0fc45c8d20
This beefs up the cgroup logic, adding --slice=, --property= to vmspawn the same way it already exists in nspawn. There are a bunch of differences though: we don't delegate the cgroup access in the allocated unit (since qemu wouldn't need that), and we do registration via varlink not dbus. Hence, while this follows a similar logic now, it differs in a lot of details. This makes in particular one change: when invoked on the command line we'll only add the qemu instance to the allocated scope, not the vmspawn process itself (this follows more closely how nspawn does this where only the container payload has its scope, not nspawn itself). This is quite tricky to implement: unlike in nspawn we have auxiliary services to start, with depencies to the scope. This means we need to start the scope early, so that we know the scope's name. But the command line to invoke is only assembled from the data we learn about the auxiliary services, hence much later. To addres we'll now fork off the child that eventually will become early, then move it to a scope, prepare the cmdline and then very late send the cmdline (and the fds we want to pass) to the prepared child, which then execs it.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS