buildsys: switch upload dist over to buster

[pve-docs.git] / pct.conf.5-opts.adoc

diff --git a/pct.conf.5-opts.adoc b/pct.conf.5-opts.adoc
index 793b3e70e0d8040b054c1b8fc14d09d3ff94cc89..7fb42b724a5aa7b8dd11c2a2cfef1667075cd771 100644 (file)
--- a/pct.conf.5-opts.adoc
+++ b/pct.conf.5-opts.adoc
@@ -1,4 +1,4 @@
-`arch`: `<amd64 | i386>` ('default =' `amd64`)::
+`arch`: `<amd64 | arm64 | armhf | i386>` ('default =' `amd64`)::
 
 OS architecture type.
 
@@ -30,11 +30,35 @@ NOTE: You can disable fair-scheduler configuration by setting this to 0.
 
 Container description. Only used on the configuration web interface.
 
+`features`: `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+
+Allow containers access to advanced features.
+
+`fuse`=`<boolean>` ('default =' `0`);;
+
+Allow using 'fuse' file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.
+
+`keyctl`=`<boolean>` ('default =' `0`);;
+
+For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.
+
+`mount`=`<fstype;fstype;...>` ;;
+
+Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container's security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host's I/O completely and prevent it from rebooting, etc.
+
+`nesting`=`<boolean>` ('default =' `0`);;
+
+Allow nesting. Best used with unprivileged containers with additional id mapping. Note that this will expose procfs and sysfs contents of the host to the guest.
+
+`hookscript`: `<string>` ::
+
+Script that will be exectued during various steps in the containers lifetime.
+
 `hostname`: `<string>` ::
 
 Set a host name for the container.
 
-`lock`: `<backup | migrate | rollback | snapshot>` ::
+`lock`: `<backup | create | disk | fstrim | migrate | mounted | rollback | snapshot | snapshot-delete>` ::
 
 Lock/unlock the VM.
 
@@ -42,7 +66,7 @@ Lock/unlock the VM.
 
 Amount of RAM for the VM in MB.
 
-`mp[n]`: `[volume=]<volume> ,mp=<Path> [,acl=<1|0>] [,backup=<1|0>] [,quota=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
+`mp[n]`: `[volume=]<volume> ,mp=<Path> [,acl=<1|0>] [,backup=<1|0>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
 
 Use volume as container mount point.
 
@@ -64,6 +88,10 @@ NOTE: Must not contain any symlinks for security reasons.
 
 Enable user quotas inside the container (not supported with zfs subvolumes)
 
+`replicate`=`<boolean>` ('default =' `1`);;
+
+Will include this volume to a storage replica job.
+
 `ro`=`<boolean>` ;;
 
 Read-only mount point
@@ -86,7 +114,7 @@ Volume, device or directory to mount into the container.
 
 Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
 
-`net[n]`: `name=<string> [,bridge=<bridge>] [,firewall=<1|0>] [,gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,hwaddr=<XX:XX:XX:XX:XX:XX>] [,ip=<IPv4Format/CIDR>] [,ip6=<IPv6Format/CIDR>] [,mtu=<integer>] [,rate=<mbps>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,type=<veth>]` ::
+`net[n]`: `name=<string> [,bridge=<bridge>] [,firewall=<1|0>] [,gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,hwaddr=<XX:XX:XX:XX:XX:XX>] [,ip=<(IPv4/CIDR|dhcp|manual)>] [,ip6=<(IPv6/CIDR|auto|dhcp|manual)>] [,mtu=<integer>] [,rate=<mbps>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,type=<veth>]` ::
 
 Specifies network interfaces for the container.
 
@@ -108,13 +136,13 @@ Default gateway for IPv6 traffic.
 
 `hwaddr`=`<XX:XX:XX:XX:XX:XX>` ;;
 
-The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)
+A common MAC address with the I/G (Individual/Group) bit not set.
 
-`ip`=`<IPv4Format/CIDR>` ;;
+`ip`=`<(IPv4/CIDR|dhcp|manual)>` ;;
 
 IPv4 address in CIDR format.
 
-`ip6`=`<IPv6Format/CIDR>` ;;
+`ip6`=`<(IPv6/CIDR|auto|dhcp|manual)>` ;;
 
 IPv6 address in CIDR format.
 
@@ -154,7 +182,7 @@ OS type. This is used to setup configuration inside the container, and correspon
 
 Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.
 
-`rootfs`: `[volume=]<volume> [,acl=<1|0>] [,quota=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
+`rootfs`: `[volume=]<volume> [,acl=<1|0>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
 
 Use volume as container root.
 
@@ -166,6 +194,10 @@ Explicitly enable or disable ACL support.
 
 Enable user quotas inside the container (not supported with zfs subvolumes)
 
+`replicate`=`<boolean>` ('default =' `1`);;
+
+Will include this volume to a storage replica job.
+
 `ro`=`<boolean>` ;;
 
 Read-only mount point