mirror of
https://github.com/systemd/systemd
synced 2025-10-06 00:13:24 +02:00
3405b84d8c
vmspawn systems might take quite a while to boot in particular if they go through uefi and wait for a network lease. Hence let's increase the start timeout to 2min (from 45s). We'll do that for both nspawn and vmspawn, even though the UEFI thing certainly doesn't apply there (but the DHCP thing still does).
56 lines
1.9 KiB
SYSTEMD
56 lines
1.9 KiB
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Container %i
|
|
Documentation=man:systemd-nspawn(1)
|
|
Wants=modprobe@tun.service modprobe@loop.service modprobe@dm_mod.service
|
|
PartOf=machines.target
|
|
Before=machines.target
|
|
After=network.target modprobe@tun.service modprobe@loop.service modprobe@dm_mod.service
|
|
RequiresMountsFor=/var/lib/machines/%i
|
|
|
|
[Service]
|
|
# Make sure the DeviceAllow= lines below can properly resolve the 'block-loop' expression (and others)
|
|
ExecStart=systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U --settings=override --machine=%i
|
|
ExecStopPost=systemd-nspawn --cleanup --machine=%i
|
|
KillMode=mixed
|
|
Type=notify
|
|
RestartForceExitStatus=133
|
|
SuccessExitStatus=133
|
|
Slice=machine.slice
|
|
Delegate=yes
|
|
DelegateSubgroup=supervisor
|
|
CoredumpReceive=yes
|
|
TasksMax=16384
|
|
TimeoutSec=2min
|
|
{{SERVICE_WATCHDOG}}
|
|
|
|
{# Enforce a strict device policy, similar to the one nspawn configures (in
|
|
# nspawn-register.c:append_machine_properties()) when it allocates its own
|
|
# scope unit. Make sure to keep these policies in sync if you change them! #}
|
|
DevicePolicy=closed
|
|
DeviceAllow=/dev/net/tun rwm
|
|
DeviceAllow=char-pts rw
|
|
DeviceAllow=/dev/fuse rwm
|
|
|
|
# nspawn itself needs access to /dev/loop-control and /dev/loop, to implement
|
|
# the --image= option. Add these here, too.
|
|
DeviceAllow=/dev/loop-control rw
|
|
DeviceAllow=block-loop rw
|
|
DeviceAllow=block-blkext rw
|
|
|
|
# nspawn can set up LUKS encrypted loopback files, in which case it needs
|
|
# access to /dev/mapper/control and the block devices /dev/mapper/*.
|
|
DeviceAllow=/dev/mapper/control rw
|
|
DeviceAllow=block-device-mapper rw
|
|
|
|
[Install]
|
|
WantedBy=machines.target
|