update static data and schema definitions

[pve-docs.git] / pct.conf.5-opts.adoc

diff --git a/pct.conf.5-opts.adoc b/pct.conf.5-opts.adoc
index d1e27c875b93aabc58bf09cac8083026c5b5f08e..1a88936fc7442e0423851ec283cfe1f8f563dc91 100644 (file)
--- a/pct.conf.5-opts.adoc
+++ b/pct.conf.5-opts.adoc
@@ -30,10 +30,14 @@ NOTE: You can disable fair-scheduler configuration by setting this to 0.
 
 Container description. Only used on the configuration web interface.
 
-`features`: `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+`features`: `[force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
 
 Allow containers access to advanced features.
 
+`force_rw_sys`=`<boolean>` ('default =' `0`);;
+
+Mount /sys in unprivileged containers as `rw` instead of `mixed`. This can break networking under newer (>= v245) systemd-network use.
+
 `fuse`=`<boolean>` ('default =' `0`);;
 
 Allow using 'fuse' file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.
@@ -42,6 +46,10 @@ Allow using 'fuse' file systems in a container. Note that interactions between f
 
 For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.
 
+`mknod`=`<boolean>` ('default =' `0`);;
+
+Allow unprivileged containers to use mknod() to add certain device nodes. This requires a kernel with seccomp trap to user space support (5.3 or newer). This is experimental.
+
 `mount`=`<fstype;fstype;...>` ;;
 
 Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container's security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host's I/O completely and prevent it from rebooting, etc.
@@ -252,7 +260,11 @@ Specify the number of tty available to the container
 
 Makes the container run as unprivileged user. (Should not be modified manually.)
 
-`unused[n]`: `<string>` ::
+`unused[n]`: `[volume=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
+`volume`=`<volume>` ;;
+
+The volume that is not used currently.
+