Podman - ローカル環境からコンテナと Kubernetes をシームレスに操作

systemd-nspawn [OPTIONS...] [PATH] [ARGUMENTS...]

Spawn a command or OS in a light-weight container.

  -h --help                 Show this help
     --version              Print version string
  -q --quiet                Do not show status information
     --no-pager             Do not pipe output into a pager
     --settings=BOOLEAN     Load additional settings from .nspawn file

Image:
  -D --directory=PATH       Root directory for the container
     --template=PATH        Initialize root directory from template directory,
                            if missing
  -x --ephemeral            Run container with snapshot of root directory, and
                            remove it after exit
  -i --image=PATH           Root file system disk image (or device node) for
                            the container
     --image-policy=POLICY  Specify disk image dissection policy
     --oci-bundle=PATH      OCI bundle directory
     --read-only            Mount the root directory read-only
     --volatile[=MODE]      Run the system in volatile mode
     --root-hash=HASH       Specify verity root hash for root disk image
     --root-hash-sig=SIG    Specify pkcs7 signature of root hash for verity
                            as a DER encoded PKCS7, either as a path to a file
                            or as an ASCII base64 encoded string prefixed by
                            'base64:'
     --verity-data=PATH     Specify hash device for verity
     --pivot-root=PATH[:PATH]
                            Pivot root to given directory in the container

Execution:
  -a --as-pid2              Maintain a stub init as PID1, invoke binary as PID2
  -b --boot                 Boot up full system (i.e. invoke init)
     --chdir=PATH           Set working directory in the container
  -E --setenv=NAME[=VALUE]  Pass an environment variable to PID 1
  -u --user=USER            Run the command under specified user or UID
     --kill-signal=SIGNAL   Select signal to use for shutting down PID 1
     --notify-ready=BOOLEAN Receive notifications from the child init process
     --suppress-sync=BOOLEAN
                            Suppress any form of disk data synchronization

System Identity:
  -M --machine=NAME         Set the machine name for the container
     --hostname=NAME        Override the hostname for the container
     --uuid=UUID            Set a specific machine UUID for the container

Properties:
  -S --slice=SLICE          Place the container in the specified slice
     --property=NAME=VALUE  Set scope unit property
     --register=BOOLEAN     Register container as machine
     --keep-unit            Do not register a scope for the machine, reuse
                            the service unit nspawn is running in

User Namespacing:
     --private-users=no     Run without user namespacing
     --private-users=yes|pick|identity
                            Run within user namespace, autoselect UID/GID range
     --private-users=UIDBASE[:NUIDS]
                            Similar, but with user configured UID/GID range
     --private-users-ownership=MODE
                            Adjust ('chown') or map ('map') OS tree ownership
                            to private UID/GID range
  -U                        Equivalent to --private-users=pick and
                            --private-users-ownership=auto

Networking:
     --private-network      Disable network in container
     --network-interface=HOSTIF[:CONTAINERIF]
                            Assign an existing network interface to the
                            container
     --network-macvlan=HOSTIF[:CONTAINERIF]
                            Create a macvlan network interface based on an
                            existing network interface to the container
     --network-ipvlan=HOSTIF[:CONTAINERIF]
                            Create an ipvlan network interface based on an
                            existing network interface to the container
  -n --network-veth         Add a virtual Ethernet connection between host
                            and container
     --network-veth-extra=HOSTIF[:CONTAINERIF]
                            Add an additional virtual Ethernet link between
                            host and container
     --network-bridge=INTERFACE
                            Add a virtual Ethernet connection to the container
                            and attach it to an existing bridge on the host
     --network-zone=NAME    Similar, but attach the new interface to an
                            an automatically managed bridge interface
     --network-namespace-path=PATH
                            Set network namespace to the one represented by
                            the specified kernel namespace file node
  -p --port=[PROTOCOL:]HOSTPORT[:CONTAINERPORT]
                            Expose a container IP port on the host

Security:
     --capability=CAP       In addition to the default, retain specified
                            capability
     --drop-capability=CAP  Drop the specified capability from the default set
     --ambient-capability=CAP
                            Sets the specified capability for the started
                            process. Not useful if booting a machine.
     --no-new-privileges    Set PR_SET_NO_NEW_PRIVS flag for container payload
     --system-call-filter=LIST|~LIST
                            Permit/prohibit specific system calls
  -Z --selinux-context=SECLABEL
                            Set the SELinux security context to be used by
                            processes in the container
  -L --selinux-apifs-context=SECLABEL
                            Set the SELinux security context to be used by
                            API/tmpfs file systems in the container

Resources:
systemd-nspawn [OPTIONS...] [PATH] [ARGUMENTS...]

Spawn a command or OS in a light-weight container.

  -h --help                 Show this help
     --version              Print version string
  -q --quiet                Do not show status information
     --no-pager             Do not pipe output into a pager
     --settings=BOOLEAN     Load additional settings from .nspawn file

Image:
  -D --directory=PATH       Root directory for the container
     --template=PATH        Initialize root directory from template directory,
                            if missing
  -x --ephemeral            Run container with snapshot of root directory, and
                            remove it after exit
  -i --image=PATH           Root file system disk image (or device node) for
                            the container
     --image-policy=POLICY  Specify disk image dissection policy
     --oci-bundle=PATH      OCI bundle directory
     --read-only            Mount the root directory read-only
     --volatile[=MODE]      Run the system in volatile mode
     --root-hash=HASH       Specify verity root hash for root disk image
     --root-hash-sig=SIG    Specify pkcs7 signature of root hash for verity
                            as a DER encoded PKCS7, either as a path to a file
                            or as an ASCII base64 encoded string prefixed by
                            'base64:'
     --verity-data=PATH     Specify hash device for verity
     --pivot-root=PATH[:PATH]
                            Pivot root to given directory in the container

Execution:
  -a --as-pid2              Maintain a stub init as PID1, invoke binary as PID2
  -b --boot                 Boot up full system (i.e. invoke init)
     --chdir=PATH           Set working directory in the container
  -E --setenv=NAME[=VALUE]  Pass an environment variable to PID 1
  -u --user=USER            Run the command under specified user or UID
     --kill-signal=SIGNAL   Select signal to use for shutting down PID 1
     --notify-ready=BOOLEAN Receive notifications from the child init process
     --suppress-sync=BOOLEAN
                            Suppress any form of disk data synchronization