add bind mount warning

[pve-docs.git] / pct.adoc

diff --git a/pct.adoc b/pct.adoc
index 5710d0feafa30ff7c17475a14d5ea38c76e853f2..014e48d6f9704366ff835003af9d04129c6f1400 100644 (file)
--- a/pct.adoc
+++ b/pct.adoc
@@ -205,9 +205,28 @@ rewrite ssh_host_keys:: so that each container has unique keys
 
 randomize crontab:: so that cron does not start at the same time on all containers
 
-The above task depends on the OS type, so the implementation is different
-for each OS type. You can also disable any modifications by manually
-setting the 'ostype' to 'unmanaged'.
+Changes made by {PVE} are enclosed by comment markers:
+
+----
+# --- BEGIN PVE ---
+<data>
+# --- END PVE ---
+----
+
+Those markers will be inserted at a reasonable location in the
+file. If such a section already exists, it will be updated in place
+and will not be moved.
+
+Modification of a file can be prevented by adding a `.pve-ignore.`
+file for it.  For instance, if the file `/etc/.pve-ignore.hosts`
+exists then the `/etc/hosts` file will not be touched. This can be a
+simple empty file creatd via:
+
+ # touch /etc/.pve-ignore.hosts
+
+Most modifications are OS dependent, so they differ between different
+distributions and versions. You can completely disable modifications
+by manually setting the 'ostype' to 'unmanaged'.
 
 OS type detection is done by testing for certain files inside the
 container:
@@ -227,6 +246,11 @@ Alpine:: test /etc/alpine-release
 NOTE: Container start fails if the configured 'ostype' differs from the auto
 detected type.
 
+Options
+~~~~~~~
+
+include::pct.conf.5-opts.adoc[]
+
 
 Container Images
 ----------------
@@ -358,6 +382,12 @@ mounting mechanisms or storage technologies, it is possible to
 establish the FUSE mount on the Proxmox host and use a bind
 mount point to make it accessible inside the container.
 
+WARNING: For security reasons, bind mounts should only be established
+using source directories especially reserved for this purpose, e.g., a
+directory hierarchy under `/mnt/bindmounts`. Never bind mount system
+directories like `/`, `/var` or `/etc` into a container - this poses a
+great security risk. The bind mount source path must not contain any symlinks.
+
 The root mount point is configured with the 'rootfs' property, and you can
 configure up to 10 additional mount points. The corresponding options
 are called 'mp0' to 'mp9', and they can contain the following setting:
@@ -453,7 +483,8 @@ set the address and gateway, while it's running
 
 Reduce the memory of the container to 512MB
 
- pct set -memory 512 100
+ pct set 100 -memory 512
+
 
 Files
 ------