [PATH] [ARGUMENTS…] Spawn a command or OS in a lightweight container. Options: -h --help Show this help --version Show package version -q --quiet Do not show status information --no-pager Do not start a pager --settings=BOOLEAN Load additional settings from .nspawn file --cleanup Clean up left-over mounts and underlying mount points used by the container --no-ask-password Do not prompt for password Image: -D --directory=PATH Root directory for the container --template=PATH Initialize root directory from template directory, if missing -x --ephemeral Run container with snapshot of root directory, and remove it after exit -i --image=PATH Root file system disk image (or device node) for the container --image-policy=POLICY Specify disk image dissection policy --oci-bundle=PATH OCI bundle directory --read-only Mount the root directory read-only --volatile[=MODE] Run the system in volatile mode --root-hash=HASH Specify verity root hash for root disk image --root-hash-sig=SIG Specify pkcs7 signature of root hash for verity --verity-data=PATH Specify hash device for verity --pivot-root=PATH[:PATH] Pivot root to given directory in the container Execution: -a --as-pid2 Maintain a stub init as PID1, invoke binary as PID2 -b --boot Boot up full system (i.e. invoke init) --chdir=PATH Set working directory in the container -E --setenv=NAME[=VALUE] Pass an environment variable to PID 1 -u --uid=USER Run the command under specified user or UID --kill-signal=SIGNAL Select signal to use for shutting down PID 1 --notify-ready=BOOLEAN Receive notifications from the child init process --suppress-sync=BOOLEAN Suppress any form of disk data synchronization System Identity: -M --machine=NAME Set the machine name for the container --hostname=NAME Override the hostname for the container --uuid=UUID Set a specific machine UUID for the container Properties: -S --slice=SLICE Place the container in the specified slice --property=NAME=VALUE Set scope unit property --register=BOOLEAN Register container as machine --keep-unit Do not register a scope for the machine, reuse the service unit nspawn is running in User Namespacing: --private-users[=MODE] Run within user namespace, configure UID/GID range --private-users-ownership=MODE Adjust ('chown') or map ('map') OS tree ownership to private UID/GID range --private-users-delegate=N Delegate N additional 64K UID/GID ranges for use by nested containers -U Equivalent to --private-users=pick and --private-users-ownership=auto Networking: --private-network Disable network in container --network-interface=HOSTIF[:CONTAINERIF] Assign an existing network interface to the container --network-macvlan=HOSTIF[:CONTAINERIF] Create a macvlan network interface based on an existing network interface to the container --network-ipvlan=HOSTIF[:CONTAINERIF] Create an ipvlan network interface based on an existing network interface to the container -n --network-veth Add a virtual Ethernet connection between host and container --network-veth-extra=HOSTIF[:CONTAINERIF] Add an additional virtual Ethernet link between host and container --network-bridge=INTERFACE Add a virtual Ethernet connection to the container and attach it to an existing bridge on the host --network-zone=NAME Similar, but attach the new interface to an automatically managed bridge interface --network-namespace-path=PATH Set network namespace to the one represented by the specified kernel namespace file node -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT] Expose a container IP port on the host Security: --capability=CAP In addition to the default, retain specified capability --drop-capability=CAP Drop the specified capability from the default set --ambient-capability=CAP Sets the specified capability for the started process --no-new-privileges=BOOL Set PR_SET_NO_NEW_PRIVS flag for container payload --system-call-filter=LIST|~LIST Permit/prohibit specific system calls --restrict-address-families=LIST Restrict socket address families to the given allowlist -Z --selinux-context=SECLABEL Set the SELinux security context to be used by processes in the container -L --selinux-apifs-context=SECLABEL Set the SELinux security context to be used by API/tmpfs file systems in the container Resources: --rlimit=NAME=LIMIT Set a resource limit for the payload --oom-score-adjust=VALUE Adjust the OOM score value for the payload --cpu-affinity=CPUS Adjust the CPU affinity of the container --personality=ARCH Pick personality for this container Integration: --resolv-conf=MODE Select mode of /etc/resolv.conf initialization --timezone=MODE Select mode of /etc/localtime initialization --link-journal=MODE Link up guest journal, one of no, auto, guest, host, try-guest, try-host -j Equivalent to --link-journal=try-guest --forward-journal=FILE|DIR Forward the container's journal to the host --forward-journal-max-use=BYTES Maximum disk space for forwarded journal --forward-journal-keep-free=BYTES Minimum disk space to keep free --forward-journal-max-file-size=BYTES Maximum size of individual journal files --forward-journal-max-files=N Maximum number of journal files to keep Mounts: --bind=PATH[:PATH[:OPTIONS]] Bind mount a file or directory from the host into the container --bind-ro=PATH[:PATH[:OPTIONS]] Similar, but creates a read-only bind mount --inaccessible=PATH Over-mount file node with inaccessible node to mask it --tmpfs=PATH:[OPTIONS] Mount an empty tmpfs to the specified directory --overlay=PATH[:PATH...]:PATH Create an overlay mount from the host to the container --overlay-ro=PATH[:PATH...]:PATH Similar, but creates a read-only overlay mount --bind-user=NAME Bind user from host to container --bind-user-shell=BOOL|PATH Configure the shell to use for --bind-user= users --bind-user-group=GROUP Add an auxiliary group to --bind-user= users Input/Output: --console=MODE Select how stdin/stdout/stderr and /dev/console are set up for the container -P --pipe Equivalent to --console=pipe --background=COLOR Set ANSI color for background Credentials: --set-credential=ID:VALUE Pass a credential with literal value to container --load-credential=ID:PATH Load credential to pass to container from file or AF_UNIX stream socket Other: --user[=NAME] Run in the user service manager scope --system Run in the system service manager scope See the systemd-nspawn(1) man page for details.