pflask [options] [–] [command ...]
pflask is a simple tool for creating process containers on LInux. It can be used for running single commands or even booting a whole operating system inside an isolated environment, where the filesystem hierarchy, networking, process tree, IPC subsystems and host/domain name can be insulated from the host system and other containers.
Change the root directory inside the container.
Change the current directory inside the container.
Set the container hostname.
Create a new type mount point inside the container. See MOUNT for more information.
Disconnect the container networking from the host. See NETIF for more information.
Run the command under the specified user.
Map container users to host users. The map argument is composed of three values separated by :: the first userid as seen in the user namespace of the container, the first userid as seen on the host, and a range indicating the number of consecutive ids to map.
Example: --user-map=0:100000,65536
Discard any change to / once the container exits. This can only be used along with --chroot and requires support for the overlay mount type.
Create a new cgroup in the given controller and move the container inside it.
Detach from terminal.
Attach to the pid detached process. Only a process with the same UID of the detached process can attach to it. To detach again press ^@ (Ctrl + @).
Set additional environment variables. It takes a comma-separated list of variables of the form name=value. This option may be used more than once.
Do not clear environment (only relevant when used with --chroot).
Disable user namespace.
Disable mount namespace.
Disable net namespace.
Disable IPC namespace.
Disable UTS namespace.
Disable PID namespace.
pflask can create the following mount point types using the --mount option:
--mount=bind:<host_path>:<container_path>
Bind mounts the host_path directory/file on the host filesystem to the container_path directory/file in the container. If the --chroot option is used, the destination path will be relative to the chroot directory.
Example: --mount=bind:/source/path:/dest/path
--mount=bind-ro:<host_path>:<container_path>
Same as bind, but makes the mount point read-only. If the --chroot option is used, the destination path will be relative to the chroot directory.
Example: --mount=bind-ro:/source/path:/dest/path
--mount=overla:<root_dir>:<dest>:<work_dir>
Stacks the host root_dir directory on top of the container’s dest directory using either AuFS or OverlayFS depending on what is found at compile-time. If the --chroot option is used, the destination path will be relative to the chroot directory. The work_dir directory needs to be an empty directory on the same filesystem as root_dir.
Note that AuFS and OverlayFS don’t support user namespaces, so the --user option is incompatible with this mount type unless --no-userns is also used.
Example: --mount=overlay:/overlay/path:/dest/path:/overlay/work
--mount=tmp:<dest>
Mounts a temporary in-memory filesystem on the dest directory inside the container.
Example: --mount=tmp:/dest/path
pflask will create a new network namespace when the --netif option is used. If one of the following arguments is provided, a network interface will also be created inside the container:
--netif=<dev>:<name>
Moves the dev network interface from the host to the container, and renames it to name. No additional configuration will be applied to it.
Example: --netif=vxlan0:eth0
--netif=macvlan:<master>:<name>
Creates a macvlan network interface using master as master interface, moves it inside the container and renames it to name. No additional configuration will be applied to it.
Example: --netif=macvlan:eth0:eth0
--netif=ipvlan:<master>:<name>
Same as macvlan but an ipvlan interface will be created instead. No additional configuration will be applied to it.
Example: --netif=ipvlan:eth0:eth0
--netif=veth:<name_outside>:<name_inside>
Creates a pair of veth network interfaces called name_outside and name_inside. The name_inside twin will then be moved inside the container. No additional configuration will be applied to them.
Example: --netif=veth:veth0:eth0
Alessandro Ghedini <alessandro@ghedini.me>
Copyright (C) 2013 Alessandro Ghedini <alessandro@ghedini.me>
This program is released under the 2 clause BSD license.