Fixed some typos and slight language improvements

[pve-docs.git] / pct.conf.5-opts.adoc

diff --git a/pct.conf.5-opts.adoc b/pct.conf.5-opts.adoc
index 793b3e70e0d8040b054c1b8fc14d09d3ff94cc89..b62e386d006dd16866e7838786fd50d6ae46614c 100644 (file)
--- a/pct.conf.5-opts.adoc
+++ b/pct.conf.5-opts.adoc
@@ -1,4 +1,4 @@
-`arch`: `<amd64 | i386>` ('default =' `amd64`)::
+`arch`: `<amd64 | arm64 | armhf | i386>` ('default =' `amd64`)::
 
 OS architecture type.
 
@@ -30,11 +30,35 @@ NOTE: You can disable fair-scheduler configuration by setting this to 0.
 
 Container description. Only used on the configuration web interface.
 
+`features`: `[fuse=<1|0>] [,keyctl=<1|0>] [,mount=<fstype;fstype;...>] [,nesting=<1|0>]` ::
+
+Allow containers access to advanced features.
+
+`fuse`=`<boolean>` ('default =' `0`);;
+
+Allow using 'fuse' file systems in a container. Note that interactions between fuse and the freezer cgroup can potentially cause I/O deadlocks.
+
+`keyctl`=`<boolean>` ('default =' `0`);;
+
+For unprivileged containers only: Allow the use of the keyctl() system call. This is required to use docker inside a container. By default unprivileged containers will see this system call as non-existent. This is mostly a workaround for systemd-networkd, as it will treat it as a fatal error when some keyctl() operations are denied by the kernel due to lacking permissions. Essentially, you can choose between running systemd-networkd or docker.
+
+`mount`=`<fstype;fstype;...>` ;;
+
+Allow mounting file systems of specific types. This should be a list of file system types as used with the mount command. Note that this can have negative effects on the container's security. With access to a loop device, mounting a file can circumvent the mknod permission of the devices cgroup, mounting an NFS file system can block the host's I/O completely and prevent it from rebooting, etc.
+
+`nesting`=`<boolean>` ('default =' `0`);;
+
+Allow nesting. Best used with unprivileged containers with additional id mapping. Note that this will expose procfs and sysfs contents of the host to the guest.
+
+`hookscript`: `<string>` ::
+
+Script that will be exectued during various steps in the containers lifetime.
+
 `hostname`: `<string>` ::
 
 Set a host name for the container.
 
-`lock`: `<backup | migrate | rollback | snapshot>` ::
+`lock`: `<backup | disk | migrate | mounted | rollback | snapshot | snapshot-delete>` ::
 
 Lock/unlock the VM.
 
@@ -42,7 +66,7 @@ Lock/unlock the VM.
 
 Amount of RAM for the VM in MB.
 
-`mp[n]`: `[volume=]<volume> ,mp=<Path> [,acl=<1|0>] [,backup=<1|0>] [,quota=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
+`mp[n]`: `[volume=]<volume> ,mp=<Path> [,acl=<1|0>] [,backup=<1|0>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
 
 Use volume as container mount point.
 
@@ -64,6 +88,10 @@ NOTE: Must not contain any symlinks for security reasons.
 
 Enable user quotas inside the container (not supported with zfs subvolumes)
 
+`replicate`=`<boolean>` ('default =' `1`);;
+
+Will include this volume to a storage replica job.
+
 `ro`=`<boolean>` ;;
 
 Read-only mount point
@@ -86,7 +114,7 @@ Volume, device or directory to mount into the container.
 
 Sets DNS server IP address for a container. Create will automatically use the setting from the host if you neither set searchdomain nor nameserver.
 
-`net[n]`: `name=<string> [,bridge=<bridge>] [,firewall=<1|0>] [,gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,hwaddr=<XX:XX:XX:XX:XX:XX>] [,ip=<IPv4Format/CIDR>] [,ip6=<IPv6Format/CIDR>] [,mtu=<integer>] [,rate=<mbps>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,type=<veth>]` ::
+`net[n]`: `name=<string> [,bridge=<bridge>] [,firewall=<1|0>] [,gw=<GatewayIPv4>] [,gw6=<GatewayIPv6>] [,hwaddr=<XX:XX:XX:XX:XX:XX>] [,ip=<(IPv4/CIDR|dhcp|manual)>] [,ip6=<(IPv6/CIDR|auto|dhcp|manual)>] [,mtu=<integer>] [,rate=<mbps>] [,tag=<integer>] [,trunks=<vlanid[;vlanid...]>] [,type=<veth>]` ::
 
 Specifies network interfaces for the container.
 
@@ -110,11 +138,11 @@ Default gateway for IPv6 traffic.
 
 The interface MAC address. This is dynamically allocated by default, but you can set that statically if needed, for example to always have the same link-local IPv6 address. (lxc.network.hwaddr)
 
-`ip`=`<IPv4Format/CIDR>` ;;
+`ip`=`<(IPv4/CIDR|dhcp|manual)>` ;;
 
 IPv4 address in CIDR format.
 
-`ip6`=`<IPv6Format/CIDR>` ;;
+`ip6`=`<(IPv6/CIDR|auto|dhcp|manual)>` ;;
 
 IPv6 address in CIDR format.
 
@@ -154,7 +182,7 @@ OS type. This is used to setup configuration inside the container, and correspon
 
 Sets the protection flag of the container. This will prevent the CT or CT's disk remove/update operation.
 
-`rootfs`: `[volume=]<volume> [,acl=<1|0>] [,quota=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
+`rootfs`: `[volume=]<volume> [,acl=<1|0>] [,quota=<1|0>] [,replicate=<1|0>] [,ro=<1|0>] [,shared=<1|0>] [,size=<DiskSize>]` ::
 
 Use volume as container root.
 
@@ -166,6 +194,10 @@ Explicitly enable or disable ACL support.
 
 Enable user quotas inside the container (not supported with zfs subvolumes)
 
+`replicate`=`<boolean>` ('default =' `1`);;
+
+Will include this volume to a storage replica job.
+
 `ro`=`<boolean>` ;;
 
 Read-only mount point