diff --git a/docs/USER_GROUP_API.md b/docs/USER_GROUP_API.md
index 55f6af7d8e..ca88b3a16d 100644
--- a/docs/USER_GROUP_API.md
+++ b/docs/USER_GROUP_API.md
@@ -108,7 +108,7 @@ example, introspection is not available, and the resolver logic is not used.
## Other Services
-The `systemd` project provides two other services implementing this
+The `systemd` project provides three other services implementing this
interface. Specifically:
1. `io.systemd.DynamicUser` → This service is implemented by the service
@@ -119,6 +119,10 @@ interface. Specifically:
and provides records for the users and groups defined by the home
directories it manages.
+3. `io.systemd.Machine` → This service is implemented by
+ `systemd-machined.service` and provides records for the users and groups used
+ by local containers that use user namespacing.
+
Other projects are invited to implement these services too. For example it
would make sense for LDAP/ActiveDirectory projects to implement these
interfaces, which would provide them a way to do per-user resource management
diff --git a/man/nss-systemd.xml b/man/nss-systemd.xml
index 26730f0fe9..ea293596be 100644
--- a/man/nss-systemd.xml
+++ b/man/nss-systemd.xml
@@ -35,8 +35,8 @@
systemd1 (for its
DynamicUser= feature, see
systemd.exec5 for
- details) or
- systemd-homed.service8.
+ details),
+ systemd-homed.service8, or systemd-machined.service8.
This module also ensures that the root and nobody users and groups (i.e. the users/groups with the UIDs/GIDs
0 and 65534) remain resolvable at all times, even if they aren't listed in /etc/passwd or
@@ -55,7 +55,7 @@
- Example
+ Configuration in /etc/nsswitch.conf
Here is an example /etc/nsswitch.conf file that enables
nss-systemd correctly:
@@ -77,6 +77,47 @@ netgroup: nis
+
+ Example: Mappings provided by systemd-machined.service
+
+ The container rawhide is spawned using
+ systemd-nspawn1:
+
+
+ # systemd-nspawn -M rawhide --boot --network-veth --private-users=pick
+Spawning container rawhide on /var/lib/machines/rawhide.
+Selected user namespace base 20119552 and range 65536.
+...
+
+$ machinectl --max-addresses=3
+MACHINE CLASS SERVICE OS VERSION ADDRESSES
+rawhide container systemd-nspawn fedora 30 169.254.40.164 fe80::94aa:3aff:fe7b:d4b9
+
+$ getent passwd vu-rawhide-0 vu-rawhide-81
+vu-rawhide-0:*:20119552:65534:vu-rawhide-0:/:/usr/sbin/nologin
+vu-rawhide-81:*:20119633:65534:vu-rawhide-81:/:/usr/sbin/nologin
+
+$ getent group vg-rawhide-0 vg-rawhide-81
+vg-rawhide-0:*:20119552:
+vg-rawhide-81:*:20119633:
+
+$ ps -o user:15,pid,tty,command -e|grep '^vu-rawhide'
+vu-rawhide-0 692 ? /usr/lib/systemd/systemd
+vu-rawhide-0 731 ? /usr/lib/systemd/systemd-journald
+vu-rawhide-192 734 ? /usr/lib/systemd/systemd-networkd
+vu-rawhide-193 738 ? /usr/lib/systemd/systemd-resolved
+vu-rawhide-0 742 ? /usr/lib/systemd/systemd-logind
+vu-rawhide-81 744 ? /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
+vu-rawhide-0 746 ? /usr/sbin/sshd -D ...
+vu-rawhide-0 752 ? /usr/lib/systemd/systemd --user
+vu-rawhide-0 753 ? (sd-pam)
+vu-rawhide-0 1628 ? login -- zbyszek
+vu-rawhide-1000 1630 ? /usr/lib/systemd/systemd --user
+vu-rawhide-1000 1631 ? (sd-pam)
+vu-rawhide-1000 1637 pts/8 -zsh
+
+
+
See Also
@@ -85,6 +126,9 @@ netgroup: nis
nss-resolve8,
nss-myhostname8,
nss-mymachines8,
+ systemd-userdbd.service8,
+ systemd-homed.service8,
+ systemd-machined.service8,
nsswitch.conf5,
getent1
diff --git a/man/systemd-machined.service.xml b/man/systemd-machined.service.xml
index 5172f6511a..a976c606bd 100644
--- a/man/systemd-machined.service.xml
+++ b/man/systemd-machined.service.xml
@@ -116,6 +116,13 @@
systemd-importd.service8
is also available, which implements importing, exporting, and downloading of container and VM images.
+
+ For each container registered with systemd-machined.service that employs user
+ namespacing, users/groups are synthesized for the used UIDs/GIDs. These are made available to the system
+ using the User/Group Record Lookup API via
+ Varlink, and thus may be resolved with
+ userdbctl1 or the
+ usual glibc NSS calls.
diff --git a/man/userdbctl.xml b/man/userdbctl.xml
index 777393ab75..9a69f33edb 100644
--- a/man/userdbctl.xml
+++ b/man/userdbctl.xml
@@ -186,6 +186,15 @@
available to the system.
+
+ io.systemd.Machine
+
+ This service is provided by
+ systemd-machined.service8
+ and synthesizes records for all users/groups used by a container that employs user
+ namespacing.
+
+
io.systemd.Multiplexer