pct.conf.5-opts.adoc

   1 `arch`: `<amd64 | arm64 | armhf | i386 | riscv32 | riscv64>` ('default =' `amd64`)::
   2
   3 OS architecture type.
   4
   5 `cmode`: `<console | shell | tty>` ('default =' `tty`)::
   6
   7 Console mode. By default, the console command tries to open a connection to one of the available tty devices. By setting cmode to 'console' it tries to attach to /dev/console instead. If you set cmode to 'shell', it simply invokes a shell inside the container (no login).
   8
   9 `console`: `<boolean>` ('default =' `1`)::
  10
  11 Attach a console device (/dev/console) to the container.
  12
  13 `cores`: `<integer> (1 - 8192)` ::
  14
  15 The number of cores assigned to the container. A container can use all available cores by default.
  16
  17 `cpulimit`: `<number> (0 - 8192)` ('default =' `0`)::
  18
  19 Limit of CPU usage.
  20 +
  21 NOTE: If the computer has 2 CPUs, it has a total of '2' CPU time. Value '0' indicates no CPU limit.
  22
  23 `cpuunits`: `<integer> (0 - 500000)` ('default =' `cgroup v1: 1024, cgroup v2: 100`)::
  24
  25 CPU weight for a container. Argument is used in the kernel fair scheduler. The larger the number is, the more CPU time this container gets. Number is relative to the weights of all the other running guests.
  26
  27 `debug`: `<boolean>` ('default =' `0`)::
  28
  29 Try to be more verbose. For now this only enables debug log-level on start.
  30
  31 `description`: `<string>` ::
  32
  33 Description for the Container. Shown in the web-interface CT's summary. This is saved as comment inside the configuration file.
  34
  35 `dev[n]`: `[[path=]<Path>] [,gid=<integer>] [,mode=<Octal access mode>] [,uid=<integer>]` ::
  36
  37 Device to pass through to the container
  38
  39 `gid`=`<integer> (0 - N)` ;;
  40
  41 Group ID to be assigned to the device node
  42
  43 `mode`=`<Octal access mode>` ;;
  44
  45 Access mode to be set on the device node
  46
  47 `path`=`<Path>` ;;
  48
  49 Path to the device to pass through to the container
  50
  51 `uid`=`<integer> (0 - N)` ;;
  52
  53 User ID to be assigned to the device node
  54
  55 `features`: `[force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
  56
  57 Allow containers access to advanced features.
  58
  59 `force_rw_sys`=`<boolean>` ('default =' `0`);;
  60
  61 Mount /sys in unprivileged containers as `rw` instead of `mixed`. This can break networking under newer (>= v245) systemd-network use.
  62
  63 `fuse`=`<boolean>` ('default =' `0`);;
  64
  65 Allow using 'fuse' file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.
  66
  67 `keyctl`=`<boolean>` ('default =' `0`);;
  68
  69 For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.
  70
  71 `mknod`=`<boolean>` ('default =' `0`);;
  72
  73 Allow unprivileged containers to use mknod() to add certain device nodes. This requires a kernel with seccomp trap to user space support (5.3 or newer). This is experimental.
  74
  75 `mount`=`<fstype;fstype;...>` ;;
  76
  77 Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container's security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host's I/O completely and prevent it from rebooting, etc.
  78
  79 `nesting`=`<boolean>` ('default =' `0`);;
  80
  81 Allow nesting. Best used with unprivileged containers with additional id mapping. Note that this will expose procfs and sysfs contents of the host to the guest.
  82
  83 `hookscript`: `<string>` ::
  84
  85 Script that will be exectued during various steps in the containers lifetime.
  86
  87 `hostname`: `<string>` ::
  88
  89 Set a host name for the container.
  90
  91 `lock`: `<backup | create | destroyed | disk | fstrim | migrate | mounted | rollback | snapshot | snapshot-delete>` ::
  92
  93 Lock/unlock the container.
  94
  95 `memory`: `<integer> (16 - N)` ('default =' `512`)::
  96
  97 Amount of RAM for the container in MB.
  98
  99 `mp[n]`: `[volume=]<volume> ,mp=<Path> [,acl=<1|0>] [,backup=<1|0>] [,mountoptions=<opt[;opt...]>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
 100
 101 Use volume as container mount point. Use the special syntax STORAGE_ID:SIZE_IN_GiB to allocate a new volume.
 102
 103 `acl`=`<boolean>` ;;
 104
 105 Explicitly enable or disable ACL support.
 106
 107 `backup`=`<boolean>` ;;
 108
 109 Whether to include the mount point in backups (only used for volume mount points).
 110
 111 `mountoptions`=`<opt[;opt...]>` ;;
 112
 113 Extra mount options for rootfs/mps.
 114
 115 `mp`=`<Path>` ;;
 116
 117 Path to the mount point as seen from inside the container.
 118 +
 119 NOTE: Must not contain any symlinks for security reasons.
 120
 121 `quota`=`<boolean>` ;;
 122
 123 Enable user quotas inside the container (not supported with zfs subvolumes)
 124
 125 `replicate`=`<boolean>` ('default =' `1`);;
 126
 127 Will include this volume to a storage replica job.
 128
 129 `ro`=`<boolean>` ;;
 130
 131 Read-only mount point
 132
 133 `shared`=`<boolean>` ('default =' `0`);;
 134
 135 Mark this non-volume mount point as available on all nodes.
 136 +
 137 WARNING: This option does not share the mount point automatically, it assumes it is shared already!
 138
 139 `size`=`<DiskSize>` ;;
 140
 141 Volume size (read only value).
 142
 143 `volume`=`<volume>` ;;
 144
 145 Volume, device or directory to mount into the container.
 146
 147 `nameserver`: `<string>` ::
 148
 149 Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
 150
 151 `net[n]`: `name=<string> [,bridge=<bridge>] [,firewall=<1|0>] [,gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,hwaddr=<XX:XX:XX:XX:XX:XX>] [,ip=<(IPv4/CIDR|dhcp|manual)>] [,ip6=<(IPv6/CIDR|auto|dhcp|manual)>] [,link_down=<1|0>] [,mtu=<integer>] [,rate=<mbps>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,type=<veth>]` ::
 152
 153 Specifies network interfaces for the container.
 154
 155 `bridge`=`<bridge>` ;;
 156
 157 Bridge to attach the network device to.
 158
 159 `firewall`=`<boolean>` ;;
 160
 161 Controls whether this interface's firewall rules should be used.
 162
 163 `gw`=`<GatewayIPv4>` ;;
 164
 165 Default gateway for IPv4 traffic.
 166
 167 `gw6`=`<GatewayIPv6>` ;;
 168
 169 Default gateway for IPv6 traffic.
 170
 171 `hwaddr`=`<XX:XX:XX:XX:XX:XX>` ;;
 172
 173 A common MAC address with the I/G (Individual/Group) bit not set.
 174
 175 `ip`=`<(IPv4/CIDR|dhcp|manual)>` ;;
 176
 177 IPv4 address in CIDR format.
 178
 179 `ip6`=`<(IPv6/CIDR|auto|dhcp|manual)>` ;;
 180
 181 IPv6 address in CIDR format.
 182
 183 `link_down`=`<boolean>` ;;
 184
 185 Whether this interface should be disconnected (like pulling the plug).
 186
 187 `mtu`=`<integer> (64 - 65535)` ;;
 188
 189 Maximum transfer unit of the interface. (lxc.network.mtu)
 190
 191 `name`=`<string>` ;;
 192
 193 Name of the network device as seen from inside the container. (lxc.network.name)
 194
 195 `rate`=`<mbps>` ;;
 196
 197 Apply rate limiting to the interface
 198
 199 `tag`=`<integer> (1 - 4094)` ;;
 200
 201 VLAN tag for this interface.
 202
 203 `trunks`=`<vlanid[;vlanid...]>` ;;
 204
 205 VLAN ids to pass through the interface
 206
 207 `type`=`<veth>` ;;
 208
 209 Network interface type.
 210
 211 `onboot`: `<boolean>` ('default =' `0`)::
 212
 213 Specifies whether a container will be started during system bootup.
 214
 215 `ostype`: `<alpine | archlinux | centos | debian | devuan | fedora | gentoo | nixos | opensuse | ubuntu | unmanaged>` ::
 216
 217 OS type. This is used to setup configuration inside the container, and corresponds to lxc setup scripts in /usr/share/lxc/config/<ostype>.common.conf. Value 'unmanaged' can be used to skip and OS specific setup.
 218
 219 `protection`: `<boolean>` ('default =' `0`)::
 220
 221 Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.
 222
 223 `rootfs`: `[volume=]<volume> [,acl=<1|0>] [,mountoptions=<opt[;opt...]>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
 224
 225 Use volume as container root.
 226
 227 `acl`=`<boolean>` ;;
 228
 229 Explicitly enable or disable ACL support.
 230
 231 `mountoptions`=`<opt[;opt...]>` ;;
 232
 233 Extra mount options for rootfs/mps.
 234
 235 `quota`=`<boolean>` ;;
 236
 237 Enable user quotas inside the container (not supported with zfs subvolumes)
 238
 239 `replicate`=`<boolean>` ('default =' `1`);;
 240
 241 Will include this volume to a storage replica job.
 242
 243 `ro`=`<boolean>` ;;
 244
 245 Read-only mount point
 246
 247 `shared`=`<boolean>` ('default =' `0`);;
 248
 249 Mark this non-volume mount point as available on all nodes.
 250 +
 251 WARNING: This option does not share the mount point automatically, it assumes it is shared already!
 252
 253 `size`=`<DiskSize>` ;;
 254
 255 Volume size (read only value).
 256
 257 `volume`=`<volume>` ;;
 258
 259 Volume, device or directory to mount into the container.
 260
 261 `searchdomain`: `<string>` ::
 262
 263 Sets DNS search domains for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
 264
 265 `startup`: `[[order=]\d+] [,up=\d+] [,down=\d+] ` ::
 266
 267 Startup and shutdown behavior. Order is a non-negative number defining the general startup order. Shutdown in done with reverse ordering. Additionally you can set the 'up' or 'down' delay in seconds, which specifies a delay to wait before the next VM is started or stopped.
 268
 269 `swap`: `<integer> (0 - N)` ('default =' `512`)::
 270
 271 Amount of SWAP for the container in MB.
 272
 273 `tags`: `<string>` ::
 274
 275 Tags of the Container. This is only meta information.
 276
 277 `template`: `<boolean>` ('default =' `0`)::
 278
 279 Enable/disable Template.
 280
 281 `timezone`: `<string>` ::
 282
 283 Time zone to use in the container. If option isn't set, then nothing will be done. Can be set to 'host' to match the host time zone, or an arbitrary time zone option from /usr/share/zoneinfo/zone.tab
 284
 285 `tty`: `<integer> (0 - 6)` ('default =' `2`)::
 286
 287 Specify the number of tty available to the container
 288
 289 `unprivileged`: `<boolean>` ('default =' `0`)::
 290
 291 Makes the container run as unprivileged user. (Should not be modified manually.)
 292
 293 `unused[n]`: `[volume=]<volume>` ::
 294
 295 Reference to unused volumes. This is used internally, and should not be modified manually.
 296
 297 `volume`=`<volume>` ;;
 298
 299 The volume that is not used currently.
 300