Add --forward-journal=FILE|DIR to forward the container's journal
entries to the host via systemd-journal-remote. When specified,
nspawn starts systemd-journal-remote listening on a Unix socket,
bind-mounts it into the container at /run/host/journal/socket, and
passes a journal.forward_to_socket credential pointing to it.
Add --forward-journal-max-use=, --forward-journal-keep-free=,
--forward-journal-max-file-size=, and --forward-journal-max-files=
to configure disk usage limits for the forwarded journal.
Consolidate nspawn's per-machine on-disk state under a single runtime
directory at /run/systemd/nspawn/<machine>/. The container rootdir
mount point moves from /tmp/nspawn-root-XXXXXX to <runtime_dir>/root,
the unix-export directory moves from
/run/systemd/nspawn/unix-export/<machine> to <runtime_dir>/unix-export,
and the journal-remote socket lives at
<runtime_dir>/journal-remote-socket. Update ssh-generator and
ssh-proxy to follow the new unix-export path layout.
Extract fork_journal_remote() into fork-notify.{c,h} as a shared
helper used by both nspawn and vmspawn, replacing vmspawn's
start_systemd_journal_remote().
Extract runtime_directory_make() into path-lookup.{c,h} as a shared
helper used by both nspawn and vmspawn, replacing vmspawn's inline
runtime directory creation logic.
Co-developed-by: Claude Opus 4.6 <noreply@anthropic.com>
Add a new --restrict-address-families= command line option and
corresponding RestrictAddressFamilies= setting for .nspawn files to
restrict which socket address families may be used inside a container.
Many address families such as AF_VSOCK and AF_NETLINK are not
network-namespaced, so restricting access to them in containers
improves isolation. The option supports allowlist and denylist modes
(via ~ prefix), as well as "none" to block all families, matching the
semantics of RestrictAddressFamilies= in unit files.
The address family parsing logic is extracted into a shared
parse_address_families() helper in parse-helpers.c, which is now also
used by config_parse_address_families() in load-fragment.c.
This is currently opt-in. In a future version, the default will be
changed to restrict address families to AF_INET, AF_INET6 and AF_UNIX.
Rename nspawn's --user=NAME option to --uid=NAME for selecting the
container user. The -u short option is preserved. --user=NAME and
--user NAME are still accepted but emit a deprecation warning. A
pre-parsing step stitches the space-separated --user NAME form into
--user=NAME before getopt sees it, preserving backwards compatibility
despite --user now being an optional_argument.
Repurpose --user (without argument) and --system as standalone
switches for selecting the runtime scope (user vs system service
manager).
Replace all uses of the arg_privileged boolean with
arg_runtime_scope comparisons throughout nspawn. The default scope
is auto-detected from the effective UID.
Co-developed-by: Claude Opus 4.6 <noreply@anthropic.com>
Move register_machine() and unregister_machine() from
vmspawn-register.{c,h} into shared machine-register.{c,h} so both
nspawn and vmspawn can use the same implementation.
The unified register_machine() uses varlink first (for richer
features like SSH support and unit allocation) with a D-Bus
RegisterMachineWithNetwork fallback for older machined. The
interface adds a class parameter ("vm" or "container") and
local_ifindex for nspawn's network interface support.
The unified unregister_machine() similarly tries varlink first
(io.systemd.Machine.Unregister) before falling back to D-Bus.
Both register_machine() and unregister_machine() only log at debug
level internally, leaving error/notice logging to callers.
Add register_machine_with_fallback() which tries system and/or user
scope registration based on a RuntimeScope parameter
(_RUNTIME_SCOPE_INVALID for both), and
unregister_machine_with_fallback() as its counterpart. Both use
RET_GATHER() to collect errors from each scope.
Make --register= a tristate (yes/no/auto) defaulting to auto. When
set to auto, registration failures are logged at notice level and
ignored. When set to yes, failures are fatal.
Co-developed-by: Claude Opus 4.6 <noreply@anthropic.com>
This is useful when the previous invocation is unexpectedly killed.
Otherwise, if systemd-nspawn is killed forcibly, then unix-export
directory is not cleared and unmounted, and the subsequent invocation
will fail. E.g.
===
[ 18.895515] TEST-13-NSPAWN.sh[645]: + machinectl start long-running
[ 18.945703] systemd-nspawn[1387]: Mount point '/run/systemd/nspawn/unix-export/long-running' exists already, refusing.
[ 18.949236] systemd[1]: systemd-nspawn@long-running.service: Failed with result 'exit-code'.
[ 18.949743] systemd[1]: Failed to start systemd-nspawn@long-running.service.
===
I don't actually need this anymore since we're going with a
unit based approach for the containers stuff internally so
let's just revert it.
Fixes#34085
This reverts commit ce2291730d.
This allows for example forcing to use /sbin/init instead of always
using /usr/lib/systemd/systemd if it exists. Or it allows using a
different path altogether.
* fix error
* remove options that are no longer supported
* add missing options
* stop completion if an option `--help` or `--version` is supplied
[[[
zjs: a note for the reader:
zshcompsys(1) in the section about optspecs in _arguments says:
> Each of the forms above may be preceded by a list in parentheses of option names and argument num‐
> bers. If the given option is on the command line, the options and arguments indicated in parentheses
> will not be offered. For example, ‘(-two -three 1)-one:...' completes the option ‘-one'; if this ap‐
> pears on the command line, the options -two and -three and the first ordinary argument will not be
> completed after it. ‘(-foo):...' specifies an ordinary argument completion; -foo will not be com‐
> pleted if that argument is already present.
>
> Other items may appear in the list of excluded options to indicate various other items that should
> not be applied when the current specification is matched: a single star (\*) for the rest arguments
> (i.e. a specification of the form ‘\*:...'); a colon (:) for all normal (non-option-) arguments; and a
> hyphen (-) for all options. For example, if ‘(\*)' appears before an option and the option appears on
> the command line, the list of remaining arguments (those shown in the above table beginning with
> ‘\*:') will not be completed.
The intended effect of the change is to remove irrelevant completion matches from the completion.
tl;dr: (- : ) prevents further completion
]]]
- Don't redefine helpers on every call
- Prefix helper names with main function name
- Adjust some helper names for consistency and convention adherance
filenames will be completed for --image/-i/--bind/--bind-ro/--tmpfs
network interfaces for --network-(interface|macvlan|ipvlan|bridge)
users for --user/-u, yes & no for --register, x86 * x86-64 for
--personality
display a message of the expected argument for --machine/-M/--uuid
--slice/-S/--port/-p/--selinux-*/-Z/-L/--setenv
Allow completing commands(and their options) of the host system for COMMAND
Things like -n to specify the lines to show with systemctl and
journalctl accepts syntax like:
journalctl -n4
systemctl -n14
Previously, typing `-nXX <tab>` where XX is a number, zsh would try to
complete an integer. Now it will see the XX and use the _journalctl_none
completion. This is also how any of the single letter options that take
arguments work as well.
Daan De Meyer
Daan De Meyer
Yu Watanabe
Eisuke Kawashima
Eric Cook
Zbigniew Jędrzejewski-Szmek
dana
Alessandro Puccetti
Lukas Rusak
Daniel Mack
William Giokas