storage: fixup PBS wiki link

[pve-docs.git] / pct.conf.5-opts.adoc

diff --git a/pct.conf.5-opts.adoc b/pct.conf.5-opts.adoc
index d1e27c875b93aabc58bf09cac8083026c5b5f08e..09aca49d6c1c55a2b6822c3dfc498c445c81fb1a 100644 (file)
--- a/pct.conf.5-opts.adoc
+++ b/pct.conf.5-opts.adoc
@@ -30,10 +30,14 @@ NOTE: You can disable fair-scheduler configuration by setting this to 0.
 
 Container description. Only used on the configuration web interface.
 
-`features`: `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+`features`: `[force_rw_sys=<1|0>] [,fuse=<1|0>] [,keyctl=<1|0>] [,mknod=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
 
 Allow containers access to advanced features.
 
+`force_rw_sys`=`<boolean>` ('default =' `0`);;
+
+Mount /sys in unprivileged containers as `rw` instead of `mixed`. This can break networking under newer (>= v245) systemd-network use.
+
 `fuse`=`<boolean>` ('default =' `0`);;
 
 Allow using 'fuse' file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.
@@ -42,6 +46,10 @@ Allow using 'fuse' file systems in a container. Note that interactions between f
 
 For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.
 
+`mknod`=`<boolean>` ('default =' `0`);;
+
+Allow unprivileged containers to use mknod() to add certain device nodes. This requires a kernel with seccomp trap to user space support (5.3 or newer). This is experimental.
+
 `mount`=`<fstype;fstype;...>` ;;
 
 Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container's security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host's I/O completely and prevent it from rebooting, etc.
@@ -244,6 +252,10 @@ Tags of the Container. This is only meta information.
 
 Enable/disable Template.
 
+`timezone`: `<string>` ::
+
+Time zone to use in the container. If option isn't set, then nothing will be done. Can be set to 'host' to match the host time zone, or an arbitrary time zone option from /usr/share/zoneinfo/zone.tab
+
 `tty`: `<integer> (0 - 6)` ('default =' `2`)::
 
 Specify the number of tty available to the container
@@ -252,7 +264,11 @@ Specify the number of tty available to the container
 
 Makes the container run as unprivileged user. (Should not be modified manually.)
 
-`unused[n]`: `<string>` ::
+`unused[n]`: `[volume=]<volume>` ::
 
 Reference to unused volumes. This is used internally, and should not be modified manually.
 
+`volume`=`<volume>` ;;
+
+The volume that is not used currently.
+