nss-mymachines(8) — Linux manual page

NAME | SYNOPSIS | DESCRIPTION | CONFIGURATION IN /ETC/NSSWITCH.CONF | MAPPINGS PROVIDED BY NSS-MYMACHINES | SEE ALSO | COLOPHON

NSS-MYMACHINES(8)              nss-mymachines              NSS-MYMACHINES(8)

NAME         top

       nss-mymachines, libnss_mymachines.so.2 - Provide hostname resolution
       for local container instances.

SYNOPSIS         top

       libnss_mymachines.so.2

DESCRIPTION         top

       nss-mymachines is a plug-in module for the GNU Name Service Switch
       (NSS) functionality of the GNU C Library (glibc), providing hostname
       resolution for the names of containers running locally that are
       registered with systemd-machined.service(8). The container names are
       resolved to the IP addresses of the specific container, ordered by
       their scope. This functionality only applies to containers using
       network namespacing (see the description of --private-network in
       systemd-nspawn(1)). Note that the name that is resolved is the one
       registered with systemd-machined, which may be different than the
       hostname configured inside of the container.

       The module also provides name resolution for user and group
       identifiers mapped to containers. All names from the range allocated
       to a given container container are exposed on the host as
       "vu-container-uid" and "vg-container-gid" (see example below). This
       functionality only applies to containers using user namespacing (see
       the description of --private-users in systemd-nspawn(1)).

       To activate the NSS module, add "mymachines" to the lines starting
       with "hosts:", "passwd:" and "group:" in /etc/nsswitch.conf.

       It is recommended to place "mymachines" after the "files" or "compat"
       entry of the /etc/nsswitch.conf lines to make sure that its mappings
       are preferred over other resolvers such as DNS, but so that
       /etc/hosts, /etc/passwd and /etc/group based mappings take
       precedence.

CONFIGURATION IN /ETC/NSSWITCH.CONF         top

       Here is an example /etc/nsswitch.conf file that enables
       nss-mymachines correctly:

           passwd:         compat mymachines systemd
           group:          compat mymachines systemd
           shadow:         compat

           hosts:          mymachines resolve [!UNAVAIL=return] myhostname files dns
           networks:       files

           protocols:      db files
           services:       db files
           ethers:         db files
           rpc:            db files

           netgroup:       nis

MAPPINGS PROVIDED BY NSS-MYMACHINES         top

       The container "rawhide" is spawned using systemd-nspawn(1):

           # systemd-nspawn -M rawhide --boot --network-veth --private-users=pick
           Spawning container rawhide on /var/lib/machines/rawhide.
           Selected user namespace base 20119552 and range 65536.
           ...

           $ machinectl --max-addresses=3
           MACHINE CLASS     SERVICE        OS     VERSION ADDRESSES
           rawhide container systemd-nspawn fedora 30      169.254.40.164 fe80::94aa:3aff:fe7b:d4b9

           $ getent passwd vu-rawhide-0 vu-rawhide-81
           vu-rawhide-0:*:20119552:65534:vu-rawhide-0:/:/usr/sbin/nologin
           vu-rawhide-81:*:20119633:65534:vu-rawhide-81:/:/usr/sbin/nologin

           $ getent group vg-rawhide-0 vg-rawhide-81
           vg-rawhide-0:*:20119552:
           vg-rawhide-81:*:20119633:

           $ ps -o user:15,pid,tty,command -e|grep '^vu-rawhide'
           vu-rawhide-0      692 ?        /usr/lib/systemd/systemd
           vu-rawhide-0      731 ?        /usr/lib/systemd/systemd-journald
           vu-rawhide-192    734 ?        /usr/lib/systemd/systemd-networkd
           vu-rawhide-193    738 ?        /usr/lib/systemd/systemd-resolved
           vu-rawhide-0      742 ?        /usr/lib/systemd/systemd-logind
           vu-rawhide-81     744 ?        /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
           vu-rawhide-0      746 ?        /usr/sbin/sshd -D ...
           vu-rawhide-0      752 ?        /usr/lib/systemd/systemd --user
           vu-rawhide-0      753 ?        (sd-pam)
           vu-rawhide-0     1628 ?        login -- zbyszek
           vu-rawhide-1000  1630 ?        /usr/lib/systemd/systemd --user
           vu-rawhide-1000  1631 ?        (sd-pam)
           vu-rawhide-1000  1637 pts/8    -zsh

           $ ping -c1 rawhide
           PING rawhide(fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide)) 56 data bytes
           64 bytes from fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide): icmp_seq=1 ttl=64 time=0.045 ms
           ...
           $ ping -c1 -4 rawhide
           PING rawhide (169.254.40.164) 56(84) bytes of data.
           64 bytes from 169.254.40.164 (169.254.40.164): icmp_seq=1 ttl=64 time=0.064 ms
           ...

           # machinectl shell rawhide /sbin/ip a
           Connected to machine rawhide. Press ^] three times within 1s to exit session.
           1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
               ...
           2: host0@if21: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
               link/ether 96:aa:3a:7b:d4:b9 brd ff:ff:ff:ff:ff:ff link-netnsid 0
               inet 169.254.40.164/16 brd 169.254.255.255 scope link host0
                  valid_lft forever preferred_lft forever
               inet6 fe80::94aa:3aff:fe7b:d4b9/64 scope link
                  valid_lft forever preferred_lft forever
           Connection to machine rawhide terminated.

SEE ALSO         top

       systemd(1), systemd-machined.service(8), machinectl(1),
       nss-systemd(8), nss-resolve(8), nss-myhostname(8), nsswitch.conf(5),
       getent(1)

COLOPHON         top

       This page is part of the systemd (systemd system and service manager)
       project.  Information about the project can be found at 
       ⟨http://www.freedesktop.org/wiki/Software/systemd⟩.  If you have a bug
       report for this manual page, see
       ⟨http://www.freedesktop.org/wiki/Software/systemd/#bugreports⟩.  This
       page was obtained from the project's upstream Git repository
       ⟨https://github.com/systemd/systemd.git⟩ on 2020-06-09.  (At that
       time, the date of the most recent commit that was found in the repos‐
       itory was 2020-06-09.)  If you discover any rendering problems in
       this HTML version of the page, or you believe there is a better or
       more up-to-date source for the page, or you have corrections or
       improvements to the information in this COLOPHON (which is not part
       of the original manual page), send a mail to man-pages@man7.org

systemd 245                                                NSS-MYMACHINES(8)

Pages that refer to this page: org.freedesktop.machine1(5)30-systemd-environment-d-generator(7)systemd.directives(7)systemd.index(7)libnss_myhostname.so.2(8)libnss_resolve.so.2(8)libnss_systemd.so.2(8)nss-myhostname(8)nss-resolve(8)nss-systemd(8)systemd-machined(8)systemd-machined.service(8)