virt-sandbox-service-create man page

virt-sandbox-service create — Create a Security container

Synopsis

virt-sandbox-service [-c URI] create [-h] [-C] [-f FILE_TYPE]
                                 [--homedir HOMEDIR] [-G GID] [-i IMAGESIZE]
                                 [[-m TYPE:DST=SRC ] ...]
                                 [-N NETWORK] [-p PATH] [-s SECURITY]
                                 [[-u UNITFILES] ...] [--username USERNAME]
                                 [-U UID] [[-P package] ... ]
                                 NAME -- COMMAND [ARG1 [ARG2...]]

Description

virt-sandbox-service is used to manage secure sandboxed system services. These applications will be launched via libvirt and run within a virtualization technology such as LinuX Containers (LXC), or optionally QEMU/KVM. The container / virtual machines will be secured by SELinux and resource separated using cgroups.

The create command can setup a sandbox for running one or more systemd unit files. It can also setup a sandbox for running a command in an GenericContainer. Specify a unit file to create the SystemdContainer and the command to create an GenericContainer.

Options

-h, --help
Display help message
-c URI, --connect URI
The connection URI for the hypervisor (currently only LXC URIs are supported).
-u UNIT_FILE, --unitfile UNIT_FILE
Name of the systemd unit file to be to run within the Systemd Container. Can be repeated if multiple unit files are required within the sandbox. Cannot be specified if you are using a COMMAND. If the unit file end with @, this will be considered as a template, and a instantiated systemd unit will be created, using the name of the container as a instance identifier.
-C, --copy
Copy content from /etc and /var directories that will be mounted within the container.
-G GID, --gid GID
Set login gid to use within the container.

Default: "Login GID of UID".
-f FILETYPE, --filetype FILETYPE
Set SELinux file type to use within container.

Default: "svirt_lxc_file_t".
-p PATH, --path PATH
Set path to store container content. NB if this argument is used when creating a container, the exact same argument must also be used when later cloning or deleting the container.

Default: "/var/lib/libvirt/filesystems".
--homedir HOMEDIR
Set homedir path to use within container.

Default: "UID's Homedir".
-m TYPE:DST=SRC, --mount TYPE:DST=SRC

Sets up a mount inside the sandbox at DST backed by SRC. The meaning of SRC depends on the value of "TYPE" specified:

host-bind
If TYPE is host-bind, then SRC is interpreted as the path to a directory on the host filesystem. If "SRC" is the empty string, then a temporary (empty) directory is created on the host before starting the sandbox and deleted afterwards. The "--include" option is useful for populating these temporary directories with copies of host files.
host-image
If TYPE is host-image, then SRC is interpreted as the path to a disk image file on the host filesystem. The image should be formatted with a filesystem that can be auto-detected by the sandbox, such as ext3, ext4, etc. The disk image itself should be a raw file, not qcow2 or any other special format
guest-bind
If TYPE is guest-bind, then SRC is interpreted as the path to another directory in the container filesystem.
ram
If TYPE is ram, then SRC is interpreted as specifying the size of the RAM disk in bytes. The suffix K, KiB, M, MiB, G, GiB can used to alter the units from bytes to a coarser level.

Some examples

-m host-bind:/tmp=/var/lib/sandbox/demo/tmp
-m host-image:/=/var/lib/sandbox/demo.img
-m guest-bind:/home=/tmp/home
-m ram:/tmp=500M
-N NETWORK-OPTIONS, --network NETWORK-OPTIONS

Add a network interface to the sandbox. By default the sandbox will only have a loopback interface. This option allows for connectivity to the LAN in some manner. NETWORK-OPTIONS is a set of key=val pairs, separated by commas. The following options are valid

dhcp

Configure the network interface using dhcp. This key takes no value. No other keys may be specified. eg

-N dhcp,source=default
--network dhcp,source=lan

where 'source' is the name of any libvirt virtual network.

source=NETWORK
Set the name of the network to connect the interface to. "NETWORK" is the name of any libvirt virtual network. See also virsh net-list
mac=NN:NN:NN:NN:NN:NN
Set the MAC address of the network interface, where each NN is a pair of hex digits.
address=IP-ADDRESS/PREFIX%BROADCAST

Configure the network interface with the static IPv4 or IPv6 address IP-ADDRESS. The PREFIX value is the length of the network prefix in IP-ADDRESS. The optional BROADCAST parameter specifies the broadcast address. Some examples

address=192.168.122.1/24
address=192.168.122.1/24%192.168.122.255
address=2001:212::204:2/64
route=IP-NETWORK/PREFIX%GATEWAY

Configure the network interface with the static IPv4 or IPv6 route IP-NETWORK. The PREFIX value is the length of the network prefix in IP-NETWORK. The GATEWAY parameter specifies the address of the gateway for the route. Some examples

route=192.168.122.255/24%192.168.1.1
-s SECURITY-OPTIONS, --security=SECURITY-OPTIONS

Use alternative security options. SECURITY-OPTIONS is a set of key=val pairs, separated by commas. The following options are valid for SELinux

dynamic
Dynamically allocate an SELinux label, using the default base context. The default base context is system_u:system_r:svirt_lxc_net_t:s0 for LXC, system_u:system_r:svirt_t:s0 for KVM, system_u:system_r:svirt_tcg_t:s0 for QEMU.
dynamic,label=USER:ROLE:TYPE:LEVEL
Dynamically allocate an SELinux label, using the base context USER:ROLE:TYPE:LEVEL, instead of the default base context.
static,label=USER:ROLE:TYPE:LEVEL
To set a completely static label. For example, static,label=system_u:system_r:svirt_t:s0:c412,c355
-i SIZE, --image SIZE
Create file system image file of this size to store container content.
-P PACKAGE, --package PACKAGE
Package(s) to be used within the container.
-U UID, --uid UID
Set uid to use within container.

Default: "CURRENT UID".
--username USERNAME
Set username to use within container.

Default: "UID's Username".

Example

Create httpd1 Systemd container

# virt-sandbox-service create -C -u httpd.service httpd1
Created container dir /var/lib/libvirt/filesystems/httpd1
Created sandbox config /etc/libvirt-sandbox/services/httpd1/config/sandbox.cfg
Created unit file /etc/systemd/system/httpd@httpd1.service

Create foobar1 Generic container

# virt-sandbox-service create -U 1234 foobar1 -- /usr/bin/foobar -a -b
Created container dir /var/lib/libvirt/filesystems/foobar1
Created sandbox config /etc/libvirt-sandbox/services/foobar1/config/sandbox.cfg

See Also

libvirt(8), selinux(8), systemd(8), "virt-sandbox-service(1)"

Files

Container content will be stored in subdirectories of "/var/lib/libvirt/filesystems", by default. You can manage the content in these directories outside of the container and processes within the container will see the content.

Authors

Daniel Walsh <dwalsh@redhat.com> Daniel P. Berrange <dan@berrange.com>

License

virt-sandbox is distributed under the terms of the GNU LGPL v2+. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE

Referenced By

virt-sandbox-service(1).

2015-07-01 libvirt-sandbox-0.6.0 Virtualization Support