mirror of
https://github.com/systemd/systemd
synced 2024-09-06 08:46:19 +00:00
![Zbigniew Jędrzejewski-Szmek](/assets/img/avatar_default.png)
The previous text did not look right when rendered. The text is much easier to read when paragraphs are separated by an empty line, latex-style.
418 lines
17 KiB
XML
418 lines
17 KiB
XML
<?xml version='1.0'?>
|
||
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
||
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
||
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
|
||
|
||
<refentry id="systemd-vmspawn" conditional="ENABLE_VMSPAWN"
|
||
xmlns:xi="http://www.w3.org/2001/XInclude">
|
||
|
||
<refentryinfo>
|
||
<title>systemd-vmspawn</title>
|
||
<productname>systemd</productname>
|
||
</refentryinfo>
|
||
|
||
<refmeta>
|
||
<refentrytitle>systemd-vmspawn</refentrytitle>
|
||
<manvolnum>1</manvolnum>
|
||
</refmeta>
|
||
|
||
<refnamediv>
|
||
<refname>systemd-vmspawn</refname>
|
||
<refpurpose>Spawn an OS in a virtual machine.</refpurpose>
|
||
</refnamediv>
|
||
|
||
<refsynopsisdiv>
|
||
<cmdsynopsis>
|
||
<command>systemd-vmspawn</command>
|
||
<arg choice="opt" rep="repeat">OPTIONS</arg>
|
||
<arg choice="opt" rep="repeat">ARGS</arg>
|
||
</cmdsynopsis>
|
||
</refsynopsisdiv>
|
||
|
||
<refsect1>
|
||
<title>Description</title>
|
||
<para><command>systemd-vmspawn</command> may be used to start a virtual machine from an OS image. In many ways it is similar to <citerefentry
|
||
project='man-pages'><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>, but
|
||
launches a full virtual machine instead of using namespaces.</para>
|
||
|
||
<para>File descriptors for <filename>/dev/kvm</filename> and <filename>/dev/vhost-vsock</filename> can be
|
||
passed to <command>systemd-vmspawn</command> via systemd's native socket passing interface (see
|
||
<citerefentry><refentrytitle>sd_listen_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
|
||
details about the precise protocol used and the order in which the file descriptors are passed), these
|
||
file descriptors must be passed with the names <literal>kvm</literal> and <literal>vhost-vsock</literal>
|
||
respectively.</para>
|
||
|
||
<para>Note: on Ubuntu/Debian derivatives systemd-vmspawn requires the user to be in the <literal>kvm</literal> group to use the VSock options.</para>
|
||
</refsect1>
|
||
|
||
<refsect1>
|
||
<title>Options</title>
|
||
|
||
<para>The excess arguments are passed as extra kernel command line arguments using SMBIOS.</para>
|
||
|
||
<para>The following options are understood:</para>
|
||
|
||
<variablelist>
|
||
|
||
<varlistentry>
|
||
<term><option>-q</option></term>
|
||
<term><option>--quiet</option></term>
|
||
|
||
<listitem><para>Turns off any status output by the tool
|
||
itself. When this switch is used, the only output from vmspawn
|
||
will be the console output of the Virtual Machine OS itself.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/></listitem>
|
||
</varlistentry>
|
||
|
||
</variablelist>
|
||
|
||
<refsect2>
|
||
<title>Image Options</title>
|
||
|
||
<varlistentry>
|
||
<term><option>-D</option></term>
|
||
<term><option>--directory=</option></term>
|
||
|
||
<listitem><para>Directory to use as file system root for the virtual machine.</para>
|
||
|
||
<para>One of either <option>--directory=</option> or <option>--image=</option> must be specified.</para>
|
||
|
||
<para>Note: If mounting a non-root owned directory you may require <option>--private-users=</option>
|
||
to map into the user's subuid namespace.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<variablelist>
|
||
<varlistentry>
|
||
<term><option>-i</option></term>
|
||
<term><option>--image=</option></term>
|
||
|
||
<listitem><para>Root file system disk image (or device node) for the virtual machine.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
</variablelist>
|
||
</refsect2>
|
||
|
||
<refsect2>
|
||
<title>Host Configuration</title>
|
||
|
||
<variablelist>
|
||
<varlistentry>
|
||
<term><option>--qemu-smp=</option><replaceable>SMP</replaceable></term>
|
||
|
||
<listitem><para>Configures the number of CPUs to start the virtual machine with.
|
||
Defaults to 1.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--qemu-mem=</option><replaceable>MEM</replaceable></term>
|
||
|
||
<listitem><para>Configures the amount of memory to start the virtual machine with.
|
||
Defaults to 2G.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--qemu-kvm=</option><replaceable>BOOL</replaceable></term>
|
||
|
||
<listitem><para>Configures whether to use KVM. If the option is not specified KVM support will be
|
||
detected automatically. If true, KVM is always used, and if false, KVM is never used.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--qemu-vsock=</option><replaceable>BOOL</replaceable></term>
|
||
|
||
<listitem>
|
||
<para>Configure whether to use VSock networking.</para>
|
||
|
||
<para>If the option is not specified VSock support will be detected automatically.
|
||
If yes is specified VSocks are always used, and vice versa if no is set VSocks are never used.</para>
|
||
<xi:include href="version-info.xml" xpointer="v255"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--vsock-cid=</option><replaceable>CID</replaceable></term>
|
||
|
||
<listitem>
|
||
<para>Configure vmspawn to use a specific CID for the guest.</para>
|
||
|
||
<para>If the option is not specified or an empty argument is supplied the guest will be assigned a random CID.</para>
|
||
|
||
<para>Valid CIDs are in the range <constant>3</constant> to <constant>4294967294</constant> (<constant>0xFFFF_FFFE</constant>).
|
||
CIDs outside of this range are reserved.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--tpm=</option><replaceable>BOOL</replaceable></term>
|
||
|
||
<listitem>
|
||
<para>Configure whether to use qemu with a virtual TPM or not.</para>
|
||
|
||
<para>If the option is not specified vmspawn will detect the presence of <citerefentry project='man-pages'>
|
||
<refentrytitle>swtpm</refentrytitle><manvolnum>8</manvolnum></citerefentry> and use it if available.
|
||
If yes is specified <citerefentry project='man-pages'><refentrytitle>swtpm</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||
is always used, and vice versa if no is set <citerefentry project='man-pages'><refentrytitle>swtpm</refentrytitle>
|
||
<manvolnum>8</manvolnum></citerefentry> is never used.</para>
|
||
|
||
<para>Note: the virtual TPM used may change in future.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--linux=</option><replaceable>PATH</replaceable></term>
|
||
|
||
<listitem>
|
||
<para>Set the linux kernel image to use for direct kernel boot.</para>
|
||
|
||
<para>If no kernel was installed into the image then the image will fail to boot.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--initrd=</option><replaceable>PATH</replaceable></term>
|
||
|
||
<listitem>
|
||
<para>Set the initrd to use for direct kernel boot.</para>
|
||
|
||
<para>If the linux kernel supplied is a UKI then this argument is not required.</para>
|
||
|
||
<para>If the option is specified multiple times vmspawn will merge the initrds together.</para>
|
||
|
||
<para>If no initrd was installed into the image then the image will fail to boot.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--qemu-gui</option></term>
|
||
|
||
<listitem><para>Start QEMU in graphical mode.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>-n</option></term>
|
||
<term><option>--network-tap</option></term>
|
||
|
||
<listitem>
|
||
<para>Create a TAP device to network with the virtual machine.</para>
|
||
|
||
<para>Note: root privileges are required to use TAP networking.
|
||
Additionally,
|
||
<citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||
must be running and correctly set up on the host to provision the host interface. The relevant
|
||
<literal>.network</literal> file can be found at
|
||
<filename>/usr/lib/systemd/network/80-vm-vt.network</filename>.
|
||
</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--network-user-mode</option></term>
|
||
|
||
<listitem><para>Use user mode networking with QEMU.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--firmware=</option><replaceable>PATH</replaceable></term>
|
||
|
||
<listitem><para>Takes an absolute path, or a relative path beginning with
|
||
<filename>./</filename>. Specifies a JSON firmware definition file, which allows selecting the
|
||
firmware to boot in the VM. If not specified a suitable firmware is automatically discovered. If the
|
||
special string <literal>list</literal> is specified lists all discovered firmwares.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/></listitem>
|
||
</varlistentry>
|
||
|
||
<varlistentry>
|
||
<term><option>--secure-boot=</option><replaceable>BOOL</replaceable></term>
|
||
|
||
<listitem><para>Configure whether to search for firmware which supports Secure Boot.</para>
|
||
|
||
<para>If the option is not specified the first firmware which is detected will be used.
|
||
If the option is set to yes then the first firmware with Secure Boot support will be selected.
|
||
If no is specified then the first firmware without Secure Boot will be selected.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
|
||
</varlistentry>
|
||
</variablelist>
|
||
</refsect2>
|
||
|
||
<refsect2>
|
||
<title>System Identity Options</title>
|
||
|
||
<variablelist>
|
||
<varlistentry>
|
||
<term><option>-M</option></term>
|
||
<term><option>--machine=</option></term>
|
||
|
||
<listitem><para>Sets the machine name for this virtual machine. This
|
||
name may be used to identify this virtual machine during its runtime
|
||
(for example in tools like
|
||
<citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
|
||
and similar).</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
</variablelist>
|
||
</refsect2>
|
||
|
||
<refsect2>
|
||
<title>User Namespacing Options</title>
|
||
|
||
<variablelist>
|
||
<varlistentry>
|
||
<term><option>--private-users=</option><replaceable>UID_SHIFT[:UID_RANGE]</replaceable></term>
|
||
|
||
<listitem><para>Controls user namespacing under <option>--directory=</option>.
|
||
If enabled, <citerefentry project='man-pages'><refentrytitle>virtiofsd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
|
||
is instructed to map user and group ids (UIDs and GIDs). This involves mapping the private UIDs/GIDs used in the virtual machine
|
||
(starting with the virtual machine's root user 0 and up) to a range of UIDs/GIDs on the host that are not used for other
|
||
purposes (usually in the range beyond the host's UID/GID 65536).</para>
|
||
|
||
<para>If one or two colon-separated numbers are specified, user namespacing is turned on. <replaceable>UID_SHIFT</replaceable>
|
||
specifies the first host UID/GID to map, <replaceable>UID_RANGE</replaceable> is optional and specifies number of host
|
||
UIDs/GIDs to assign to the virtual machine. If <replaceable>UID_RANGE</replaceable> is omitted, 65536 UIDs/GIDs are assigned.</para>
|
||
|
||
<para>When user namespaces are used, the GID range assigned to each virtual machine is always chosen identical to the
|
||
UID range.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/></listitem>
|
||
</varlistentry>
|
||
</variablelist>
|
||
</refsect2>
|
||
|
||
<refsect2>
|
||
<title>Mount Options</title>
|
||
|
||
<variablelist>
|
||
|
||
<varlistentry>
|
||
<term><option>--bind=</option><replaceable>PATH</replaceable></term>
|
||
<term><option>--bind-ro=</option><replaceable>PATH</replaceable></term>
|
||
|
||
<listitem><para>Mount a directory from the host into the virtual machine. Takes one of: a path
|
||
argument — in which case the specified path will be mounted from the host to the same path in the virtual machine, or
|
||
a colon-separated pair of paths — in which case the first specified path is the source in the host, and the
|
||
second path is the destination in the virtual machine. If the source path is not absolute, it is resolved
|
||
relative to the current working directory. The <option>--bind-ro=</option> option creates read-only bind mounts.
|
||
Backslash escapes are interpreted, so <literal>\:</literal> may be used to embed colons in either path.
|
||
This option may be specified multiple times for creating multiple independent bind mount points.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/></listitem>
|
||
</varlistentry>
|
||
</variablelist>
|
||
</refsect2>
|
||
|
||
<refsect2>
|
||
<title>Integration Options</title>
|
||
|
||
<variablelist>
|
||
<varlistentry>
|
||
<term><option>--forward-journal=</option><replaceable>FILE|DIR</replaceable></term>
|
||
|
||
<listitem><para>Forward the virtual machine's journal to the host.
|
||
<citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
||
is currently used to receive the guest VM's forwarded journal entries. This option determines where
|
||
this journal is saved on the host and has the same semantics as
|
||
<option>-o</option>/<option>--output</option> described in
|
||
<citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v256"/>
|
||
</listitem>
|
||
</varlistentry>
|
||
</variablelist>
|
||
</refsect2>
|
||
|
||
<refsect2>
|
||
<title>Credentials</title>
|
||
|
||
<variablelist>
|
||
<varlistentry>
|
||
<term><option>--load-credential=</option><replaceable>ID</replaceable>:<replaceable>PATH</replaceable></term>
|
||
<term><option>--set-credential=</option><replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></term>
|
||
|
||
<listitem><para>Pass a credential to the virtual machine. These two options correspond to the
|
||
<varname>LoadCredential=</varname> and <varname>SetCredential=</varname> settings in unit files. See
|
||
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
|
||
details about these concepts, as well as the syntax of the option's arguments.</para>
|
||
|
||
<para>In order to embed binary data into the credential data for <option>--set-credential=</option>,
|
||
use C-style escaping (i.e. <literal>\n</literal> to embed a newline, or <literal>\x00</literal> to
|
||
embed a <constant>NUL</constant> byte). Note that the invoking shell might already apply unescaping
|
||
once, hence this might require double escaping!.</para>
|
||
|
||
<xi:include href="version-info.xml" xpointer="v255"/></listitem>
|
||
</varlistentry>
|
||
</variablelist>
|
||
|
||
</refsect2><refsect2>
|
||
<title>Other</title>
|
||
|
||
<variablelist>
|
||
<xi:include href="standard-options.xml" xpointer="no-pager" />
|
||
<xi:include href="standard-options.xml" xpointer="help" />
|
||
<xi:include href="standard-options.xml" xpointer="version" />
|
||
</variablelist>
|
||
</refsect2>
|
||
</refsect1>
|
||
|
||
<xi:include href="common-variables.xml" />
|
||
|
||
<refsect1>
|
||
<title>Examples</title>
|
||
|
||
<example>
|
||
<title>Run an Arch Linux VM image generated by mkosi</title>
|
||
|
||
<programlisting>
|
||
$ mkosi -d arch -p systemd -p linux --autologin -o image.raw -f build
|
||
$ systemd-vmspawn --image=image.raw
|
||
</programlisting>
|
||
</example>
|
||
</refsect1>
|
||
|
||
<refsect1>
|
||
<title>Exit status</title>
|
||
|
||
<para>If an error occurred the value errno is propagated to the return code.
|
||
If EXIT_STATUS is supplied by the running image that is returned.
|
||
Otherwise EXIT_SUCCESS is returned.</para>
|
||
</refsect1>
|
||
|
||
<refsect1>
|
||
<title>See Also</title>
|
||
<para><simplelist type="inline">
|
||
<member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
|
||
<member><citerefentry><refentrytitle>mkosi</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
|
||
</simplelist></para>
|
||
</refsect1>
|
||
</refentry>
|