File: lxc.container.conf.sgml.in

package info (click to toggle)
lxc 1%3A1.0.6-6
  • links: PTS, VCS
  • area: main
  • in suites: jessie-kfreebsd
  • size: 4,800 kB
  • sloc: ansic: 33,735; sh: 11,868; python: 1,223; makefile: 734
file content (1657 lines) | stat: -rw-r--r-- 53,079 bytes parent folder | download | duplicates (3)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
<!--

lxc: linux Container library

(C) Copyright IBM Corp. 2007, 2008

Authors:
Daniel Lezcano <daniel.lezcano at free.fr>

This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

-->

<!DOCTYPE refentry PUBLIC @docdtd@ [

<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">
]>

<refentry>

  <docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>

  <refmeta>
    <refentrytitle>lxc.container.conf</refentrytitle>
    <manvolnum>5</manvolnum>
  </refmeta>

  <refnamediv>
    <refname>lxc.container.conf</refname>

    <refpurpose>
      LXC container configuration file
    </refpurpose>
  </refnamediv>

  <refsect1>
    <title>Description</title>

    <para>
      The linux containers (<command>lxc</command>) are always created
      before being used. This creation defines a set of system
      resources to be virtualized / isolated when a process is using
      the container. By default, the pids, sysv ipc and mount points
      are virtualized and isolated. The other system resources are
      shared across containers, until they are explicitly defined in
      the configuration file. For example, if there is no network
      configuration, the network will be shared between the creator of
      the container and the container itself, but if the network is
      specified, a new network stack is created for the container and
      the container can no longer use the network of its ancestor.
    </para>

    <para>
      The configuration file defines the different system resources to
      be assigned for the container. At present, the utsname, the
      network, the mount points, the root file system, the user namespace,
      and the control groups are supported.
    </para>

    <para>
      Each option in the configuration file has the form <command>key
      = value</command> fitting in one line. The '#' character means
      the line is a comment.
    </para>

    <refsect2>
      <title>Configuration</title>
      <para>
	In order to ease administration of multiple related containers, it
	is possible to have a container configuration file cause another
	file to be loaded.  For instance, network configuration
	can be defined in one common file which is included by multiple
	containers.  Then, if the containers are moved to another host,
	only one file may need to be updated.
      </para>

      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.include</option>
	  </term>
	  <listitem>
	    <para>
	      Specify the file to be included.  The included file must be
	      in the same valid lxc configuration file format.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Architecture</title>
      <para>
	Allows one to set the architecture for the container. For example,
	set a 32bits architecture for a container running 32bits
	binaries on a 64bits host. This fixes the container scripts
	which rely on the architecture to do some work like
	downloading the packages.
      </para>

      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.arch</option>
	  </term>
	  <listitem>
	    <para>
	      Specify the architecture for the container.
	    </para>
	    <para>
	      Valid options are
	      <option>x86</option>,
	      <option>i686</option>,
	      <option>x86_64</option>,
	      <option>amd64</option>
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>

    </refsect2>

    <refsect2>
      <title>Hostname</title>
      <para>
	The utsname section defines the hostname to be set for the
	container. That means the container can set its own hostname
	without changing the one from the system. That makes the
	hostname private for the container.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.utsname</option>
	  </term>
	  <listitem>
	    <para>
	      specify the hostname for the container
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Halt signal</title>
      <para>
    Allows one to specify signal name or number, sent by lxc-stop to the
    container's init process to cleanly shutdown the container. Different
    init systems could use different signals to perform clean shutdown
    sequence. This option allows the signal to be specified in kill(1)
    fashion, e.g. SIGPWR, SIGRTMIN+14, SIGRTMAX-10 or plain number. The
    default signal is SIGPWR.
      </para>
      <variablelist>
    <varlistentry>
      <term>
        <option>lxc.haltsignal</option>
      </term>
      <listitem>
        <para>
          specify the signal used to halt the container
        </para>
      </listitem>
    </varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Stop signal</title>
      <para>
    Allows one to specify signal name or number, sent by lxc-stop to forcibly
    shutdown the container. This option allows signal to be specified in
    kill(1) fashion, e.g. SIGKILL, SIGRTMIN+14, SIGRTMAX-10 or plain number.
    The default signal is SIGKILL.
      </para>
      <variablelist>
    <varlistentry>
      <term>
        <option>lxc.stopsignal</option>
      </term>
      <listitem>
        <para>
          specify the signal used to stop the container
        </para>
      </listitem>
    </varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Network</title>
      <para>
	The network section defines how the network is virtualized in
	the container. The network virtualization acts at layer
	two. In order to use the network virtualization, parameters
	must be specified to define the network interfaces of the
	container. Several virtual interfaces can be assigned and used
	in a container even if the system has only one physical
	network interface.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.network.type</option>
	  </term>
	  <listitem>
	    <para>
	      specify what kind of network virtualization to be used
	      for the container. Each time
	      a <option>lxc.network.type</option> field is found a new
	      round of network configuration begins. In this way,
	      several network virtualization types can be specified
	      for the same container, as well as assigning several
	      network interfaces for one container. The different
	      virtualization types can be:
	    </para>

	    <para>
	      <option>none:</option> will cause the container to share
	      the host's network namespace.  This means the host
	      network devices are usable in the container.  It also
	      means that if both the container and host have upstart as
	      init, 'halt' in a container (for instance) will shut down the
	      host.
	    </para>

	    <para>
	      <option>empty:</option> will create only the loopback
	      interface.
	    </para>

	    <para>
	      <option>veth:</option> a peer network device is created
	      with one side assigned to the container and the other
	      side is attached to a bridge specified by
	      the <option>lxc.network.link</option>. If the bridge is
	      not specified, then the veth pair device will be created
	      but not attached to any bridge. Otherwise, the bridge
	      has to be setup before on the
	      system, <command>lxc</command> won't handle any
	      configuration outside of the container.  By
	      default <command>lxc</command> choose a name for the
	      network device belonging to the outside of the
	      container, this name is handled
	      by <command>lxc</command>, but if you wish to handle
	      this name yourself, you can tell <command>lxc</command>
	      to set a specific name with
	      the <option>lxc.network.veth.pair</option> option (except for
	      unprivileged containers where this option is ignored for security
	      reasons).
	    </para>

	    <para>
	      <option>vlan:</option> a vlan interface is linked with
	      the interface specified by
	      the <option>lxc.network.link</option> and assigned to
	      the container. The vlan identifier is specified with the
	      option <option>lxc.network.vlan.id</option>.
	    </para>

	    <para>
	      <option>macvlan:</option> a macvlan interface is linked
	      with the interface specified by
	      the <option>lxc.network.link</option> and assigned to
	      the container.
	      <option>lxc.network.macvlan.mode</option> specifies the
	      mode the macvlan will use to communicate between
	      different macvlan on the same upper device. The accepted
	      modes are <option>private</option>, the device never
	      communicates with any other device on the same upper_dev (default),
	      <option>vepa</option>, the new Virtual Ethernet Port
	      Aggregator (VEPA) mode, it assumes that the adjacent
	      bridge returns all frames where both source and
	      destination are local to the macvlan port, i.e. the
	      bridge is set up as a reflective relay.  Broadcast
	      frames coming in from the upper_dev get flooded to all
	      macvlan interfaces in VEPA mode, local frames are not
	      delivered locally, or <option>bridge</option>, it
	      provides the behavior of a simple bridge between
	      different macvlan interfaces on the same port. Frames
	      from one interface to another one get delivered directly
	      and are not sent out externally. Broadcast frames get
	      flooded to all other bridge ports and to the external
	      interface, but when they come back from a reflective
	      relay, we don't deliver them again.  Since we know all
	      the MAC addresses, the macvlan bridge mode does not
	      require learning or STP like the bridge module does.
	    </para>

	    <para>
	      <option>phys:</option> an already existing interface
	      specified by the <option>lxc.network.link</option> is
	      assigned to the container.
	    </para>
	  </listitem>
	  </varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.flags</option>
	  </term>
	  <listitem>
	    <para>
	      specify an action to do for the
	      network.
	    </para>

	    <para><option>up:</option> activates the interface.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.link</option>
	  </term>
	  <listitem>
	    <para>
	      specify the interface to be used for real network
	      traffic.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.mtu</option>
	  </term>
	  <listitem>
	    <para>
	      specify the maximum transfer unit for this interface.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.name</option>
	  </term>
	  <listitem>
	    <para>
	      the interface name is dynamically allocated, but if
	      another name is needed because the configuration files
	      being used by the container use a generic name,
	      eg. eth0, this option will rename the interface in the
	      container.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.hwaddr</option>
	  </term>
	  <listitem>
	    <para>
	      the interface mac address is dynamically allocated by
	      default to the virtual interface, but in some cases,
	      this is needed to resolve a mac address conflict or to
	      always have the same link-local ipv6 address.
	      Any "x" in address will be replaced by random value,
	      this allows setting hwaddr templates.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.ipv4</option>
	  </term>
	  <listitem>
	    <para>
	      specify the ipv4 address to assign to the virtualized
	      interface. Several lines specify several ipv4 addresses.
	      The address is in format x.y.z.t/m,
	      eg. 192.168.1.123/24. The broadcast address should be
	      specified on the same line, right after the ipv4
	      address.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.ipv4.gateway</option>
	  </term>
	  <listitem>
	    <para>
	      specify the ipv4 address to use as the gateway inside the
	      container. The address is in format x.y.z.t, eg.
	      192.168.1.123.

	      Can also have the special value <option>auto</option>,
	      which means to take the primary address from the bridge
	      interface (as specified by the
	      <option>lxc.network.link</option> option) and use that as
	      the gateway. <option>auto</option> is only available when
	      using the <option>veth</option> and
	      <option>macvlan</option> network types.
	    </para>
	  </listitem>
	</varlistentry>


	<varlistentry>
	  <term>
	    <option>lxc.network.ipv6</option>
	  </term>
	  <listitem>
	    <para>
	      specify the ipv6 address to assign to the virtualized
	      interface. Several lines specify several ipv6 addresses.
	      The address is in format x::y/m,
	      eg. 2003:db8:1:0:214:1234:fe0b:3596/64
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.ipv6.gateway</option>
	  </term>
	  <listitem>
	    <para>
	      specify the ipv6 address to use as the gateway inside the
	      container. The address is in format x::y,
	      eg. 2003:db8:1:0::1

	      Can also have the special value <option>auto</option>,
	      which means to take the primary address from the bridge
	      interface (as specified by the
	      <option>lxc.network.link</option> option) and use that as
	      the gateway. <option>auto</option> is only available when
	      using the <option>veth</option> and
	      <option>macvlan</option> network types.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.script.up</option>
	  </term>
	  <listitem>
	    <para>
	      add a configuration option to specify a script to be
	      executed after creating and configuring the network used
	      from the host side. The following arguments are passed
	      to the script: container name and config section name
	      (net) Additional arguments depend on the config section
	      employing a script hook; the following are used by the
	      network system: execution context (up), network type
	      (empty/veth/macvlan/phys), Depending on the network
	      type, other arguments may be passed:
	      veth/macvlan/phys. And finally (host-sided) device name.
	    </para>
	    <para>
	      Standard output from the script is logged at debug level.
	      Standard error is not logged, but can be captured by the
	      hook redirecting its standard error to standard output.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.network.script.down</option>
	  </term>
	  <listitem>
	    <para>
	      add a configuration option to specify a script to be
	      executed before destroying the network used from the
	      host side. The following arguments are passed to the
	      script: container name and config section name (net)
	      Additional arguments depend on the config section
	      employing a script hook; the following are used by the
	      network system: execution context (down), network type
	      (empty/veth/macvlan/phys), Depending on the network
	      type, other arguments may be passed:
	      veth/macvlan/phys. And finally (host-sided) device name.
	    </para>
	    <para>
	      Standard output from the script is logged at debug level.
	      Standard error is not logged, but can be captured by the
	      hook redirecting its standard error to standard output.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>New pseudo tty instance (devpts)</title>
      <para>
	For stricter isolation the container can have its own private
	instance of the pseudo tty.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.pts</option>
	  </term>
	  <listitem>
	    <para>
	      If set, the container will have a new pseudo tty
	      instance, making this private to it. The value specifies
              the maximum number of pseudo ttys allowed for a pts
              instance (this limitation is not implemented yet).
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Container system console</title>
      <para>
	If the container is configured with a root filesystem and the
	inittab file is setup to use the console, you may want to specify
	where the output of this console goes.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.console.logfile</option>
	  </term>
	  <listitem>
	    <para>
	      Specify a path to a file where the console output will
	      be written.
	    </para>
	  </listitem>
	</varlistentry>
	<varlistentry>
	  <term>
	    <option>lxc.console</option>
	  </term>
	  <listitem>
	    <para>
	      Specify a path to a device to which the console will be
	      attached.  The keyword 'none' will simply disable the
	      console.  This is dangerous once if have a rootfs with a
	      console device file where the application can write, the
	      messages will fall in the host.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Console through the ttys</title>
      <para>
	This option is useful if the container is configured with a root
	filesystem and the inittab file is setup to launch a getty on the
	ttys. The option specifies the number of ttys to be available for
	the container. The number of gettys in the inittab file of the
	container should not be greater than the number of ttys	specified
	in this option, otherwise the excess getty sessions will die and
	respawn indefinitely giving annoying messages on the console or in
	<filename>/var/log/messages</filename>.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.tty</option>
	  </term>
	  <listitem>
	    <para>
	      Specify the number of tty to make available to the
	      container.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Console devices location</title>
      <para>
        LXC consoles are provided through Unix98 PTYs created on the
	host and bind-mounted over the expected devices in the container.
	By default, they are bind-mounted over <filename>/dev/console</filename>
	and <filename>/dev/ttyN</filename>.  This can prevent package upgrades
	in the guest.  Therefore you can specify a directory location (under
	<filename>/dev</filename> under which LXC will create the files and
	bind-mount over them.  These will then be symbolically linked to
	<filename>/dev/console</filename> and <filename>/dev/ttyN</filename>.
	A package upgrade can then succeed as it is able to remove and replace
	the symbolic links.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.devttydir</option>
	  </term>
	  <listitem>
	    <para>
	      Specify a directory under <filename>/dev</filename>
	      under which to create the container console devices.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>/dev directory</title>
      <para>
	By default, lxc creates a few symbolic links (fd,stdin,stdout,stderr)
	in the container's <filename>/dev</filename> directory but does not
	automatically create device node entries. This allows the container's
	<filename>/dev</filename> to be set up as needed in the container
	rootfs.  If lxc.autodev is set to 1, then after mounting the container's
	rootfs LXC will mount a fresh tmpfs under <filename>/dev</filename>
	(limited to 100k) and fill in a minimal set of initial devices.
        This is generally required when starting a container containing
        a "systemd" based "init" but may be optional at other times.  Additional
        devices in the containers /dev directory may be created through the
        use of the <option>lxc.hook.autodev</option> hook.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.autodev</option>
	  </term>
	  <listitem>
	    <para>
	      Set this to 1 to have LXC mount and populate a minimal
	      <filename>/dev</filename> when starting the container.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Enable kmsg symlink</title>
      <para>
      Enable creating /dev/kmsg as symlink to /dev/console.  This defaults to 1.
      </para>
      <variablelist>
    <varlistentry>
      <term>
        <option>lxc.kmsg</option>
      </term>
      <listitem>
        <para>
          Set this to 0 to disable /dev/kmsg symlinking.
        </para>
      </listitem>
    </varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Mount points</title>
      <para>
	The mount points section specifies the different places to be
	mounted. These mount points will be private to the container
	and won't be visible by the processes running outside of the
	container. This is useful to mount /etc, /var or /home for
	examples.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.mount</option>
	  </term>
	  <listitem>
	    <para>
	      specify a file location in
	      the <filename>fstab</filename> format, containing the
	      mount information.  The mount target location can and in
	      most cases should be a relative path, which will become
	      relative to the mounted container root.  For instance,
	     </para>
<screen>
proc proc proc nodev,noexec,nosuid 0 0
</screen>
	     <para>
	      Will mount a proc filesystem under the container's /proc,
	      regardless of where the root filesystem comes from.  This
	      is resilient to block device backed filesystems as well as
	      container cloning.
	     </para>
	     <para>
	      Note that when mounting a filesystem from an
	      image file or block device the third field (fs_vfstype)
	      cannot be auto as with
              <citerefentry>
		<refentrytitle>mount</refentrytitle>
                <manvolnum>8</manvolnum>
              </citerefentry>
              but must be explicitly specified.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.mount.entry</option>
	  </term>
	  <listitem>
	    <para>
	      specify a mount point corresponding to a line in the
	      fstab format.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.mount.auto</option>
	  </term>
	  <listitem>
	    <para>
	      specify which standard kernel file systems should be
	      automatically mounted. This may dramatically simplify
	      the configuration. The file systems are:
	    </para>
	    <itemizedlist>
	      <listitem>
	        <para>
	          <option>proc:mixed</option> (or <option>proc</option>):
	          mount <filename>/proc</filename> as read-write, but
	          remount <filename>/proc/sys</filename> and
	          <filename>/proc/sysrq-trigger</filename> read-only
	          for security / container isolation purposes.
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>proc:rw</option>: mount
	          <filename>/proc</filename> as read-write
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>sys:ro</option> (or <option>sys</option>):
	          mount <filename>/sys</filename> as read-only
	          for security / container isolation purposes.
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>sys:rw</option>: mount
	          <filename>/sys</filename> as read-write
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup:mixed</option>:
	          mount a tmpfs to <filename>/sys/fs/cgroup</filename>,
	          create directories for all hierarchies to which
	          the container is added, create subdirectories
	          there with the name of the cgroup, and bind-mount
	          the container's own cgroup into that directory.
	          The container will be able to write to its own
	          cgroup directory, but not the parents, since they
	          will be remounted read-only
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup:ro</option>: similar to
	          <option>cgroup:mixed</option>, but everything will
	        be mounted read-only.
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup:rw</option>: similar to
	          <option>cgroup:mixed</option>, but everything will
	          be mounted read-write. Note that the paths leading
	          up to the container's own cgroup will be writable,
	          but will not be a cgroup filesystem but just part
	          of the tmpfs of <filename>/sys/fs/cgroup</filename>
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup</option> (without specifier):
	          defaults to <option>cgroup:rw</option> if the
	          container retains the CAP_SYS_ADMIN capability,
	          <option>cgroup:mixed</option> otherwise.
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup-full:mixed</option>:
	          mount a tmpfs to <filename>/sys/fs/cgroup</filename>,
	          create directories for all hierarchies to which
	          the container is added, bind-mount the hierarchies
	          from the host to the container and make everything
	          read-only except the container's own cgroup. Note
	          that compared to <option>cgroup</option>, where
	          all paths leading up to the container's own cgroup
	          are just simple directories in the underlying
	          tmpfs, here
	          <filename>/sys/fs/cgroup/$hierarchy</filename>
	          will contain the host's full cgroup hierarchy,
	          albeit read-only outside the container's own cgroup.
	          This may leak quite a bit of information into the
	          container.
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup-full:ro</option>: similar to
	          <option>cgroup-full:mixed</option>, but everything
	          will be mounted read-only.
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup-full:rw</option>: similar to
	          <option>cgroup-full:mixed</option>, but everything
	          will be mounted read-write. Note that in this case,
	          the container may escape its own cgroup. (Note also
	          that if the container has CAP_SYS_ADMIN support
	          and can mount the cgroup filesystem itself, it may
	          do so anyway.)
	        </para>
	      </listitem>
	      <listitem>
	        <para>
	          <option>cgroup-full</option> (without specifier):
	          defaults to <option>cgroup-full:rw</option> if the
	          container retains the CAP_SYS_ADMIN capability,
	          <option>cgroup-full:mixed</option> otherwise.
	        </para>
	      </listitem>
	    </itemizedlist>
	    <para>
	      Note that if automatic mounting of the cgroup filesystem
	      is enabled, the tmpfs under
	      <filename>/sys/fs/cgroup</filename> will always be
	      mounted read-write (but for the <option>:mixed</option>
	      and <option>:ro</option> cases, the individual
	      hierarchies,
	      <filename>/sys/fs/cgroup/$hierarchy</filename>, will be
	      read-only). This is in order to work around a quirk in
	      Ubuntu's
              <citerefentry>
		<refentrytitle>mountall</refentrytitle>
                <manvolnum>8</manvolnum>
              </citerefentry>
	      command that will cause containers to wait for user
	      input at boot if
	      <filename>/sys/fs/cgroup</filename> is mounted read-only
	      and the container can't remount it read-write due to a
	      lack of CAP_SYS_ADMIN.
	    </para>
	    <para>
	      Examples:
	    </para>
	    <programlisting>
	      lxc.mount.auto = proc sys cgroup
	      lxc.mount.auto = proc:rw sys:rw cgroup-full:rw
	    </programlisting>
	  </listitem>
	</varlistentry>

      </variablelist>
    </refsect2>

    <refsect2>
      <title>Root file system</title>
      <para>
	The root file system of the container can be different than that
	of the host system.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.rootfs</option>
	  </term>
	  <listitem>
	    <para>
	      specify the root file system for the container. It can
	      be an image file, a directory or a block device. If not
	      specified, the container shares its root file system
	      with the host.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.rootfs.mount</option>
	  </term>
	  <listitem>
	    <para>
	      where to recursively bind <option>lxc.rootfs</option>
	      before pivoting.  This is to ensure success of the
	      <citerefentry>
		<refentrytitle><command>pivot_root</command></refentrytitle>
		<manvolnum>8</manvolnum>
	      </citerefentry>
	      syscall.  Any directory suffices, the default should
	      generally work.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.rootfs.options</option>
	  </term>
	  <listitem>
	    <para>
	      extra mount options to use when mounting the rootfs.
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term>
	    <option>lxc.pivotdir</option>
	  </term>
	  <listitem>
	    <para>
	      where to pivot the original root file system under
	      <option>lxc.rootfs</option>, specified relatively to
	      that.  The default is <filename>mnt</filename>.
	      It is created if necessary, and also removed after
	      unmounting everything from it during container setup.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Control group</title>
      <para>
	The control group section contains the configuration for the
	different subsystem. <command>lxc</command> does not check the
	correctness of the subsystem name. This has the disadvantage
	of not detecting configuration errors until the container is
	started, but has the advantage of permitting any future
	subsystem.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.cgroup.[subsystem name]</option>
	  </term>
	  <listitem>
	    <para>
	      specify the control group value to be set.  The
	      subsystem name is the literal name of the control group
	      subsystem.  The permitted names and the syntax of their
	      values is not dictated by LXC, instead it depends on the
	      features of the Linux kernel running at the time the
	      container is started,
	      eg. <option>lxc.cgroup.cpuset.cpus</option>
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Capabilities</title>
      <para>
	The capabilities can be dropped in the container if this one
	is run as root.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.cap.drop</option>
	  </term>
	  <listitem>
	    <para>
	      Specify the capability to be dropped in the container. A
	      single line defining several capabilities with a space
	      separation is allowed. The format is the lower case of
	      the capability definition without the "CAP_" prefix,
	      eg. CAP_SYS_MODULE should be specified as
	      sys_module. See
	      <citerefentry>
		<refentrytitle><command>capabilities</command></refentrytitle>
		<manvolnum>7</manvolnum>
	      </citerefentry>,
	    </para>
	  </listitem>
	</varlistentry>
	<varlistentry>
	  <term>
	    <option>lxc.cap.keep</option>
	  </term>
	  <listitem>
	    <para>
	      Specify the capability to be kept in the container. All other
	      capabilities will be dropped.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Apparmor profile</title>
      <para>
	If lxc was compiled and installed with apparmor support, and the host
	system has apparmor enabled, then the apparmor profile under which the
	container should be run can be specified in the container
	configuration.  The default is <command>lxc-container-default</command>.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.aa_profile</option>
	  </term>
	  <listitem>
	    <para>
	      Specify the apparmor profile under which the container should
	      be run.  To specify that the container should be unconfined,
	      use
	    </para>
	      <programlisting>lxc.aa_profile = unconfined</programlisting>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>SELinux context</title>
      <para>
	If lxc was compiled and installed with SELinux support, and the host
	system has SELinux enabled, then the SELinux context under which the
	container should be run can be specified in the container
	configuration.  The default is <command>unconfined_t</command>,
	which means that lxc will not attempt to change contexts.
	See @DATADIR@/lxc/selinux/lxc.te for an example policy and more
	information.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.se_context</option>
	  </term>
	  <listitem>
	    <para>
	      Specify the SELinux context under which the container should
	      be run or <command>unconfined_t</command>. For example
	    </para>
	    <programlisting>lxc.se_context = system_u:system_r:lxc_t:s0:c22</programlisting>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Seccomp configuration</title>
      <para>
        A container can be started with a reduced set of available
	system calls by loading a seccomp profile at startup.  The
	seccomp configuration file must begin with a version number
	on the first line, a policy type on the second line, followed
	by the configuration.
      </para>
      <para>
        Versions 1 and 2 are currently supported.  In version 1, the
	policy is a simple whitelist.  The second line therefore must
	read "whitelist", with the rest of the file containing one (numeric)
	sycall number per line.  Each syscall number is whitelisted,
	while every unlisted number is blacklisted for use in the container
      </para>

      <para>
       In version 2, the policy may be blacklist or whitelist,
       supports per-rule and per-policy default actions, and supports
       per-architecture system call resolution from textual names.
      </para>
      <para>
       An example blacklist policy, in which all system calls are
       allowed except for mknod, which will simply do nothing and
       return 0 (success), looks like:
      </para>
<screen>
2
blacklist
mknod errno 0
</screen>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.seccomp</option>
	  </term>
	  <listitem>
	    <para>
	      Specify a file containing the seccomp configuration to
	      load before the container starts.
	     </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>UID mappings</title>
      <para>
        A container can be started in a private user namespace with
	user and group id mappings.  For instance, you can map userid
	0 in the container to userid 200000 on the host.  The root
	user in the container will be privileged in the container,
	but unprivileged on the host.  Normally a system container
	will want a range of ids, so you would map, for instance,
	user and group ids 0 through 20,000 in the container to the
	ids 200,000 through 220,000.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.id_map</option>
	  </term>
	  <listitem>
	    <para>
	      Four values must be provided.  First a character, either
	      'u', or 'g', to specify whether user or group ids are
	      being mapped.  Next is the first userid as seen in the
	      user namespace of the container.  Next is the userid as
	      seen on the host.  Finally, a range indicating the number
	      of consecutive ids to map.
	     </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Container hooks</title>
      <para>
        Container hooks are programs or scripts which can be executed
	at various times in a container's lifetime.
      </para>
      <para>
        When a container hook is executed, information is passed both
	as command line arguments and through environment variables.
	The arguments are:
	<itemizedlist>
	  <listitem><para> Container name. </para></listitem>
	  <listitem><para> Section (always 'lxc'). </para></listitem>
	  <listitem><para> The hook type (i.e. 'clone' or 'pre-mount'). </para></listitem>
	  <listitem><para> Additional arguments In the
	  case of the clone hook, any extra arguments passed to
	  lxc-clone will appear as further arguments to the hook. </para></listitem>
	</itemizedlist>
	The following environment variables are set:
	<itemizedlist>
	  <listitem><para> LXC_NAME: is the container's name. </para></listitem>
	  <listitem><para> LXC_ROOTFS_MOUNT: the path to the mounted root filesystem. </para></listitem>
	  <listitem><para> LXC_CONFIG_FILE: the path to the container configuration file. </para></listitem>
	  <listitem><para> LXC_SRC_NAME: in the case of the clone hook, this is the original container's name. </para></listitem>
	  <listitem><para> LXC_ROOTFS_PATH: this is the lxc.rootfs entry for the container.  Note this is likely not where the mounted rootfs is to be found, use LXC_ROOTFS_MOUNT for that. </para></listitem>
	</itemizedlist>
      </para>
      <para>
        Standard output from the hooks is logged at debug level.
        Standard error is not logged, but can be captured by the
        hook redirecting its standard error to standard output.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.hook.pre-start</option>
	  </term>
	  <listitem>
	    <para>
	      A hook to be run in the host's namespace before the
	      container ttys, consoles, or mounts are up.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.hook.pre-mount</option>
	  </term>
	  <listitem>
	    <para>
	      A hook to be run in the container's fs namespace but before
	      the rootfs has been set up.  This allows for manipulation
	      of the rootfs, i.e. to mount an encrypted filesystem.  Mounts
	      done in this hook will not be reflected on the host (apart from
	      mounts propagation), so they will be automatically cleaned up
	      when the container shuts down.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.hook.mount</option>
	  </term>
	  <listitem>
	    <para>
	      A hook to be run in the container's namespace after
	      mounting has been done, but before the pivot_root.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.hook.autodev</option>
	  </term>
	  <listitem>
	    <para>
	      A hook to be run in the container's namespace after
	      mounting has been done and after any mount hooks have
	      run, but before the pivot_root, if
	      <option>lxc.autodev</option> == 1.
	      The purpose of this hook is to assist in populating the
	      /dev directory of the container when using the autodev
	      option for systemd based containers.  The container's /dev
	      directory is relative to the
	      ${<option>LXC_ROOTFS_MOUNT</option>} environment
	      variable available when the hook is run.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.hook.start</option>
	  </term>
	  <listitem>
	    <para>
	      A hook to be run in the container's namespace immediately
	      before executing the container's init.  This requires the
	      program to be available in the container.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.hook.post-stop</option>
	  </term>
	  <listitem>
	    <para>
	      A hook to be run in the host's namespace after the
	      container has been shut down.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.hook.clone</option>
	  </term>
	  <listitem>
	    <para>
	      A hook to be run when the container is cloned to a new one.
	      See <citerefentry><refentrytitle><command>lxc-clone</command></refentrytitle>
	      <manvolnum>1</manvolnum></citerefentry> for more information.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
      <title>Container hooks Environment Variables</title>
      <para>
        A number of environment variables are made available to the startup
        hooks to provide configuration information and assist in the
        functioning of the hooks.  Not all variables are valid in all
        contexts.  In particular, all paths are relative to the host system
        and, as such, not valid during the <option>lxc.hook.start</option> hook.
      </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>LXC_NAME</option>
	  </term>
	  <listitem>
	    <para>
	      The LXC name of the container.  Useful for logging messages
	      in common log environments.  [<option>-n</option>]
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>LXC_CONFIG_FILE</option>
	  </term>
	  <listitem>
	    <para>
	      Host relative path to the container configuration file.  This
	      gives the container to reference the original, top level,
	      configuration file for the container in order to locate any
	      additional configuration information not otherwise made
	      available.  [<option>-f</option>]
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>LXC_CONSOLE</option>
	  </term>
	  <listitem>
	    <para>
	      The path to the console output of the container if not NULL.
	      [<option>-c</option>] [<option>lxc.console</option>]
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>LXC_CONSOLE_LOGPATH</option>
	  </term>
	  <listitem>
	    <para>
	      The path to the console log output of the container if not NULL.
	      [<option>-L</option>]
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>LXC_ROOTFS_MOUNT</option>
	  </term>
	  <listitem>
	    <para>
	      The mount location to which the container is initially bound.
	      This will be the host relative path to the container rootfs
	      for the container instance being started and is where changes
	      should be made for that instance.
	      [<option>lxc.rootfs.mount</option>]
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>LXC_ROOTFS_PATH</option>
	  </term>
	  <listitem>
	    <para>
	      The host relative path to the container root which has been
	      mounted to the rootfs.mount location.
	      [<option>lxc.rootfs</option>]
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>

    </refsect2>
    <refsect2>
    <title>Logging</title>
    <para>
      Logging can be configured on a per-container basis.  By default,
      depending upon how the lxc package was compiled, container startup
      is logged only at the ERROR level, and logged to a file named after
      the container (with '.log' appended) either under the container path,
      or under @LOGPATH@.
    </para>
    <para>
      Both the default log level and the log file can be specified in the
      container configuration file, overriding the default behavior.  Note
      that the configuration file entries can in turn be overridden by the
      command line options to <command>lxc-start</command>.
    </para>
      <variablelist>
	<varlistentry>
	  <term>
	    <option>lxc.loglevel</option>
	  </term>
	  <listitem>
	    <para>
	    The level at which to log.  The log level is an integer in
	    the range of 0..8 inclusive, where a lower number means more
	    verbose debugging.  In particular 0 = trace, 1 = debug, 2 =
	    info, 3 = notice, 4 = warn, 5 = error, 6 = critical, 7 =
	    alert, and 8 = fatal.  If unspecified, the level defaults
	    to 5 (error), so that only errors and above are logged.
	    </para>
	    <para>
	    Note that when a script (such as either a hook script or a
	    network interface up or down script) is called, the script's
	    standard output is logged at level 1, debug.
	    </para>
	  </listitem>
	</varlistentry>
	<varlistentry>
	  <term>
	    <option>lxc.logfile</option>
	  </term>
	  <listitem>
	    <para>
	    The file to which logging info should be written.
	    </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
    <title>Autostart</title>
    <para>
        The autostart options support marking which containers should be
        auto-started and in what order. These options may be used by LXC tools
        directly or by external tooling provided by the distributions.
    </para>

    <variablelist>
        <varlistentry>
          <term>
            <option>lxc.start.auto</option>
          </term>
          <listitem>
            <para>
              Whether the container should be auto-started.
              Valid values are 0 (off) and 1 (on).
            </para>
          </listitem>
        </varlistentry>
        <varlistentry>
          <term>
            <option>lxc.start.delay</option>
          </term>
          <listitem>
            <para>
              How long to wait (in seconds) after the container is
              started before starting the next one.
            </para>
          </listitem>
        </varlistentry>
        <varlistentry>
          <term>
            <option>lxc.start.order</option>
          </term>
          <listitem>
            <para>
              An integer used to sort the containers when auto-starting
              a series of containers at once.
            </para>
          </listitem>
        </varlistentry>
        <varlistentry>
          <term>
            <option>lxc.group</option>
          </term>
          <listitem>
            <para>
              A multi-value key (can be used multiple times) to put the
              container in a container group. Those groups can then be
              used (amongst other things) to start a series of related
              containers.
            </para>
          </listitem>
        </varlistentry>
      </variablelist>
    </refsect2>

    <refsect2>
    <title>Autostart and System Boot</title>
    <para>
          Each container can be part of any number of groups or no group at all.
          Two groups are special. One is the NULL group, i.e. the container does
          not belong to any group. The other group is the "onboot" group.
    </para>

    <para>
          When the system boots with the LXC service enabled, it will first
          attempt to boot any containers with lxc.start.auto == 1 that is a member
          of the "onboot" group. The startup will be in order of lxc.start.order.
          If an lxc.start.delay has been specified, that delay will be honored
          before attempting to start the next container to give the current
          container time to begin initialization and reduce overloading the host
          system. After starting the members of the "onboot" group, the LXC system
          will proceed to boot containers with lxc.start.auto == 1 which are not
          members of any group (the NULL group) and proceed as with the onboot
          group.
    </para>

    </refsect2>
  </refsect1>

  <refsect1>
    <title>Examples</title>
      <para>
	In addition to the few examples given below, you will find
	some other examples of configuration file in @DOCDIR@/examples
      </para>
    <refsect2>
      <title>Network</title>
      <para>This configuration sets up a container to use a veth pair
	device with one side plugged to a bridge br0 (which has been
	configured before on the system by the administrator). The
	virtual network device visible in the container is renamed to
	eth0.</para>
      <programlisting>
	lxc.utsname = myhostname
	lxc.network.type = veth
	lxc.network.flags = up
	lxc.network.link = br0
	lxc.network.name = eth0
	lxc.network.hwaddr = 4a:49:43:49:79:bf
	lxc.network.ipv4 = 10.2.3.5/24 10.2.3.255
	lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3597
      </programlisting>
    </refsect2>

    <refsect2>
      <title>UID/GID mapping</title>
      <para>This configuration will map both user and group ids in the
        range 0-9999 in the container to the ids 100000-109999 on the host.
      </para>
      <programlisting>
	lxc.id_map = u 0 100000 10000
	lxc.id_map = g 0 100000 10000
      </programlisting>
    </refsect2>

    <refsect2>
      <title>Control group</title>
      <para>This configuration will setup several control groups for
      the application, cpuset.cpus restricts usage of the defined cpu,
      cpus.share prioritize the control group, devices.allow makes
      usable the specified devices.</para>
      <programlisting>
	lxc.cgroup.cpuset.cpus = 0,1
	lxc.cgroup.cpu.shares = 1234
	lxc.cgroup.devices.deny = a
	lxc.cgroup.devices.allow = c 1:3 rw
	lxc.cgroup.devices.allow = b 8:0 rw
      </programlisting>
    </refsect2>

    <refsect2>
      <title>Complex configuration</title>
      <para>This example show a complex configuration making a complex
      network stack, using the control groups, setting a new hostname,
      mounting some locations and a changing root file system.</para>
      <programlisting>
	lxc.utsname = complex
	lxc.network.type = veth
	lxc.network.flags = up
	lxc.network.link = br0
	lxc.network.hwaddr = 4a:49:43:49:79:bf
	lxc.network.ipv4 = 10.2.3.5/24 10.2.3.255
	lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3597
	lxc.network.ipv6 = 2003:db8:1:0:214:5432:feab:3588
	lxc.network.type = macvlan
	lxc.network.flags = up
	lxc.network.link = eth0
	lxc.network.hwaddr = 4a:49:43:49:79:bd
	lxc.network.ipv4 = 10.2.3.4/24
	lxc.network.ipv4 = 192.168.10.125/24
	lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3596
	lxc.network.type = phys
	lxc.network.flags = up
	lxc.network.link = dummy0
	lxc.network.hwaddr = 4a:49:43:49:79:ff
	lxc.network.ipv4 = 10.2.3.6/24
	lxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3297
	lxc.cgroup.cpuset.cpus = 0,1
	lxc.cgroup.cpu.shares = 1234
	lxc.cgroup.devices.deny = a
	lxc.cgroup.devices.allow = c 1:3 rw
	lxc.cgroup.devices.allow = b 8:0 rw
	lxc.mount = /etc/fstab.complex
	lxc.mount.entry = /lib /root/myrootfs/lib none ro,bind 0 0
	lxc.rootfs = /mnt/rootfs.complex
	lxc.cap.drop = sys_module mknod setuid net_raw
	lxc.cap.drop = mac_override
      </programlisting>
    </refsect2>

  </refsect1>

  <refsect1>
    <title>See Also</title>
    <simpara>
      <citerefentry>
	<refentrytitle><command>chroot</command></refentrytitle>
	<manvolnum>1</manvolnum>
      </citerefentry>,

      <citerefentry>
	<refentrytitle><command>pivot_root</command></refentrytitle>
	<manvolnum>8</manvolnum>
      </citerefentry>,

      <citerefentry>
	<refentrytitle><filename>fstab</filename></refentrytitle>
	<manvolnum>5</manvolnum>
      </citerefentry>,

      <citerefentry>
	<refentrytitle><filename>capabilities</filename></refentrytitle>
	<manvolnum>7</manvolnum>
      </citerefentry>
    </simpara>
  </refsect1>

  &seealso;

  <refsect1>
    <title>Author</title>
    <para>Daniel Lezcano <email>daniel.lezcano@free.fr</email></para>
  </refsect1>

</refentry>

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:2
sgml-indent-data:t
sgml-parent-document:nil
sgml-default-dtd-file:nil
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
-->