From 730bdfed8173d508d4202b0bee957ab70b1e16a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 16 Jun 2023 09:43:46 +0200 Subject: [PATCH] man/systemd-nspawn: fix indentation and parenthesis location --- man/systemd-nspawn.xml | 89 +++++++++++++++++++++--------------------- 1 file changed, 45 insertions(+), 44 deletions(-) diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml index 847a11f0e0c..e4537a5c134 100644 --- a/man/systemd-nspawn.xml +++ b/man/systemd-nspawn.xml @@ -1545,8 +1545,9 @@ After=sys-subsystem-net-devices-ens1.device with a focus on implementing stateless operating system images. + - + Input/Output Options @@ -1592,57 +1593,57 @@ After=sys-subsystem-net-devices-ens1.device - - Credentials + + + Credentials - - - ID:PATH - ID:VALUE + + + ID:PATH + ID:VALUE - Pass a credential to the container. These two options correspond to the - LoadCredential= and SetCredential= settings in unit files. See - systemd.exec5 for - details about these concepts, as well as the syntax of the option's arguments. + Pass a credential to the container. These two options correspond to the + LoadCredential= and SetCredential= settings in unit files. See + systemd.exec5 for + details about these concepts, as well as the syntax of the option's arguments. - Note: when systemd-nspawn runs as systemd system service it can propagate - the credentials it received via LoadCredential=/SetCredential= - to the container payload. A systemd service manager running as PID 1 in the container can further - propagate them to the services it itself starts. It is thus possible to easily propagate credentials - from a parent service manager to a container manager service and from there into its payload. This - can even be done recursively. + Note: when systemd-nspawn runs as systemd system service it can propagate + the credentials it received via LoadCredential=/SetCredential= + to the container payload. A systemd service manager running as PID 1 in the container can further + propagate them to the services it itself starts. It is thus possible to easily propagate credentials + from a parent service manager to a container manager service and from there into its payload. This + can even be done recursively. - In order to embed binary data into the credential data for - use C-style escaping (i.e. \n to embed a newline, or \x00 to - embed a NUL byte. Note that the invoking shell might already apply unescaping - once, hence this might require double escaping!). + In order to embed binary data into the credential data for , + use C-style escaping (i.e. \n to embed a newline, or \x00 to + embed a NUL byte). Note that the invoking shell might already apply unescaping + once, hence this might require double escaping!. - The - systemd-sysusers.service8 - and - systemd-firstboot1 - services read credentials configured this way for the purpose of configuring the container's root - user's password and shell, as well as system locale, keymap and timezone during the first boot - process of the container. This is particularly useful in combination with - where every single boot appears as first boot, since configuration - applied to /etc/ is lost on container reboot cycles. See the respective man - pages for details. Example: + The + systemd-sysusers.service8 + and + systemd-firstboot1 + services read credentials configured this way for the purpose of configuring the container's root + user's password and shell, as well as system locale, keymap and timezone during the first boot + process of the container. This is particularly useful in combination with + where every single boot appears as first boot, since configuration + applied to /etc/ is lost on container reboot cycles. See the respective man + pages for details. Example: - # systemd-nspawn -i image.raw \ - --volatile=yes \ - --set-credential=firstboot.locale:de_DE.UTF-8 \ - --set-credential=passwd.hashed-password.root:'$y$j9T$yAuRJu1o5HioZAGDYPU5d.$F64ni6J2y2nNQve90M/p0ZP0ECP/qqzipNyaY9fjGpC' \ - -b + # systemd-nspawn -i image.raw \ + --volatile=yes \ + --set-credential=firstboot.locale:de_DE.UTF-8 \ + --set-credential=passwd.hashed-password.root:'$y$j9T$yAuRJu1o5HioZAGDYPU5d.$F64ni6J2y2nNQve90M/p0ZP0ECP/qqzipNyaY9fjGpC' \ + -b - The above command line will invoke the specified image file image.raw in - volatile mode, i.e. with empty /etc/ and /var/. The - container payload will recognize this as a first boot, and will invoke - systemd-firstboot.service, which then reads the two passed credentials to - configure the system's initial locale and root password. - + The above command line will invoke the specified image file image.raw in + volatile mode, i.e. with empty /etc/ and /var/. The + container payload will recognize this as a first boot, and will invoke + systemd-firstboot.service, which then reads the two passed credentials to + configure the system's initial locale and root password. + - - + Other