SYSTEMD-VMSPAWN(1) systemd-vmspawn SYSTEMD-VMSPAWN(1) (NAME) systemd-vmspawn - (SYNOPSIS) systemd-vmspawn [OPTIONS...] [ARGS...] (DESCRIPTION) systemd-vmspawn . systemd-nspawn(1) (namespaces) . (File descriptors) /dev/kvm /dev/vhost-vsock systemd systemd-vmspawn ( sd_listen_fds(3) ) "kvm" "vhost-vsock" . : / systemd-vmspawn VSOCK "kvm" . (OPTIONS) SMBIOS . : -q, --quiet . vmspawn . 256. --system, --user machined machined . root machined machined . 260. (Image Options) -D, --directory= . --directory= --image= . --directory=. . : root subuid --private-users= . /etc/subuid . 256. -x, --ephemeral (snapshot) . --image= . --ephemeral --extra-drive= . 260. -i, --image= ( ) . 255. --image-format=FORMAT --image= . "raw" "qcow2" . "raw" . "qcow2" . 260. --image-disk-type=TYPE --image= . --extra-drive= . "virtio-blk" "virtio-scsi" "nvme" "scsi-cd" . "virtio-blk" . "scsi-cd" CD-ROM . 261. --discard-disk=BOOL qemu (discard) . . . 256. --grow-image=BYTES, -G BYTES --image= . . K M G ( 1024) . 4096 . 258. (Host Configuration) --cpus=CPUS (CPU) . 1 . 255. --ram=BYTES[:MAXBYTES[:SLOTS]] . 2G . (memory hotplug) . 1 . 255. --kvm=BOOL KVM . auto KVM . true KVM . false KVM . 255. --vsock=BOOL VSOCK . auto VSOCK . true VSOCK . false VSOCK . 255. --vsock-cid=CID CID . CID 3 4294967294 (0xFFFF_FFFE) . CID . vmspawn CID CID CID . 255. --tpm=BOOL TPM swtpm(8) . auto vmspawn swtpm . yes swtpm . no TPM . 256. --tpm-state=PATH|auto|off TPM TPM ( --tpm= ). . . "auto" VM ".tpmstate" . "off" TPM VM . VM TPM . "auto" . --ephemeral "auto" "off" . 258. --efi-nvram-template=PATH ./ . EFI NVRAM NVRAM EFI . NVRAM . 261. --efi-nvram-state=PATH|auto|off NVRAM EFI . . . "auto" VM ".efinvramstate" . "off" NVRAM EFI VM . "auto" . --ephemeral "auto" "off" . 261. --secure-boot=BOOL (Secure Boot) . "auto" . yes --firmware-features=secure-boot no --firmware-features=~secure-boot . "auto" "secure-boot" . 255. --firmware=PATH VM . "auto" "uefi" "bios" "none" ./ . "auto" UEFI --linux= PE "none" . "uefi" OVMF ( JSON ). "bios" OVMF QEMU BIOS ( SeaBIOS x86). "none" --linux= . UKI "uefi" . "list" . "describe" UEFI ( --firmware-features=) . . 256. --firmware-features=FEATURE[,FEATURE...] . . . "~" : . . "enrolled-keys" . . "list" . 261. --coco= : systemd ( ). (Confidential VM) . "no" "sev-snp" . "no" . "sev-snp" AMD SEV-SNP . KVM x86_64 SNP . --firmware= OVMF SNP .fd pflash + NVRAM SNP -bios QEMU (Secure Boot) . SMBIOS --set-credential= --load-credential= (launch measurement) SNP . --linux= initrd ("kernel-hashes=on") . vTPM --tpm= . 261. (Networking Options) -n, --network-tap TAP . : TAP root . systemd-networkd(8) . ".network" /usr/lib/systemd/network/80-vm-vt.network . 255. --network-user-mode . 255. (Execution Options) --linux=PATH . --linux= vmspawn XBOOTLDR /boot ESP /efi UAPI.1[1] . . 256. --initrd=PATH initrd . --linux= UAPI.1[1] . initrd . --initrd= vmspawn . 256. --smbios11=STRING, -s STRING SMBIOS Type #11 . . smbios-type-11(7) . 258. --notify-ready= init systemd-vmspawn . true systemd-vmspawn "READY=1" init . false systemd-vmspawn . systemd-vmspawn . sd_notify(3) . true . ( systemd-nspawn(1) false .) 258. (System Identity Options) -M, --machine= . ( machinectl(1) ). 255. --uuid= (UUID) . init /etc/machine-id . /etc/machine-id . 256. (Property Options) -S, --slice= machine.slice (slice) . --keep-unit . 258. --property= . --keep-unit . systemctl set-property . . 258. --register= systemd-machined(8) . "auto" "auto" . machinectl(1) . "auto" . 256. (User Namespacing Options) --private-users=UID_SHIFT[:UID_RANGE] --directory= . virtiofsd(1) (UID GID) . UID/GID ( 0 ) UID/GID ( UID/GID 65536 ). . UID_SHIFT UID/GID UID_RANGE UID/GID . UID_RANGE UID/GID . GID UID . 256. (Mount Options) --bind=PATH, --bind-ro=PATH . : -- -- . . --bind-ro= bind . "\:" . bind . 256. --extra-drive=[FORMAT:][DISKTYPE:]PATH . / . . "raw" --image-disk-type= ( "virtio-blk" ) . "qcow2" . 256. --bind-volume=PROVIDER:VOLUME[:CONFIG][:K=V,...] storagectl(1) . PROVIDER ( "block" "fs"). VOLUME Acquire() . CONFIG "virtio-blk" "virtio-scsi" "nvme" "scsi-cd" . "virtio-blk" . K=V io.systemd.StorageProvider.Acquire() : template= create= ( "any" "new" "open") read-only= ( ro= "auto" ) size= / create-size= ( ) request-as= ( "blk" "reg" "dir" "dir" vmspawn ). "PROVIDER:VOLUME" . machinectl unbind-volume machinectl bind-volume . /run/systemd/io.systemd.StorageProvider/ ( $XDG_RUNTIME_DIR/systemd/io.systemd.StorageProvider/ ) --user / --system . 261. --bind-user= (bind) . . . : 1. /run/vmhost/home/ virtiofs . virtiofsd UID/GID UID/GID . 2. JSON "userdb.transient.*" . UID/GID . nss-systemd(8) glibc NSS / . . ( ). UID/GID . . UID/GID ( --bind-user= ) "" . / systemd 258 nss-systemd nsswitch.conf . nss-systemd(8) . . ( yescrypt "$y$") . 259. --bind-user-shell= --bind-user= . . o false () . . o true . o . : . --bind-user= . 259. --bind-user-group=NAME --bind-user= . . : . --bind-user= . 259. (Logging Options) --forward-journal=FILE|DIR . systemd-journal-remote(8) VM . -o/--output systemd-journal-remote(8) . 256. --forward-journal-max-use=BYTES, --forward-journal-keep-free=BYTES, --forward-journal-max-file-size=BYTES, --forward-journal-max-files=N systemd-journal-remote(8) VM . journal-remote.conf(5) . 261. SSH (SSH Options) --pass-ssh-key=BOOL SSH systemd-vmspawn D-Bus systemd . "no" SSH . systemd-vmspawn . 256. --ssh-key-type=TYPE SSH ssh-keygen(1) . "ed25519" sshd(8) "rsa" . 256. / (Input/Output Options) --console=MODE . "interactive" "read-only" "native" "gui" "headless" . "interactive" . "interactive" . "read-only" . "native" TTY qemu ( qemu ). "gui" qemu . "headless" . 256. --console-transport=TRANSPORT . "virtio" "serial" . "virtio" . "virtio" virtio-serial /dev/hvc0 . "serial" /dev/ttyS0 ( /dev/ttyAMA0 ARM) . --console=interactive --console=read-only --console=native . 261. --background=COLOR ANSI . ANSI X3.64 SGR "40" "41" ... "47" "48;2;..." "48;5;...". ANSI ()[2] . . --console=interactive --console=read-only . 256. (Credentials) --load-credential=ID:PATH, --set-credential=ID:VALUE . LoadCredential= SetCredential= . systemd.exec(5) . --set-credential= C ( "\n" "\x00" NUL). ! SMBIOS Type 11 fw_cfg QEMU . systemd.set_credential_binary= . . 255. (Other) --no-pager . -h, --help . --version . --no-ask-password . (ENVIRONMENT) $SYSTEMD_LOG_LEVEL ( ). . ( ) : emerg alert crit err warning notice info debug 0...7. syslog(3) . console syslog kmsg journal ( SYSTEMD_LOG_LEVEL=debug,console:info debug info ). . $SYSTEMD_LOG_COLOR . true tty . journalctl(1) . $SYSTEMD_LOG_TIME . true . journalctl(1) . $SYSTEMD_LOG_LOCATION . true . . . $SYSTEMD_LOG_TID . true (TID) . . . $SYSTEMD_LOG_TARGET . console ( tty ) console-prefixed ( tty "facility" syslog(3) ) kmsg ( ) journal ( ) journal-or-kmsg ( kmsg) auto ( ) null ( ). $SYSTEMD_LOG_RATELIMIT_KMSG kmsg . . "true" . systemd kmsg . $SYSTEMD_PAGER, $PAGER --no-pager . $SYSTEMD_PAGER $PAGER . $SYSTEMD_PAGER $PAGER less(1) more(1) . . "cat" --no-pager . : $SYSTEMD_PAGERSECURE $SYSTEMD_PAGER $PAGER ( "cat" "") . $SYSTEMD_LESS less ( "FRSXMK"). : K Ctrl+C . less Ctrl+C . $SYSTEMD_LESS "K" less Ctrl+C . X termcap . . . $LESS less systemd . less(1) . $SYSTEMD_LESSCHARSET less ( "utf-8" UTF-8 ). $LESSCHARSET less systemd . $SYSTEMD_PAGERSECURE less(1) <<>> . sudo(8) pkexec(1) . . << >> (secure mode) ( ). << >> --no-pager PAGER=cat . . true << >> . << >> LESSSECURE=1 . less(1) << >> . false . SYSTEMD_PAGERSECURE=0 . $SYSTEMD_PAGERSECURE systemd << >> . UID ( geteuid(2) sd_pid_get_owner_uid(3) ) sudo(8) ( $SUDO_UID [3]) << >> . SYSTEMD_PAGERSECURE=1 << >> . . $SYSTEMD_PAGERSECURE . $SYSTEMD_PAGER $PAGER $SYSTEMD_PAGERSECURE . $SYSTEMD_COLORS . () systemd . $COLORTERM "truecolor" "24bit" $NO_COLOR $TERM . true $NO_COLOR . false . "16", "256", "24bit" ANSI . "auto-16", "auto-256", "auto-24bit" $TERM . $SYSTEMD_URLIFY . . systemd $TERM . (EXAMPLES) . Arch Linux mkosi $ mkosi -d arch -p systemd -p linux --autologin -o image.raw -f build $ systemd-vmspawn --image=image.raw . Fedora 44 Cloud importctl $ curl -L \ -O https://download.fedoraproject.org/pub/fedora/linux/releases/44/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2 \ -O https://download.fedoraproject.org/pub/fedora/linux/releases/44/Cloud/x86_64/images/Fedora-Cloud-44-1.7-x86_64-CHECKSUM \ -O https://fedoraproject.org/fedora.gpg $ gpgv --keyring ./fedora.gpg Fedora-Cloud-44-1.7-x86_64-CHECKSUM $ sha256sum -c Fedora-Cloud-44-1.7-x86_64-CHECKSUM # importctl import-raw -m Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2 fedora-44-cloud # systemd-vmspawn -M fedora-44-cloud . systemd $ mkosi build $ systemd-vmspawn \ -D mkosi.output/system \ --private-users $(grep $(whoami) /etc/subuid | cut -d: -f2) \ --linux mkosi.output/system.efi \ --forward-journal=vm.journal \ enforcing=0 : SELinux (enforcing) . . SSH systemd-ssh-proxy $ mkosi build $ my_vsock_cid=3735928559 $ systemd-vmspawn \ -D mkosi.output/system \ --private-users $(grep $(whoami) /etc/subuid | cut -d: -f2) \ --linux mkosi.output/system.efi \ --vsock-cid $my_vsock_cid \ enforcing=0 $ ssh root@vsock/$my_vsock_cid -i /run/user/$UID/systemd/vmspawn/machine-*-system-ed25519 (EXIT STATUS) errno . EXIT_STATUS . EXIT_SUCCESS . (SEE ALSO) systemd(1), mkosi(1), machinectl(1), importctl(1), UAPI.1[1] (NOTES) 1. UAPI.1 https://uapi- group.org/specifications/specs/boot_loader_specification 2. ANSI () https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_(Select_Graphic_Rendition)_parameters 3. $SUDO_UID . systemd 261.2 SYSTEMD-VMSPAWN(1)