'\" -*- coding: UTF-8 -*-
.if \n(.g .ds T< \\FC
.if \n(.g .ds T> \\F[\n[.fam]]
.de URL
\\$2 \(la\\$1\(ra\\$3
..
.if \n(.g .mso www.tmac
.TH lxc-user-nic 1 2023-02-19 "" ""
.SH NAME
lxc-user-nic \- Manage nics in another network namespace 
.SH SYNOPSIS
'nh
.fi
.ad l
\fBlxc-user-nic\fR \kx
.if (\nx>(\n(.l/2)) .nr x (\n(.l/5)
'in \n(.iu+\nxu
\fBcreate\fR {\fIlxcpath\fR} {\fIname\fR} {\fIpid\fR} {\fItype\fR} {\fIbridge\fR} {\fIcontainer nicname\fR}
'in \n(.iu-\nxu
.ad b
'hy
'nh
.fi
.ad l
\fBlxc-user-nic\fR \kx
.if (\nx>(\n(.l/2)) .nr x (\n(.l/5)
'in \n(.iu+\nxu
\fBdelete\fR {\fIlxcpath\fR} {\fIname\fR} {\fIpath to network namespace\fR} {\fItype\fR} {\fIbridge\fR} {\fIcontainer nicname\fR}
'in \n(.iu-\nxu
.ad b
'hy
.SH DESCRIPTION
\fBlxc-user-nic\fR is a setuid-root program with which
unprivileged users may manage network interfaces for use by a
lxc container.
.PP
It will consult the configuration file \*(T<\fI/etc/lxc/lxc\-usernet\fR\*(T>
to determine the number of interfaces which the calling user is allowed to
create, and which bridge he may attach them to. It tracks the
number of interfaces each user has created using the file
\*(T<\fI/run/lxc/nics\fR\*(T>. It ensures that the calling
user is privileged over the network namespace to which the interface
will be attached.
\fBlxc-user-nic\fR also allows one to delete network devices.
Currently only ovs ports can be deleted.
.SH OPTIONS
.TP 
\fIlxcpath\fR 
The path of the container. This is currently not used.
.TP 
\fIname\fR 
The name of the container. This is currently not used.
.TP 
\fIpid\fR 
The process id for the task to whose network namespace the interface
should be attached.
.TP 
\fItype\fR 
The network interface type to attach. Currently only veth is
supported. With this type, two interfaces representing each
tunnel endpoint are created. One endpoint will be attached
to the specified bridge, while the other will be passed into
the container.
.TP 
\fIbridge\fR 
The bridge to which to attach the network interface, for
instance \*(T<\fIlxcbr0\fR\*(T>.
.TP 
\fIcontainer nicname\fR 
The desired interface name in the container. This will be
\*(T<\fIeth0\fR\*(T> if unspecified.
.TP 
\fIpath to network namespace\fR 
A path to open to get a file descriptor for the target
network namespace.
This is only relevant when an veth device is deleted.
.SH "SEE ALSO"
\fBlxc\fR(1),
\fBlxc-start\fR(1),
\fBlxc-usernet\fR(5)
.SH AUTHOR
Christian Brauner <\*(T<christian@brauner.io\*(T>>
.PP
Serge Hallyn <\*(T<serge@hallyn.com\*(T>>
.PP
Daniel Lezcano <\*(T<daniel.lezcano@free.fr\*(T>>