X-Git-Url: https://git.proxmox.com/?p=pve-docs.git;a=blobdiff_plain;f=pct.adoc;h=014e48d6f9704366ff835003af9d04129c6f1400;hp=95856da31bc5196ff32af9d787d2abe5f12bb3d9;hb=c9f6e1a4f6607851c416c2abdfee350affa47c33;hpb=0585f29ac4ed08d13d073ccc77a344ec0e951d43

diff --git a/pct.adoc b/pct.adoc
index 95856da..014e48d 100644
--- a/pct.adoc
+++ b/pct.adoc
@@ -205,9 +205,28 @@ rewrite ssh_host_keys:: so that each container has unique keys
 
 randomize crontab:: so that cron does not start at the same time on all containers
 
-The above task depends on the OS type, so the implementation is different
-for each OS type. You can also disable any modifications by manually
-setting the 'ostype' to 'unmanaged'.
+Changes made by {PVE} are enclosed by comment markers:
+
+----
+# --- BEGIN PVE ---
+<data>
+# --- END PVE ---
+----
+
+Those markers will be inserted at a reasonable location in the
+file. If such a section already exists, it will be updated in place
+and will not be moved.
+
+Modification of a file can be prevented by adding a `.pve-ignore.`
+file for it.  For instance, if the file `/etc/.pve-ignore.hosts`
+exists then the `/etc/hosts` file will not be touched. This can be a
+simple empty file creatd via:
+
+ # touch /etc/.pve-ignore.hosts
+
+Most modifications are OS dependent, so they differ between different
+distributions and versions. You can completely disable modifications
+by manually setting the 'ostype' to 'unmanaged'.
 
 OS type detection is done by testing for certain files inside the
 container:
@@ -227,6 +246,11 @@ Alpine:: test /etc/alpine-release
 NOTE: Container start fails if the configured 'ostype' differs from the auto
 detected type.
 
+Options
+~~~~~~~
+
+include::pct.conf.5-opts.adoc[]
+
 
 Container Images
 ----------------
@@ -358,6 +382,12 @@ mounting mechanisms or storage technologies, it is possible to
 establish the FUSE mount on the Proxmox host and use a bind
 mount point to make it accessible inside the container.
 
+WARNING: For security reasons, bind mounts should only be established
+using source directories especially reserved for this purpose, e.g., a
+directory hierarchy under `/mnt/bindmounts`. Never bind mount system
+directories like `/`, `/var` or `/etc` into a container - this poses a
+great security risk. The bind mount source path must not contain any symlinks.
+
 The root mount point is configured with the 'rootfs' property, and you can
 configure up to 10 additional mount points. The corresponding options
 are called 'mp0' to 'mp9', and they can contain the following setting: