types.db

package: collectd

title: types.db(5)

summary: Data\-set specifications for the system statistics collection daemon

text:
# types.db(5)

## NAME
types.db - Data-set specifications for the system statistics collection daemon collectd

## SYNOPSIS

```
  bitrate    value:GAUGE:0:4294967295
  counter    value:COUNTER:U:U
  if_octets  rx:COUNTER:0:4294967295, tx:COUNTER:0:4294967295
```

## DESCRIPTION
The "types.db" file contains collectd's metric type specifications. Each line describes one metric type, which is called "data set" in collectd. Each line consists of two or more fields delimited by spaces and/or horizontal tabs.

For example, the following defines two data sets, "bytes" and "total_bytes".

```
  bytes        value:GAUGE:0:U
  total_bytes  value:DERIVE:0:U
```

The first field defines the name of the data set. By convention, data set names use lower-case alphanumeric characters and underscores ("_") only. Also by convention, if a metric makes sense both as a cumulative metric (e.g. "DERIVE") and a non-cumulative metric (i.e. "GAUGE"), the cumulative metric gets a "total_" prefix. For example, "bytes" is a "GAUGE" and "total_bytes" is a "DERIVE".

The second and each following field defines a named metric value, called "data source". New data sets with multiple data sources are strongly discouraged. Each field is a colon-separated tuple of the data source name, value type, minimum and maximum values: ds-name:ds-type:min:max.

- ds-name is, by convention, a lower-case alphanumeric string. If the data set contains a single data source, it is called "value" by convention. Data source names must be unique within a data set.

- ds-type may be DERIVE, GAUGE, or COUNTER. For historic reasons a type called ABSOLUTE is also supported, but its use is strongly discouraged, and it should not be used for new metric type definitions.

- min and max define the range of valid values this data source. Either or both may be unbounded, which is specified by providing "U" instead of a number. For cumulative metric values, min and max apply to the value's rate, not the raw cumulative metric value.

## FILES
The location of the types.db file is defined by the TypesDB configuration option (see collectd.conf(5)). It defaults to collectd's shared data directory, i. e. prefix/share/collectd/.

## CUSTOM TYPES
If you want to specify custom types, you should do so by specifying a custom file in addition to the default one (see FILES) above. You can do that by having multiple TypesDB statements in your configuration file or by specifying more than one file in one line.

For example:

```
 TypesDB "/opt/collectd/share/collectd/types.db"
 TypesDB "/opt/collectd/etc/types.db.custom"
```

Note: Make sure to make this file available on all systems if you're sending values over the network.

## SEE ALSO
collectd(1), collectd.conf(5), rrdcreate(1)

## AUTHOR
collectd has been written by Florian Forster <octo at collectd.org>.

This manpage has been written by Sebastian Harl <sh at tokkee.org>.

branch: sisyphus


composefs-dump

package: composefs

title: composefs-dump(5)

text:
# composefs-dump(5)

## NAME
composefs-dump - textual file format for composefs content

## DESCRIPTION
Both the composefs-info and the mkcompose commands support generation/consumptions of a textual descriptions of the contents of a composefs image. This can be used to inspect or modify an image, or to generate an image without having to have a local directory with the files in it.

The file format is very simple, with one file per line, first with a 11 fixed fields, followed by a variable number of extended attributes for the file. It is recommended, but not required to include a trailing newline for the last file.

Fields are separated by a single space, and lines by a single newline. Extended attributes further use '=' to separate key from value. Therefore all these characters, as well as non-printable characters are escaped in the fields ('=' only in xattr fields). Also, back-slashes have to be escaped as they are used as the escape mechanism.

Escapes are of the form \xXY which escapes a single byte using two hex digits. For example \x00 is the zero byte and \xff is the 255 byte. Optionally, these custom escapes are suppored:

*\\*

: backslash.

\n

: newline.

\r

: carriage return.

\t

: tab

Optional fields that are not set contain '-', and if a field actually has that particular value it is escaped.

The fixed fields on a line are (all numbers in base 10 unless otherwise specified):

PATH : The full, absolute path of the file in the image. Any directories

used as prefix in the path must have been in the file before this

line.

SIZE : The size of the file. This is ignored for directories.

MODE : The st_mode stat field the file in octal, which includes both the

permissions and the file type.

```
 Additionally, if the file is a hardlink, then this field will

 start with a single '@' character, and the payload field points

 to the target file. Note that all other fields are typically

 filled out for a hardlink as the target, but for generation

 of a new file we ignore all the fields except the payload.
```

NLINK : The st_nlink stat field.

UID : The owner uid.

GID : The owner gid.

RDEV : The st_rdev stat field.

MTIME : The modification time in seconds and nanoseconds since the unix

epoch, separated by '.'. Note this is not a float, "1.1" means

one second and one nanosecond.

PAYLOAD : The payload of the file. For symbolic links this means the symlink

targets. For regular files this is the relative pathname for the

backing files. For hardlinks (see MODE), this is the path of

another file in this file that this is a hardlink of.

CONTENT : Small files can inline the actual content in the composefs

image. This contains an escaped version of the content.

This must match the size specified in SIZE

DIGEST : A fs-verity digest for the file (only used for regular files, and

not if CONTENT is set) that will be validated against backing

files when used.

After the fixed fields comes the xattrs, escaped and space-separated in the form KEY=VALUE. Note that '=' must be escaped in KEY.

## EXAMPLE

```
/ 4096 40755 4 1000 1000 0 1695372970.944925700 - - - security.selinux=unconfined_u:object_r:unlabeled_t:s0\x00
/a\x20dir\x20w\x20space 27 40755 2 1000 1000 0 1694598852.869646118 - - - security.selinux=unconfined_u:object_r:unlabeled_t:s0\x00
/a-dir 45 40755 2 1000 1000 0 1674041780.601887980 - - - security.selinux=unconfined_u:object_r:unlabeled_t:s0\x00
/a-dir/a-file 259 100644 1 1000 1000 0 1695368732.385062094 35/d02f81325122d77ec1d11baba655bc9bf8a891ab26119a41c50fa03ddfb408 - 35d02f81325122d77ec1d11baba655bc9bf8a891ab26119a41c50fa03ddfb408 security.selinux=unconfined_u:object_r:unlabeled_t:s0\x00
/a-hardlink 259 @100644 1 1000 1000 0 1695368732.385062094 /a-dir/a-file - 35d02f81325122d77ec1d11baba655bc9bf8a891ab26119a41c50fa03ddfb408 security.selinux=unconfined_u:object_r:unlabeled_t:s0\x00
/inline.txt 10 100644 1 1000 1000 0 1697019909.446146440 - some-text\n - security.selinux=unconfined_u:object_r:unlabeled_t:s0\x00
```

## SEE ALSO
composefs-info(1), mkcomposefs(1)

composefs upstream ⟨https://github.com/containers/composefs⟩


connman-service.config

package: connman

title: connman-service.config(5)

summary: ConnMan service provisioning file

text:
# connman-service.config(5)

## NAME
service-name.config - ConnMan service provisioning file

## SYNOPSIS
/var/lib/connman/service-name.config

## DESCRIPTION
ConnMan's services are configured with so called "provisioning files" which reside under /var/lib/connman/. The files can be named anything, as long as they end in .config. The provisioning files can be used to configure for example secured wireless access points which need complex authentication, for example eduroam, or for static IPs and so on. Each provisioning file can be used for multiple services at once.

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [global]
This section is optional, and can be used to describe the actual file. The two allowed fields for this section are:

Name=name

Name of the network.

Description=description

Description of the network.

### [service_*]
Each provisioned service must start with a [service_*] tag, with * replaced by an unique name within the file. The allowed fields are:

Type=ethernet | wifi

Mandatory. Other types than ethernet or wifi are not supported.

IPv4=off | dhcp | network/netmask/gateway

IPv4 settings for the service. If set to off, IPv4 won't be used. If set to dhcp, dhcp will be used to obtain the network settings. netmask can be specified as length of the mask rather than the mask itself. The gateway can be omitted when using a static IP.

IPv6=off | auto | network/prefixlength/gateway

IPv6 settings for the service. If set to off, IPv6 won't be used. If set to auto, settings will be obtained from the network.

IPv6.Privacy=disabled | enabled | preferred

IPv6 privacy settings as per RFC3041.

MAC=address

MAC address of the interface to be used. If not specified, the first found interface is used. Must be in format ab:cd:ef:01:23:45.

DeviceName=ifname

Device name the interface to be used, e.g. eth0. MAC takes preference over DeviceName.

Nameservers=servers

Comma separated list of nameservers.

SearchDomains=domains

Comma separated list of DNS search domains.

Timeservers=servers

Comma separated list of timeservers.

Domain=domain

Domain name to be used.

The following keys can only be used for wireless networks:

Name=name

A string representation of an network SSID. If the SSID field is present, the Name field is ignored. If the SSID field is not present, this field is mandatory.

SSID=ssid

SSID: A hexadecimal representation of an 802.11 SSID. Use this format to encode special characters including starting or ending spaces.

Passphrase=passphrase

RSN/WPA/WPA2 Passphrase.

Security=type

The security type of the network. Possible values are psk (WPA/WPA2 PSK), ieee8021x (WPA EAP), none and wep. When not set, the default value is ieee8021x if an EAP type is configured, psk if a passphrase is present and none otherwise.

Hidden=true | false

If set to true, then this AP is hidden. If missing or set to false, then AP is not hidden.

The following keys are used for WPA EAP (when Security=ieee8021x):

EAP=tls | ttls | peap

EAP type to use. Only tls, ttls and peap are supported.

CACertFile=file

Path to the CA certificate file. Only PEM and DER formats are supported.

PrivateKeyFile=file

Path to the private key file. Only PEM, DER and PFX formats are supported.

PrivateKeyPassphrase=passphrase

Passphrase of the private key.

PrivateKeyPassphraseType=fsid

If specified, use the private key's fsid as the passphrase, and ignore the PrivateKeyPassphrase field.

Identity=identity

Identity string for EAP.

AnonymousIdentity=identity

Anonymous identity string for EAP.

SubjectMatch=substring

Substring to be matched against the subject of the authentication server certificate for EAP.

AltSubjectMatch=substring

Semicolon separated string of entries to be matched against the alternative subject name of the authentication server certificate for EAP.

DomainSuffixMatch=domain

Constraint for server domain name. If set, this FQDN is used as a suffix match requirement for the authentication server certificate for EAP.

DomainMatch=domain

This FQDN is used as a full match requirement for the authentication server certificate for EAP.

Phase2=type

Inner authentication type with for EAP=tls or EAP=ttls. Prefix the value with EAP- to indicate usage of EAP-based authentication method (should only be used with EAP=ttls).

## EXAMPLE

### Eduroam
This is a configuration file for eduroam networks. This file could for example be /var/lib/connman/eduroam.config. Your university's exact settings might be different.

```
[service_eduroam]
Type = wifi
Name = eduroam
EAP = peap
Phase2 = MSCHAPV2
CACertFile = /etc/ssl/certs/UNIV_CA.crt
```

### Complex networking
This is a configuration file for a network providing EAP-TLS, EAP-TTLS and EAP-PEAP services. The respective SSIDs are tls_ssid, ttls_ssid and peap_ssid and the file name could be /var/lib/connman/complex.config.

Please note that the SSID entry is for hexadecimal encoded SSID (e.g. "SSID = 746c735f73736964"). If your SSID does not contain any exotic character then you should use the Name entry instead (e.g. "Name = tls_ssid").

```
[global]
Name = Example
Description = Example network configuration
[service_tls]
Type = wifi
SSID = 746c735f73736964
EAP = tls
CACertFile = /home/user/.certs/ca.pem
ClientCertFile = /home/user/devlp/.certs/client.pem
PrivateKeyFile = /home/user/.certs/client.fsid.pem
PrivateKeyPassphraseType = fsid
Identity = user
[service_ttls]
Type = wifi
Name = ttls_ssid
EAP = ttls
CACertFile = /home/user/.cert/ca.pem
Phase2 = MSCHAPV2
Identity = user
[service_peap]
Type = wifi
Name = peap_ssid
EAP = peap
CACertFile = /home/user/.cert/ca.pem
Phase2 = MSCHAPV2
Identity = user
[service_home_ethernet]
Type = ethernet
IPv4 = 192.168.1.42/255.255.255.0/192.168.1.1
IPv6 = 2001:db8::42/64/2001:db8::1
MAC = 01:02:03:04:05:06
Nameservers = 10.2.3.4,192.168.1.99
SearchDomains = my.home,isp.net
Timeservers = 10.172.2.1,ntp.my.isp.net
Domain = my.home
[service_home_wifi]
Type = wifi
Name = my_home_wifi
Passphrase = password
IPv4 = 192.168.2.2/255.255.255.0/192.168.2.1
MAC = 06:05:04:03:02:01
[service_vlan]
Type = ethernet
DeviceName = enp4s0.1
IPv4 = 192.168.1.42/255.255.255.0/192.168.1.1
```

## SEE ALSO
connman(8)


connman-vpn-provider.config

title: connman-vpn-provider.config(5)

text:
# connman-vpn-provider.config(5)

## NAME
connection_name.config - ConnMan vpn connection provisioning file

## SYNOPSIS
/var/lib/connman-vpn/connection-name.config

## DESCRIPTION
ConnMan's vpn connections are configured with so called "provisioning files" which reside under /var/lib/connman-vpn/. The files can be named anything, as long as they contain only printable ascii characters, for example letters, numbers and underscores. The file must end with .config. Each VPN connection requires a provisioning file, but multiple connections can be specified in the same file.

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [global]
This section is optional, and can be used to describe the actual file. The two allowed fields for this section are:

Name=name

Name of the network.

Description=description

Description of the network.

### [provider_*]
Each provisioned connection must start with a [provider_*] tag, with * replaced by an unique name within the file. The following fields are mandatory:

Type=OpenConnect | OpenVPN | VPNC | L2TP | PPTP

Specifies the VPN type.

Host=IP

VPN server IP address.

Domain=domain

Domain name for the VPN service.

The following field is optional:

Networks=network/netmask/gateway[,...]

Networks behind the VPN. If all traffic should go through the VPN, this field can be left out. The gateway can be left out. For IPv6 addresses, only the prefix length is accepted as the netmask.

### OpenConnect
The following keys can be used for openconnect(8) networks:

OpenConnect.ServerCert=cert

SHA1 fingerprint of the VPN server's certificate.

OpenConnect.CACert=cert

File containing additional CA certificates in addition to the system trusted certificate authorities.

OpenConnect.ClientCert=cert

Client certificate, if needed by web authentication.

OpenConnect.MTU=mtu

Request mtu from the server as the MTU of the tunnel.

OpenConnect.Cookie=cookie

The resulting cookie of the authentication process. As the cookie lifetime can be very limited, it does not usually make sense to add it into the configuration file.

OpenConnect.VPNHost=host

The final VPN server to use after completing the web authentication. Only usable for extremely simple VPN configurations and should normally be set only via the VPN Agent API.

If OpenConnect.Cookie, OpenConnect.VPNHost or OpenConnect.ServerCert are missing, the VPN Agent will be contacted to supply the information.

### OpenVPN
The following keys are mandatory for openvpn(8) networks:

OpenVPN.CACert=cert

Certificate authority file.

OpenVPN.Cert=cert

Local peer's signed certificate.

OpenVPN.Cert=cert

Local peer's signed certificate.

OpenVPN.Key=key

Local peer's private key.

The following keys are optional for openvpn(8) networks:

OpenVPN.MTU=mtu

MTU of the tunnel.

OpenVPN.NSCertType=client | server

Peer certificate type, either client or server.

OpenVPN.Proto=protocol

Use protocol.

OpenVPN.Port=port

TCP/UDP port number.

OpenVPN.AuthUserPass=true | false

Authenticate on the server using username/password.

OpenVPN.AskPass=file

Get certificate password from file.

OpenVPN.AuthNoCache=true | false

Don't cache AskPass or AuthUserPass value.

OpenVPN.TLSRemote=name

Accept connections only from a host with X509 name or common name equal to name.

OpenVPN.TLSAuth=file

Use file for HMAC authentication.

OpenVPN.TLSAuthDir=direction

Use direction for HMAC authentication direction.

OpenVPN.Cipher=cipher

Use cipher as the cipher.

OpenVPN.Auth=true | false

Use HMAC authentication.

OpenVPN.CompLZO=yes | no | adaptive

Use fast LZO compression.

OpenVPN.RemoteCertTls=client | server

Require that remote certificate is signed based on RFC3280 TLS rules.

OpenVPN.ConfigFile=file

OpenVPN config file for extra options not supported by the OpenVPN plugin.

OpenVPN.DeviceType=tun|tap

Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. Defaults to tun if omitted.

### VPNC
The following key is mandatory for vpnc(8) networks:

VPNC.IPSec.ID=id

Group username.

The following keys are optional for vpnc(8) networks:

VPNC.IPSec.Secret=secret

Group password.

VPNC.XAuth.Username=username

Username.

VPNC.XAuth.Password=password

Password.

VPNC.IKE.Authmode=mode

IKE authentication mode.

VPNC.IKE.DHGroup=group

IKE DH group name.

VPNC.PFS=group

Diffie-Hellman group for perfect forward secrecy.

VPNC.Domain=domain

Domain name for authentication.

VPNC.Vendor=vendor

Vendor of the IPSec gateway.

VPNC.LocalPort=port

Local ISAKMP port number to use.

VPNC.CiscoPort=port

Cisco UDP Encapsulation Port.

VPNC.AppVersion=version

Application version to report.

VPNC.NATTMode=mode

NAT-Traversal Method to use.

VPNC.DPDTimeout=timeout

DPD idle timeout.

VPNC.SingleDES=true | false

Enable single DES encryption.

VPNC.NoEncryption=true | false

Enable usage of no encryption for data traffic.

VPNC.DeviceType=tun|tap

Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. Defaults to tun if omitted.

### L2TP
The following keys are optional for l2tp (xl2tp.conf(5), pppd(8)) networks:

L2TP.User=user

L2TP username.

L2TP.Password=password

L2TP password.

L2TP.BPS=bps

Max bandwidth to use.

L2TP.TXBPS=bps

Max transmit bandwidth to use.

L2TP.RXBPS=bps

Max receive bandwidth to use.

L2TP.LengthBit=yes | no

Use length bit.

L2TP.Challenge=yes | no

Use challenge authentication.

L2TP.DefaultRoute=route

Add route to the routing tables.

L2TP.FlowBit=yes | no

Use seq numbers.

L2TP.TunnelRWS=size

Window size.

L2TP.Exclusive=yes | no

Use only one control channel.

L2TP.Redial=yes | no

Redial if disconnected.

L2TP.RedialTimeout=timeout

Redial timeout.

L2TP.MaxRedials=count

Maximum amount of redial tries.

L2TP.RequirePAP=yes | no

Require PAP.

L2TP.RequireCHAP=yes | no

Require CHAP.

L2TP.ReqAuth=yes | no

Require authentication.

L2TP.AccessControl=yes | no

Use access control.

L2TP.AuthFile=file

Authentication file location.

L2TP.ListenAddr=address

Listen address.

L2TP.IPSecSaref=yes | no

Listen address.

L2TP.Port=port

UDP port used.

PPPD.EchoFailure=count

Echo failure count.

PPPD.EchoFailure=count

Dead peer check count.

PPPD.EchoInterval=interval

Dead peer check interval.

PPPD.Debug=level

Debug level.

PPPD.RefuseEAP=true | false

Refuse EAP authentication.

PPPD.RefusePAP=true | false

Refuse PAP authentication.

PPPD.RefuseCHAP=true | false

Refuse CHAP authentication.

PPPD.RefuseMSCHAP=true | false

Refuse MSCHAP authentication.

PPPD.RefuseMSCHAP2=true | false

Refuse MSCHAPv2 authentication.

PPPD.NoBSDComp=true | false

Disable BSD compression.

PPPD.NoPcomp=true | false

Disable protocol compression.

PPPD.UseAccomp=true | false

Disable Access/Control compression.

PPPD.NoDeflate=true | false

Disable deflate compression.

PPPD.ReqMPPE=true | false

Require the use of MPPE.

PPPD.ReqMPPE40=true | false

Require the use of MPPE 40 bit.

PPPD.ReqMPPE128=true | false

Require the use of MPPE 128 bit.

PPPD.ReqMPPEStateful=true | false

Allow MPPE to use stateful mode.

PPPD.NoVJ=true | false

No Van Jacobson compression.

### PPTP
The following keys are optional for pptp(8) (see also pppd(8)) networks:

PPTP.User=username

Username.

PPTP.Password=password

Password.

PPPD.EchoFailure=count

Echo failure count.

PPPD.EchoFailure=count

Dead peer check count.

PPPD.EchoInterval=interval

Dead peer check interval.

PPPD.Debug=level

Debug level.

PPPD.RefuseEAP=true | false

Refuse EAP authentication.

PPPD.RefusePAP=true | false

Refuse PAP authentication.

PPPD.RefuseCHAP=true | false

Refuse CHAP authentication.

PPPD.RefuseMSCHAP=true | false

Refuse MSCHAP authentication.

PPPD.RefuseMSCHAP2=true | false

Refuse MSCHAPv2 authentication.

PPPD.NoBSDComp=true | false

Disable BSD compression.

PPPD.NoPcomp=true | false

Disable protocol compression.

PPPD.UseAccomp=true | false

Disable Access/Control compression.

PPPD.NoDeflate=true | false

Disable deflate compression.

PPPD.ReqMPPE=true | false

Require the use of MPPE.

PPPD.ReqMPPE40=true | false

Require the use of MPPE 40 bit.

PPPD.ReqMPPE128=true | false

Require the use of MPPE 128 bit.

PPPD.ReqMPPEStateful=true | false

Allow MPPE to use stateful mode.

PPPD.NoVJ=true | false

No Van Jacobson compression.

## EXAMPLE
This is a configuration file for a VPN providing L2TP, OpenVPN and OpenConnect services. It could, for example, be in the file /var/lib/connman-vpn/example.config.

```
[global]
Name = Example
Description = Example VPN configuration
[provider_l2tp]
Type = L2TP
Name = Connection to corporate network
Host = 1.2.3.4
Domain = corporate.com
Networks = 10.10.30.0/24
L2TP.User = username
[provider_openconnect]
Type = OpenConnect
Name = Connection to corporate network using Cisco VPN
Host = 7.6.5.4
Domain = corporate.com
Networks = 10.10.20.0/255.255.255.0/10.20.1.5,192.168.99.1/24,2001:db8::1/64
OpenConnect.ServerCert = 263AFAB4CB2E6621D12E90182008AEF44AEFA031
OpenConnect.CACert = /etc/certs/certificate.p12
[provider_openvpn]
Type = OpenVPN
Name = Connection to corporate network using OpenVPN
Host = 3.2.5.6
Domain = my.home.network
OpenVPN.CACert = /etc/certs/cacert.pem
OpenVPN.Cert = /etc/certs/cert.pem
OpenVPN.Key = /etc/certs/cert.key
```

## SEE ALSO
connmanctl(1), connman(8), connman-vpn(8)


connman-vpn.conf

title: connman-vpn.conf(5)

summary: ConnMan-VPN configuration file

text:
# connman-vpn.conf(5)

## NAME
connman-vpn.conf - ConnMan-VPN configuration file

## SYNOPSIS
/etc/connman/connman-vpn.conf

## DESCRIPTION
connman-vpn.conf is a configuration file for ConnMan-VPN. The configuration file is optional but it can be used to set up various aspects of ConnMan-VPN's behavior. The location of the file may be changed through use of the --config= argument for connman-vpn(8).

DAC privileges (user, group and supplementary groups) of a VPN binary ran by connman-vpn(8) can be controlled by this configuration. Configuration in connman-vpn.conf is for all VPN types and can be overridden by defining separate configs into /etc/connman/vpn-plugin/ using the plugin name + .conf suffix using the same syntax. For example, for OpenVPN the path to config is /etc/connman/vpn-plugin/openvpn.conf which will override any value in the main configuration.

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [General]
This section is the only mandatory section of the configuration file.

InputRequestTimeout=secs

Set input request timeout. Default is 300 seconds. The request for inputs like passphrase will timeout after certain amount of time. Use this setting to increase the value in case of different user interface designs.

### [DACPrivileges]
This section controls the DAC privileges to use for a VPN binary used by a VPN plugin. DAC privileges that can be set are user, group and supplementary groups.

User=username/uid

User on the system to use for running VPN binary. Username or uid can be used.

Group=groupname/gid

The main group to use for running VPN binary. Group name or gid can be used.

SupplementaryGroups=groupnames/gids

Comma separated list of supplementary groups to set for the VPN binary. Groups can be defined with their names or gid's.

## EXAMPLES
The following example configuration sets InputRequestTimeout to 10 minutes, runs VPNs as user "vpn_user" of group "vpn" with additional supplementary groups "inet" and "net_admin".

```
[General]
InputRequestTimeout = 600
[DACPrivileges]
User = vpn_user
Group = vpn
SupplementaryGroups = inet, net_admin
```

## SEE ALSO
connman(8), connman-vpn(8)


connman.conf

title: connman.conf(5)

summary: ConnMan configuration file

text:
# connman.conf(5)

## NAME
main.conf - ConnMan configuration file

## SYNOPSIS
/etc/connman/main.conf

## DESCRIPTION
main.conf is a configuration file for ConnMan. The configuration file is optional but it can be used to set up various aspects of ConnMan's behavior. The location of the file may be changed through use of the --config= argument for connman(8).

## FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

### [General]
This section is the only mandatory section of the configuration file.

InputRequestTimeout=secs

Set input request timeout. Default is 120 seconds The request for inputs like passphrase will timeout after certain amount of time. Use this setting to increase the value in case of different user interface designs.

BrowserLaunchTimeout=secs

Set browser launch timeout. Default is 300 seconds The request for launching a browser for portal pages will timeout after certain amount of time. Use this setting to increase the value in case of different user interface designs.

BackgroundScanning=true | false

Enable background scanning. Default is true. If wifi is disconnected, the background scanning will follow a simple backoff mechanism from 3s up to 5 minutes. Then, it will stay in 5 minutes unless user specifically asks for scanning through a D-Bus call. If so, the mechanism will start again from 3s. This feature activates also the background scanning while being connected, which is required for roaming on wifi. When BackgroundScanning is false, ConnMan will not perform any scan regardless of wifi is connected or not, unless it is requested by the user through a D-Bus call.

UseGatewaysAsTimeservers=true| false

Assume that service gateways also function as timeservers. Default is false.

FallbackTimeservers=server[,...]

List of Fallback timeservers separated by ",". These timeservers are used for NTP sync when there are no timeservers set by the user or by the service, and when UseGatewaysAsTimeservers = false. These can contain a mixed combination of fully qualified domain names, IPv4 and IPv6 addresses.

FallbackNameservers=server[,...]

List of fallback nameservers separated by "," appended to the list of nameservers given by the service. The nameserver entries must be in numeric format, host names are ignored.

DefaultAutoConnectTechnologies=technology[,...]

List of technologies that are marked autoconnectable by default, separated by commas ",". The default value for this entry when empty is ethernet,wifi,cellular. Services that are automatically connected must have been set up and saved to storage beforehand.

DefaultEnabledTechnologies=technology[,...]

List of technologies that are marked enabled or powered by default, separated by commas ",". The default value for this entry when empty is ethernet.

DefaultFavoriteTechnologies=technology[,...]

List of technologies that are marked favorite by default, separated by commas ",". The default value for this entry when empty is ethernet. Connects to services from this technology even if not setup and saved to storage.

AlwaysConnectedTechnologies=technology[,...]

List of technoolgies which are always connected regardless of PreferredTechnologies setting (AutoConnect = true). The default value is empty and this feature is disabled unless explicitly enabled in the config file.

PreferredTechnologies=technology[,...]

List of preferred technologies from the most preferred one to the least preferred one separated by commas ",". Services of the listed technology type will be tried one by one in the order given, until one of them gets connected or they are all tried. A service of a preferred technology type in state 'ready' will get the default route when compared to another preferred type further down the list with state 'ready' or with a non-preferred type; a service of a preferred technology type in state 'online' will get the default route when compared to either a non-preferred type or a preferred type further down in the list.

NetworkInterfaceBlacklist=interface[,...]

List of blacklisted network interfaces separated by ",". Found interfaces will be compared to the list and will not be handled by connman, if their first characters match any of the list entries. Default value is vmnet,vboxnet,virbr,ifb,ve-,vb-,ham,veth.

AllowHostnameUpdates=true | false

Allow connman to change the system hostname. This can happen for example if we receive DHCP hostname option. Default value is true.

AllowDomainnameUpdates=true | false

Allow connman to change the system domainname. This can happen for example if we receive DHCP domainname option. Default value is true.

SingleConnectedTechnology=true | false

Keep only a single connected technology at any time. When a new service is connected by the user or a better one is found according to PreferredTechnologies, the new service is kept connected and all the other previously connected services are disconnected. With this setting it does not matter whether the previously connected services are in 'online' or 'ready' states, the newly connected service is the only one that will be kept connected. A service connected by the user will be used until going out of network coverage. With this setting enabled applications will notice more network breaks than normal. Note this options can't be used with VPNs. Default value is false.

TetheringTechnologies=technology[,...]

List of technologies that are allowed to enable tethering separated by ",". The default value is wifi,bluetooth,gadget. Only those technologies listed here are used for tethering. If one wants to tether ethernet, then add "ethernet" in the list. NOTE that if ethernet tethering is enabled, then a DHCP server is started on all ethernet interfaces. Tethered ethernet should never be connected to corporate or home network as it will disrupt normal operation of these networks. Due to this ethernet is not tethered by default. Do not activate ethernet tethering unless you really know what you are doing.

PersistentTetheringMode=true | false

Restore earlier tethering status when returning from offline mode, re-enabling a technology, and after restarts and reboots. Default value is false.

Enable6to4=true | false

Automatically enable Anycast 6to4 if possible. This is not recommended, as the use of 6to4 will generally lead to a severe degradation of connection quality. See RFC6343. Default value is false (as recommended by RFC6343 section 4.1).

VendorClassID=string

Set DHCP option 60 (Vendor Class ID) to the given string. This option can be used by DHCP servers to identify specific clients without having to rely on MAC address ranges, etc

EnableOnlineCheck=true | false

Enable or disable use of HTTP GET as an online status check. When a service is in a READY state, and is selected as default, ConnMan will issue an HTTP GET request to verify that end-to-end connectivity is successful. Only then the service will be transitioned to ONLINE state. If this setting is false, the default service will remain in READY state. Default value is true. NOTE: EnableOnlineCheck is deprecated; please use OnlineCheckMode with a mode of either one-shot or none.

OnlineCheckMode=mode

This indicates the "online" HTTP-based Internet reachability check mode and supercedes and deprecates EnableOnlineCheck. Possible values for mode are none, one-shot, and continuous. The default value of mode is one-shot. In none mode, there are no "online" HTTP-based Internet reachability checks. Any connected service and the manager state will terminate at the "ready" state and will not progress to "online".

In one-shot mode, there is a single, one-shot "online" HTTP-based Internet reachability check for the default service. When the check succeeds, the associated service and the manager state will terminate at the "online" state. When the check fails, subsequent checks will be rescheduled according to OnlineCheckIntervalStyle, OnlineCheckInitialInterval, and OnlineCheckMaxInterval and will continue indefinitely until one succeeds or unti the service is disconnected.

In continuous mode, there are ongoing "online" HTTP-based Internet reachability check for the default service. As with "one-shot" mode, when the first check succeeds, the associated service and the manager state will terminate at the "online" state. Thereafter, subsequent checks will be scheduled according to OnlineCheckIntervalStyle and OnlineCheckMaxInterval. When the check fails, subsequent checks will be rescheduled according to OnlineCheckIntervalStyle, OnlineCheckInitialInterval, and OnlineCheckMaxInterval. When and if OnlineCheckFailuresThreshold is met, the service and manager state will be demoted to "ready" and the service will have its "Error" property set to "online-check-failed" while subsequent checks will continue. In the interim, if available, another service may be promoted to the default service and online checks will be initiated for it. When and if, for the demoted service, OnlineCheckSuccessesThreshold is met, the service "Error" property will be cleared and the service state promoted to "online", potentially causing it to become the default service again.

OnlineCheckIPv4URL=url,OnlineCheckIPv6URL=url

Urls (IPv4 and IPv6 respectively) used during the online status check. Please refer to the README for more detailed information. Default values are http://ipv4.connman.net/online/status.html and http://ipv6.connman.net/online/status.html respectively.

OnlineCheckConnectTimeout=secs[.milliseconds]

The time, in decimal seconds (for example, 12.3), to wait for a successful TCP connection to the host associated with OnlineCheckIPv4URL or OnlineCheckIPv6URL (see above). Connections that take longer than OnlineCheckConnectTimeout will be aborted. The default value is zero ('0') which indicates that no explicit connection timeout will be used, leaving the timeout to the underlying operating system and network stack.

OnlineCheckInitialInterval=interval,OnlineCheckMaxInterval=interval

Range of intervals between two online check requests. Please refer to the README for more detailed information. Default values are 1 and 12 respectively.

OnlineCheckIntervalStyle=fibonacci | geometric

The style or mathematical series function used to compute the actual time, in seconds, between two "ready" to "online" HTTP-based Internet reachability checks. The value of which may be either "geometric" or "fibonacci" with a default value of "geometric". The "geometric" style or function simply takes the square of the online check interval (see OnlineCheckInitialInterval and OnlineCheckMaxInterval above). For example, at a check interval of 6, the time, in seconds, is 36 (6^2) seconds.

The "fibonacci" style or function takes the value of the Fibonacci sequence at the online check interval. For example, at a check interval of 6, the time, in seconds, is 8 seconds.

The "fibonacci" series and style is more aggressive in check rate up to 12 steps (its equivalence point with "geometric" at 144 seconds) than "geometric" but backs off far more aggressively past that point reaching an hour at interval 19 which "geometric" does not reach until interval 60.

EnableOnlineToReadyTransition=true | false

In addition to EnableOnlineCheck setting, enable or disable use of HTTP GET to detect the loss of end-to-end connectivity. If this setting is false, when the default service transitions to ONLINE state, the HTTP GET request is no more called until next cycle, initiated by a transition of the default service to DISCONNECT state. If this setting is true, the HTTP GET request keeps beeing called to guarantee that end-to-end connectivity is still successful. If not, the default service will transition to READY state, enabling another service to become the default one, in replacement. Default value is false. NOTE: EnableOnlineToReadyTransition is deprecated; please use OnlineCheckMode with a mode of either continuous or none.

OnlineCheckFailuresThreshold=failures

When OnlineCheckMode is "continuous", this is the number of failed back-to-back "ready" to "online" HTTP-based Internet reachability checks that will be allowed before marking a service as "failed" from a reachability perspective, sorting it at a lower priority than other services not so marked. Lower values may result in higher-frequency network service cycling while higher values may result in a longer period of time before failing from a non-Internet reachable service to one that might be.

See OnlineCheckIntervalStyle, OnlineCheckInitialInterval, and OnlineCheckMaxInterval for other values that influence network service failure/recovery transition time. The default value is 6.

OnlineCheckSuccessesThreshold=successes

When OnlineCheckMode is "continuous", this is the number of successful back-to-back "ready" to "online" HTTP-based Internet reachability checks that must be met before clearing a service as "failed" from a reachability perspective and allowing it to transition to the "online" state again, allowing it to sort back to a higher priority relative to other network services. Lower values may result in higher-frequency network service cycling while higher values may result in a longer period of time before transitioning back to more a preferred, Internet reachable network service.

See OnlineCheckIntervalStyle, OnlineCheckInitialInterval, and OnlineCheckMaxInterval for other values that influence network service failure/recovery transition time.

The default value is 6.

AutoConnectRoamingServices=true | false

Automatically connect roaming services. This is not recommended unless you know you won't have any billing problem. Default value is false.

AddressConflictDetection=true | false

Enable or disable the implementation of IPv4 address conflict detection according to RFC5227. ConnMan will send probe ARP packets to see if an IPv4 address is already in use before assigning the address to an interface. If an address conflict occurs for a statically configured address, an IPv4LL address will be chosen instead (according to RFC3927). If an address conflict occurs for an address offered via DHCP, ConnMan send a DHCP DECLINE once and for the second conflict resort to finding an IPv4LL address. Default value is false.

Localtime=string

Path to localtime file. Defaults to /etc/localtime.

RegdomFollowsTimezone=true | false

Enable regdomain to be changed along timezone changes. With this option set to true each time the timezone changes the first present ISO3166 country code is being read from /usr/share/zoneinfo/zone1970.tab and set as regdom value. Default value is false.

ResolvConf=string

Path to resolv.conf file. If the file does not exist, but intermediate directories exist, it will be created. If this option is not set, it tries to write into /run/connman/resolv.conf and fallbacks to /etc/resolv.conf if it fails (/run/connman does not exist or is not writeable). If you do not want to update resolv.conf, you can set /dev/null.

## EXAMPLE
The following example configuration disables hostname updates and enables ethernet tethering.

```
[General]
AllowHostnameUpdates = false
AllowDomainnameUpdates = false
TetheringTechnologies = ethernet,wifi,bluetooth,gadget
```

## SEE ALSO
connman(8)


conntrackd.conf

package: conntrack-tools

title: conntrackd.conf(5)

text:
# conntrackd.conf(5)

## NAME
conntrackd.conf - configuration file for conntrackd daemon

## DESCRIPTION
conntrackd.conf is the main configuration file for the conntrackd(8) daemon. It is loaded by calling `conntrackd -C conntrackd.conf'.

The format of this file is simple, using brackets for sections and key-value pairs for concrete configuration directives:

```
	section1 {
		option1 value1
		option2 value2
	}
	section2 {
		option3 value3
		subsection1 {
			option4 value4
		}
	}
```

You should consider this file as case-sensitive. Empty lines and lines starting with the '#' character are ignored.

Before starting to develop a new configuration, you may want to learn the concepts behind this technology at http://conntrack-tools.netfilter.org/manual.html.

There are complete configuration examples at the end of this man page.

## SYNC
This top-level section defines how conntrackd(8) should handle synchronization with other cluster nodes.

There are 3 main synchronization modes or protocols: NOTRACK, ALARM and FTFW.

There are 3 transport protocols as well: TCP, Multicast and UDP.

You have to choose one synchronization mode and one transport protocol.

Also, there are some general options in this section.

### Mode FTFW
This mode is based on a reliable protocol that performs message tracking. Thus, the protocol can recover from message loss, re-ordering and corruption.

In this synchronization mode you may configure ResendQueueSize, CommitTimeout, PurgeTimeout, ACKWindowSize , DisableExternalCache and StartupResync.

ResendQueueSize <value>

Size of the resend queue (in objects). This is the maximum number of objects that can be stored waiting to be confirmed via acknowledgment. If you keep this value low, the daemon will have less chances to recover state-changes under message omission. On the other hand, if you keep this value high, the daemon will consume more memory to store dead objects. Example: ResendQueueSize 131072

Default is 131072 objects.

CommitTimeout <seconds>

This parameter allows you to set an initial fixed timeout for the committed entries when this node goes from backup to primary. This mechanism provides a way to purge entries that were not recovered appropriately after the specified fixed timeout. If you set a low value, TCP entries in Established states with no traffic may hang. For example, an SSH connection without KeepAlive enabled. Example: CommitTimeout 180

By default, this option is not set (the daemon uses an approximate timeout value calculation mechanism).

PurgeTimeout <seconds>

If the firewall replica goes from primary to backup, the `conntrackd -t command' is invoked in the script. This command schedules a flush of the table in N seconds. This is useful to purge the connection tracking table of zombie entries and avoid clashes with old entries if you trigger several consecutive hand-overs.

Default is 60 seconds.

ACKWindowSize <value>

Set the acknowledgment window size. If you decrease this value, the number of acknowledgments increases. More acknowledgments means more overhead as conntrackd(8) has to handle more control messages. On the other hand, if you increase this value, the resend queue gets more populated. This results in more overhead in the queue releasing. Example: ACKWindowSize 300

If not set, default window size is 300 (value is based on some practical experiments measuring the cycles spent by the acknowledgment handling with oprofile).

DisableExternalCache <yes|no>

This clause allows you to disable the external cache. Thus, the state entries are directly injected into the kernel conntrack table. As a result, you save memory in user-space but you consume slots in the kernel conntrack table for backup state entries. Moreover, disabling the external cache means more CPU consumption. You need a Linux kernel >= 2.6.29 to use this feature. If you are installing conntrackd(8) for first time, please read the user manual and I encourage you to consider using the fail-over scripts instead of enabling this option!

By default this is set to no, meaning the external cache is enabled.

StartupResync <yes|no>

Order conntrackd to request a complete conntrack table resync against the other node at startup. A single request will be made. This is useful to get in sync with another node which has been running while we were down.

Example: StartupResync yes

By default, this clause is set to no.

### Mode ALARM
This mode is spamming. It is based on a alarm-based protocol that periodically re-sends the flow state to the backup firewall replicas. This protocol consumes a lot of bandwidth but it resolves synchronization problems fast.

In this synchronization mode you may configure RefreshTime, CacheTimeout, CommitTimeout and PurgeTimeout.

RefreshTime <seconds>

If a conntrack entry is not modified in <= N seconds, then a message is broadcasted. For example, this mechanism may be used to resynchronize nodes that just joined the multicast group. Example: RefreshTime 15

CacheTimeout <seconds>

If we don't receive a notification about the state of an entry in the external cache after N seconds, then remove it. Example: CacheTimeout 180

CommitTimeout <seconds>

Same as in FTFW mode.

PurgeTimeout <seconds>

Same as in FTFW mode.

### Mode NOTRACK
Is the most simple mode as it is based on a best effort replication protocol, ie. unreliable protocol. This protocol sends and receives the state information without performing any specific checking.

In this synchronization mode you may configure DisableInternalCache, DisableExternalCache, CommitTimeout, PurgeTimeout and StartupResync.

DisableInternalCache <yes|no>

This clause allows you to disable the internal cache. Thus, the synchronization messages are directly sent through the dedicated link. This option is set to no by default.

DisableExternalCache <yes|no>

Same as in FTFW mode.

CommitTimeout <seconds>

Same as in FTFW mode.

PurgeTimeout <seconds>

Same as in FTFW mode.

StartupResync <yes|no>

Same as in FTFW mode.

### MULTICAST
This section indicates to conntrackd(8) to use multicast as transport mechanism between nodes of the firewall cluster.

Please note you can specify more than one dedicated link. Thus, if one dedicated link fails, the daemon can fail-over to another. Note that adding more than one dedicated link does not mean that state-updates will be sent to all of them. There is only one active dedicated link at a given moment.

The Default keyword indicates that this interface will be selected as the initial dedicated link. You can have up to 4 redundant dedicated links.

Note: use different multicast groups for every redundant link.

Example:

```
	Multicast Default {
		IPv4_address 225.0.0.51
		Group 3781
		IPv4_interface 192.168.100.101
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
	Multicast {
		IPv4_address 225.0.0.51
		Group 3782
		IPv4_interface 192.168.100.102
		Interface eth4
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
```

IPv4_address <address>

Multicast address: The address that you use as destination in the synchronization messages. You do not have to add this IP to any of your existing interfaces. Example: IPv4_address 255.0.0.50

Group <number>

The multicast group that identifies the cluster. Example: Group 3780

If any doubt, do not modify this value.

IPv4_interface <address>

IP address of the interface that you are going to use to send the synchronization messages. Remember that you must use a dedicated link for the synchronization messages. Example: IPv4_interface 192.168.100.100

Interface <name>

The name of the interface that you are going to use to send the synchronization messages. Example: Interface eth2

SndSocketBuffer <number>

This transport protocol sender uses a buffer to enqueue the packets that are going to be transmitted. The default size of this socket buffer is available at /proc/sys/net/core/wmem_default. This value determines the chances to have an overrun in the sender queue. The overrun results in packet loss, thus, losing state information that would have to be retransmitted. If you notice some packet loss, you may want to increase the size of the buffer. The system default size is usually around ~100 KBytes which is fairly small for busy firewalls.

Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

Example: SndSocketBuffer 1249280

RcvSocketBuffer <number>

This transport protocol receiver uses a buffer to enqueue the packets that the socket is pending to handle. The default size of this socket buffer is available at /proc/sys/net/core/rmem_default. This value determines the chances to have an overrun in the receiver queue. The overrun results in packet loss, thus, losing state information that would have to be retransmitted. If you notice some packet loss, you may want to increase the size of the buffer. The system default size is usually around ~100 KBytes which is fairly small for busy firewalls.

Note: The NOTRACK protocol is best effort, it is really recommended to increase the buffer size.

Example: RcvSocketBuffer 1249280

Checksum <yes|no>

Enable/Disable message checksumming. This is a good property to achieve fault-tolerance. In case of doubt, use it.

### UDP
This section indicates to conntrackd(8) to use UDP as transport mechanism between nodes of the firewall cluster.

As in the Multicast configuration, you may specify several fail-over dedicated links using the Default keyword.

Example:

```
	UDP {
		IPv4_address 172.16.0.1
		IPv4_Destination_Address 172.16.0.2
		Port 3781
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum on
	}
```

IPv4_address <address>

UDP IPv4 address that this firewall uses to listen to events. Example: IPv4_address 192.168.2.100

IPv6_address <address>

UDP IPv6 address that this firewall uses to listen to events. Example: IPv6_address fe80::215:58ff:fe28:5a27

IPv4_Destination_Address <address>

Destination IPv4 UDP address that receives events, ie. the other firewall's dedicated link address. Example: IPv4_Destination_Address 192.168.2.101

IPv6_Destionation_Address <address>

Destination IPv6 UDP address that receives events, ie. the other firewall's dedicated link address. Example: IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c

Port <number>

UDP port used Example: Port 3780

Interface <name>

Same as in the Multicast transport protocol configuration.

SndSocketBuffer <number>

Same as in the Multicast transport protocol configuration.

RcvSocketBuffer <number>

Same as in the Multicast transport protocol configuration.

Checksum <yes|no>

Same as in the Multicast transport protocol configuration.

### TCP
You can also use Unicast TCP to propagate events.

If you combine this transport with the NOTRACK mode, it becomes reliable.

The TCP transport protocol can be configured in exactly the same way as the UDP transport protocol.

As in the Multicast configuration, you may specify several fail-over dedicated links using the Default keyword.

Example:

```
	TCP {
		IPv6_address fe80::215:58ff:fe28:5a27
		IPv6_Destination_Address fe80::215:58ff:fe28:5a27
		Port 3781
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum yes
	}
```

### OPTIONS
Other unsorted options that are related to the synchronization protocol or transport mechanism.

TCPWindowTracking <yes|no>

TCP state-entries have window tracking disabled by default, you can enable it with this option. As said, default is off. This feature requires a Linux kernel >= 2.6.36.

ExpectationSync <on|{ list }>

Set this option on if you want to enable the synchronization of expectations. You have to specify the list of helpers that you want to enable. This feature requires a Linux kernel >= 3.5.

Example, sync all expectations:

```
	ExpectationSync on
```

Example, sync given expectations:

```
	ExpectationSync {
		ftp
		ras
		q.931
		h.245
		sip
	}
```

By default, this option is disabled.

## GENERAL
This top-level section contains generic configuration directives for the conntrackd(8) daemon.

Systemd <yes|no>

Enable systemd(1) runtime support if conntrackd(8) is compiled with the proper configuration. Then you can use a service unit of Type=notify. Obviously, this requires the init of your system to be systemd(1).

Note: systemd(1) watchdog is supported as well.

Example: Systemd yes

By default runtime support is enabled if conntrackd was built with the systemd feature. Otherwise is off.

Nice <value>

Deprecated. Conntrackd ignores this option and it will be removed in the future. Please note that you can run nice(1) and renice(1) externally. Also note that conntrackd(8) now uses by default a RT scheduler.

HashSize <value>

Number of buckets in the cache hashtable. The bigger it is, the closer it gets to O(1) at the cost of consuming more memory. Read some documents about tuning hashtables for further reference. Example: HashSize 32768

HashLimit <value>

Maximum number of conntracks, it should be double of /proc/sys/net/netfilter/nf_conntrack_max since the daemon may keep some dead entries cached for possible retransmission during state synchronization. Example: HashLimit 131072

LogFile <yes|no|filename>

Enable conntrackd(8) to log to a file. Example: LogFile no

Default is no. Default logfile is /var/log/conntrackd.log.

Syslog <yes|no|facility>

Enable connection logging via Syslog. If you set the facility, use the same as in the Stats section, otherwise you'll get a warning message. Example: Syslog local0

Default is off.

Lockfile <filename>

Lockfile to be used by conntrackd(8) (absolute path). Example: LockFile /var/lock/conntrack.lock

Default is /var/lock/conntrack.lock.

NetlinkBufferSize <value>

Netlink event socket buffer size. If you do not specify this clause, the default buffer size value in /proc/sys/net/core/rmem_default is used. This default value is usually around 100 Kbytes which is fairly small for busy firewalls. This leads to event message dropping and high CPU consumption. Example: NetlinkBufferSize 2097152

NetlinkBufferSizeMaxGrowth <value>

The daemon doubles the size of the netlink event socket buffer size if it detects netlink event message dropping. This clause sets the maximum buffer size growth that can be reached. Example: NetlinkBufferSizeMaxGrowth 8388608

NetlinkOverrunResync <yes|no|value>

If the daemon detects that Netlink is dropping state-change events, it automatically schedules a resynchronization against the Kernel after 30 seconds (default value). Resynchronizations are expensive in terms of CPU consumption since the daemon has to get the full kernel state-table and purge state-entries that do not exist anymore. Note: Be careful of setting a very small value here.

Example: NetlinkOverrunResync yes

The default value is 30 seconds. If not specified, the daemon assumes that this option is enabled and uses the default value.

NetlinkEventsReliable <yes|no>

If you want reliable event reporting over Netlink, set on this option. If you set on this clause, it is a good idea to set off NetlinkOverrunResync. You need Linux Kernel >= 2.6.31 for this option to work.

Example: NetlinkEventsReliable yes

This option is off by default.

PollSecs <seconds>

By default, the daemon receives state updates following an event-driven model. You can modify this behaviour by switching to polling mode with this clause. This clause tells conntrackd(8) to dump the states in the kernel every N seconds. With regards to synchronization mode, the polling mode can only guarantee that long-lifetime states are recovered. The main advantage of this method is the reduction in the state replication at the cost of reducing the chances of recovering connections.

Example: PollSecs 15

EventIterationLimit <value>

The daemon prioritizes the handling of state-change events coming from the core. With this clause, you can set the maximum number of state-change events (those coming from kernel-space) that the daemon will handle after which it will handle other events coming from the network or userspace. A low value improves interactivity (in terms of real-time behaviour) at the cost of extra CPU consumption.

Example: EventIterationLimit 100

Default (if not set) is 100.

### UNIX
Unix socket configuration. This socket is used by conntrackd(8) to listen to external commands like `conntrackd -k' or `conntrackd -n'.

Example:

```
	UNIX {
		Path /var/run/conntrackd.ctl
	}
```

Path <filename>

Absolute path to the Unix socket. Example: Path /var/run/conntrackd.ctl

Backlog <value>

Deprecated option.

### FILTER
Event filtering. This clause allows you to filter certain traffic.

There are currently three filter-sets: Protocol, Address and State. The filter is attached to an action that can be: Accept or Ignore. Thus, you can define the event filtering policy of the filter-sets in positive or negative logic depending on your needs.

You can select if conntrackd(8) filters the event messages from user-space or kernel-space. The kernel-space event filtering saves some CPU cycles by avoiding the copy of the event message from kernel-space to user-space. The kernel-space event filtering is preferred, however, you require a Linux kernel >= 2.6.29 to filter from kernel-space.

The syntax for this section is: Filter From <from> { }.

If you want to select kernel-space event filtering, use the keyword Kernelspace instead of Userspace.

Example:

```
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv6_address ::1
		}
		State Accept {
			ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
		}
	}
```

Protocol <policy> { <protocols list> }

Accept only certain protocols: You may want to replicate the state of flows depending on their layer 4 protocol. Policy is one of Accept or Ignore.

Protocols are: TCP, SCTP, DCCP, UDP, ICMP and IPv6-ICMP.

The ICMP and IPv6-ICMP protocols require a Linux kernel >= 2.6.31.

Example:

```
	Protocol Accept {
		TCP
		SCTP
		DCCP
	}
```

Address <policy> { <addresses list> }

Ignore traffic for a certain set of IP's: Usually all the IP assigned to the firewall since local traffic must be ignored, only forwarded connections are worth to replicate. Note that these values depends on the local IPs that are assigned to the firewall.

You may specify several IPv4_address and/or IPv6_address directives. You can also specify networks in CIDR format.

Policy is one of Accept or Ignore.

Example:

```
	Address Ignore {
		IPv4_address 127.0.0.1 # loopback
		IPv4_address 192.168.0.100 # virtual IP 1
		IPv4_address 192.168.1.100 # virtual IP 2
		IPv4_address 192.168.100.100 # dedicated link ip
		IPv4_address 192.168.0.0/24
		IPv6_address ::1
	}
```

State <policy> { <states list> for TCP }

Filter by flow state. This option introduces a trade-off in the replication: it reduces CPU consumption at the cost of having lazy backup firewall replicas. Note: only affects TCP flows.

The existing TCP states are: SYN_SENT, SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK, TIME_WAIT, CLOSED and LISTEN.

Policy is one of Accept or Ignore.

Example:

```
	State Accept {
		ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
	}
```

### SCHEDULER
Select a different scheduler for the daemon, you can select between RR and FIFO and the process priority.

Using a RT scheduler reduces the chances to overrun the Netlink buffer and conntrackd(8) uses by default RR unless FIFO is selected. See sched_setscheduler(2) for more information.

Example:

```
	Scheduler {
		Type FIFO
		Priority 99
	}
```

Type <type>

Supported values are RR or FIFO. Default: RR

Priority <value>

Value of the scheduler priority. Minimum is 0, maximum is 99. Default: 99 (as returned by sched_get_priority_max(2) for SCHED_RR)

## STATS
This top-level section indicates conntrackd(8) to work as a statistic collector for the nf_conntrack linux kernel subsystem.

LogFile <yes|no|filename>

If you enable this option, the daemon writes the information about destroyed connections to a logfile. Default is no. Default filename is /var/log/conntrackd-stats.log.

NetlinkEventsReliable <yes|no>

If you want reliable event reporting over Netlink, set on this option. If you set on this clause, it is a good idea to set off NetlinkOverrunResync. This requires Linux kernel >= 2.6.31. Default is no.

Syslog <yes|no|facility>

Enable connection logging via Syslog. If you set the facility, use the same as in the General section, otherwise you'll get a warning message. Example: Syslog local0

Default is no.

## HELPER
Note: this configuration is very advanced and has nothing to do with synchronization or stats collection.

This top-level section indicates conntrackd(8) to inject user-space helpers into the nf_conntrack linux kernel subsystem. It will result in the nf_conntrack engine sending connections to userspace for further processing.

Before this, you have to make sure you have registered the given user-space helper stub.

Example:

```
	% nfct add helper ftp inet tcp
```

Each user-space helper should be registered using a Type section, which are named this way:

```
	Type <name> <af> <transport>
```

Examples:

```
Helper {
	Type ftp inet tcp {
		QueueNum 0
		QueueLen 10240
		Policy ftp {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type rpc inet tcp {
		QueueNum 1
		QueueLen 10240
		Policy rpc {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type rpc inet udp {
		QueueNum 2
		QueueLen 10240
		Policy rpc {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type tns inet tcp {
		QueueNum 3
		QueueLen 10240
		Policy tns {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type dhcpv6 inet6 udp {
		QueueNum 4
		QueueLen 10240
		Policy dhcpv6 {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
	Type ssdp inet udp {
		QueueNum 5
		QueueLen 10240
		Policy ssdp {
			ExpectMax 1
			ExpectTimeout 300
		}
	}
}
```

Parameters inside the Type section:

QueueNum <number>

Set NFQUEUE number you want to use to receive traffic from the kernel. Example: QueueNum 0

QueueLen <number>

Maximum number of packets waiting in the queue to receive a verdict from user-space. Rise value if you hit the following error message:

```
	"nf_queue: full at X entries, dropping packet(s)"
```

Default is 1024.

Example: QueueLen 10240

Policy <name> { }

Set the expectation policy for the given helper. This sub-section contains 2 directives: ExpectMax <number> (maximum number of simultaneous expectations) and ExpecTimeout <seconds> (maximum living time for one expectation).

## COMPLETE EXAMPLES
Find below some real-life working examples.

### STATS EXAMPLE
This configuration example tells conntrackd(8) to work as a stats collector.

```
Stats {
	LogFile yes
	NetlinkEventsReliable no
	Syslog yes
}
General {
	Systemd yes
	HashSize 8192
	HashLimit 65535
	Syslog yes
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 262142
	NetlinkBufferSizeMaxGrowth 655355
	Filter {
		Protocol Accept {
			TCP
			UDP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv6_address ::1
		}
	}
}
```

### SYNC EXAMPLE 1
This example configures synchronization in FTFW mode with Multicast transport.

It includes common general configuration as well.

Note: this is one of the recommended setups for conntrackd(8) in a firewall cluster environment.

```
Sync {
	Mode FTFW {
		ResendQueueSize 131072
		PurgeTimeout 60
		ACKWindowSize 300
		DisableExternalCache no
	}
	Multicast {
		IPv4_address 225.0.0.50
		Group 3780
		IPv4_interface 192.168.100.100
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum yes
	}
	Multicast Default {
		IPv4_address 225.0.0.51
		Group 3781
		IPv4_interface 192.168.100.101
		Interface eth3
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum yes
	}
	Options {
		TCPWindowTracking no
		ExpectationSync yes
	}
}
General {
	Systemd yes
	HashSize 32768
	HashLimit 131072
	LogFile yes
	Syslog no
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 2097152
	NetlinkBufferSizeMaxGrowth 8388608
	NetlinkOverrunResync yes
	NetlinkEventsReliable no
	EventIterationLimit 100
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv4_address 192.168.100.0/24
			IPv6_address ::1
		}
	}
}
```

### SYNC EXAMPLE 2
This example configures synchronization in NOTRACK mode with TCP transport.

It includes common general configuration as well.

```
Sync {
	Mode NOTRACK {
		DisableInternalCache yes
		DisableExternalCache yes
	}
	TCP {
		IPv4_address 192.168.2.100
		IPv4_Destination_Address 192.168.2.101
		Port 3780
		Interface eth2
		SndSocketBuffer 1249280
		RcvSocketBuffer 1249280
		Checksum yes
	}
	Options {
		TCPWindowTracking no
		ExpectationSync yes
	}
}
General {
	Systemd yes
	HashSize 32768
	HashLimit 131072
	LogFile yes
	Syslog no
	LockFile /var/lock/conntrack.lock
	UNIX {
		Path /var/run/conntrackd.ctl
	}
	NetlinkBufferSize 2097152
	NetlinkBufferSizeMaxGrowth 8388608
	NetlinkOverrunResync yes
	NetlinkEventsReliable no
	EventIterationLimit 100
	Filter From Userspace {
		Protocol Accept {
			TCP
			SCTP
			DCCP
		}
		Address Ignore {
			IPv4_address 127.0.0.1
			IPv4_address 192.168.0.0/16
			IPv6_address ::1
		}
		State Accept {
			ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
		}
	}
}
```

## SEE ALSO
conntrackd(8), conntrack(8), nfct(8), http://conntrack-tools.netfilter.org/manual.html

## AUTHOR
Pablo Neira Ayuso wrote and maintains the conntrackd tool.

This manual page was written by Arturo Borrero Gonzalez <arturo@debian.org> based on the conntrackd tarball config examples.

Please send bug reports to <netfilter-devel@lists.netfilter.org>. Subscription is required.

This documentation is free/libre under the terms of the GPLv2+.


containerd-config.toml

package: containerd

title: containerd-config.toml(5)

summary: configuration file for containerd

text:
# containerd-config.toml(5)

## NAME
containerd-config.toml - configuration file for containerd

## SYNOPSIS
The config.toml file is a configuration file for the containerd daemon. The file must be placed at /etc/containerd/config.toml or specified with the --config option of containerd to be used by the daemon. If the file does not exist at the appropriate location or is not provided via the --config option containerd uses its default configuration settings, which can be displayed with the containerd config(1) command.

## DESCRIPTION
The TOML file used to configure the containerd daemon settings has a short list of global settings followed by a series of sections for specific areas of daemon configuration. There is also a section for plugins that allows each containerd plugin to have an area for plugin-specific configuration and settings.

## FORMAT
version : The version field in the config file specifies the config’s version. If no version number is specified inside the config file then it is assumed to be a version 1 config and parsed as such. Version 4 is the latest config version. Older configs are automatically migrated on startup.

root : The root directory for containerd metadata. (Default: "/var/lib/containerd")

state : The state directory for containerd (Default: "/run/containerd")

plugin_dir : The directory for dynamic plugins to be stored

[grpc] (deprecated in version 4) : Section for gRPC socket listener settings. In version 4, use the server plugins io.containerd.server.v1.grpc and io.containerd.server.v1.grpc-tcp instead. Existing configs are migrated automatically. Contains the following properties:

- address (Default: "/run/containerd/containerd.sock")

- tcp_address

- tcp_tls_cert

- tcp_tls_key

- uid (Default: 0)

- gid (Default: 0)

- max_recv_message_size

- max_send_message_size

[ttrpc] (deprecated in version 4) : Section for TTRPC settings. In version 4, use the server plugin io.containerd.server.v1.ttrpc instead. In prior versions, when the TTRPC address was not explicitly set it was derived from the GRPC address (grpcAddress + ".ttrpc") and inherited GRPC’s UID/GID. In version 4, each server plugin is independently configured; the TTRPC plugin uses its own defaults when its configuration block is omitted. Contains properties:

- address (Default: "")

- uid (Default: 0)

- gid (Default: 0)

[debug] (deprecated in version 4) : Section to enable and configure a debug socket listener. In version 4, use the server plugin io.containerd.server.v1.debug instead. Contains properties:

- address (Default: "/run/containerd/debug.sock")

- uid (Default: 0)

- gid (Default: 0)

- level (Default: "info") sets the debug log level. Supported levels are: "trace", "debug", "info", "warn", "error", "fatal", "panic"

- format (Default: "text") sets log format. Supported formats are "text" and "json"

[metrics] (deprecated in version 4) : Section to enable and configure a metrics listener. In version 4, use the server plugin io.containerd.server.v1.metrics instead. Contains properties:

- address (Default: "") Metrics endpoint does not listen by default

- grpc_histogram (Default: false) Turn on or off gRPC histogram metrics

disabled_plugins : Disabled plugins are IDs of plugins to disable. Disabled plugins won't be initialized and started.

required_plugins : Required plugins are IDs of required plugins. Containerd exits if any required plugin doesn't exist or fails to be initialized or started.

[plugins] : The plugins section contains configuration options exposed from installed plugins. The following plugins are enabled by default and their settings are shown below. Plugins that are not enabled by default will provide their own configuration values documentation.

•

[plugins."io.containerd.server.v1.grpc"] configures the main gRPC server listener (version 4):

- address (Default: "/run/containerd/containerd.sock")

- uid (Default: effective UID)

- gid (Default: effective GID)

- max_recv_message_size (Default: 16777216)

- max_send_message_size (Default: 16777216)

•

[plugins."io.containerd.server.v1.grpc-tcp"] configures the TCP gRPC server listener (version 4). Skipped if address is empty:

- address (Default: "")

- tls_cert, tls_key, tls_ca, tls_common_name

- max_recv_message_size (Default: 16777216)

- max_send_message_size (Default: 16777216)

•

[plugins."io.containerd.server.v1.ttrpc"] configures the TTRPC server listener (version 4). In version 4, this plugin is configured independently from the gRPC plugin. If the plugin block is omitted, the TTRPC server binds to its own default address rather than deriving one from the gRPC address:

- address (Default: "/run/containerd/containerd.sock.ttrpc")

- uid (Default: effective UID)

- gid (Default: effective GID)

•

[plugins."io.containerd.server.v1.debug"] configures the debug server listener (version 4). Skipped if address is empty:

- address (Default: "")

- uid (Default: 0)

- gid (Default: 0)

•

[plugins."io.containerd.server.v1.metrics"] configures the metrics HTTP listener (version 4). Skipped if address is empty:

•

address (Default: "")

- [plugins."io.containerd.monitor.v1.cgroups"] has one option no_prometheus (Default: false)

- [plugins."io.containerd.service.v1.diff-service"] has one option default, a list by default set to ["walking"]

- [plugins."io.containerd.gc.v1.scheduler"] has several options that perform advanced tuning for the scheduler:

- pause_threshold is the maximum amount of time GC should be scheduled (Default: 0.02),

- deletion_threshold guarantees GC is scheduled after n number of deletions (Default: 0 [not triggered]),

- mutation_threshold guarantees GC is scheduled after n number of database mutations (Default: 100),

- schedule_delay defines the delay after trigger event before scheduling a GC (Default "0ms" [immediate]),

- startup_delay defines the delay after startup before scheduling a GC (Default "100ms")

•

[plugins."io.containerd.runtime.v2.task"] specifies options for configuring the runtime shim:

- platforms specifies the list of supported platforms

- sched_core Core scheduling is a feature that allows only trusted tasks to run concurrently on cpus sharing compute resources (eg: hyperthreads on a core). (Default: false)

•

[plugins."io.containerd.service.v1.tasks-service"] has performance options:

- blockio_config_file (Linux only) specifies path to blockio class definitions (Default: ""). Controls I/O scheduler priority and bandwidth throttling. See blockio configuration ⟨https://github.com/intel/goresctrl/blob/main/doc/blockio.md#configuration⟩ for details of the file format.

- rdt_config_file (Linux only) specifies path to a configuration used for configuring RDT (Default: ""). Enables support for Intel RDT, a technology for cache and memory bandwidth management. See RDT configuration ⟨https://github.com/intel/goresctrl/blob/main/doc/rdt.md#configuration⟩ for details of the file format.

•

[plugins."io.containerd.grpc.v1.cri".containerd] contains options for the CRI plugin, and child nodes for CRI options:

•

default_runtime_name (Default: "runc") specifies the default runtime name

- [plugins."io.containerd.grpc.v1.cri".containerd.runtimes] one or more container runtimes, each with a unique name

- [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.<runtime>] a runtime named <runtime>

- [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.<runtime>.options] options for the named <runtime>, most important:

•

BinaryName specifies the path to the actual runtime to be invoked by the shim, e.g. "/usr/bin/runc"

oom_score : The out of memory (OOM) score applied to the containerd daemon process (Default: 0)

[cgroup] : Section for Linux cgroup specific settings

•

path (Default: "") Specify a custom cgroup path for created containers

[proxy_plugins] : Proxy plugins configures plugins which are communicated to over gRPC

- type (Default: "")

- address (Default: "")

timeouts : Timeouts specified as a duration <!-- [timeouts]

"io.containerd.timeout.shim.cleanup" = "5s"

"io.containerd.timeout.shim.load" = "5s"

"io.containerd.timeout.shim.shutdown" = "3s"

"io.containerd.timeout.task.state" = "2s" -->

imports : Imports is a list of additional configuration files to include. This allows to split the main configuration file and keep some sections separately (for example vendors may keep a custom runtime configuration in a separate file without modifying the main config.toml). Imported files will overwrite simple fields like int or string (if not empty) and will append array and map fields. Imported files are also versioned, and the version can't be higher than the main config.

stream_processors

- accepts (Default: "[]") Accepts specific media-types

- returns (Default: "") Returns the media-type

- path (Default: "") Path or name of the binary

- args (Default: "[]") Args to the binary

## EXAMPLES

### Version 4 Configuration
The following is a config.toml example using version 4, where server settings are configured as plugins:

```
version = 4
root = "/var/lib/containerd"
state = "/run/containerd"
oom_score = 0
imports = ["/etc/containerd/runtime_*.toml", "./debug.toml"]
[plugins."io.containerd.server.v1.grpc"]

  address = "/run/containerd/containerd.sock"
[plugins."io.containerd.server.v1.ttrpc"]

  address = "/run/containerd/containerd.sock.ttrpc"
[plugins."io.containerd.server.v1.debug"]

  address = "/run/containerd/debug.sock"

  level = "info"
[cgroup]

  path = ""
[plugins]

  [plugins."io.containerd.monitor.v1.cgroups"]

    no_prometheus = false

  [plugins."io.containerd.service.v1.diff-service"]

    default = ["walking"]

  [plugins."io.containerd.gc.v1.scheduler"]

    pause_threshold = 0.02

    deletion_threshold = 0

    mutation_threshold = 100

    schedule_delay = 0

    startup_delay = "100ms"

  [plugins."io.containerd.runtime.v2.task"]

    platforms = ["linux/amd64"]

    sched_core = true

  [plugins."io.containerd.service.v1.tasks-service"]

    blockio_config_file = ""

    rdt_config_file = ""
```

### Multiple Runtimes
The following is an example partial configuration with two runtimes:

```
[plugins]

  [plugins."io.containerd.grpc.v1.cri"]

    [plugins."io.containerd.grpc.v1.cri".containerd]

      default_runtime_name = "runc"

      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]

        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]

          privileged_without_host_devices = false

          runtime_type = "io.containerd.runc.v2"

          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]

            BinaryName = "/usr/bin/runc"

        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.other]

          privileged_without_host_devices = false

          runtime_type = "io.containerd.runc.v2"

          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.other.options]

            BinaryName = "/usr/bin/path-to-runtime"
```

The above creates two named runtime configurations - named runc and other - and sets the default runtime to runc. The above are used solely for runtimes invoked via CRI. To use the non-default "other" runtime in this example, a spec will include the runtime handler named "other" to specify the desire to use the named runtime config.

The CRI specification includes a runtime_handler field ⟨https://github.com/kubernetes/cri-api/blob/de5f1318aede866435308f39cb432618a15f104e/pkg/apis/runtime/v1/api.proto#L476⟩, which will reference the named runtime.

It is important to note the naming convention. Runtimes are under [plugins."io.containerd.grpc.v1.cri".containerd.runtimes], with each runtime given a unique name, e.g. [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]. In addition, each runtime can have shim-specific options under [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.<runtime>.options], for example, [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options].

The io.containerd.runc.v2 runtime is used to run OCI-compatible runtimes on Linux, such as runc. In the example above, the runtime_type field specifies the shim to use (io.containerd.runc.v2) while the BinaryName field is a shim-specific option which specifies the path to the OCI runtime.

For the example configuration named "runc", the shim will launch /usr/bin/runc as the OCI runtime. For the example configuration named "other", the shim will launch /usr/bin/path-to-runtime instead.

## BUGS
Please file any specific issues that you encounter at

⟨https://github.com/containerd/containerd⟩.

## AUTHOR
Phil Estes ⟨estesp@gmail.com⟩

## SEE ALSO
ctr(8), containerd-config(8), containerd(8)


.containerignore

package: containers-common

title: .containerignore(5)

text:
# .containerignore(5)

## NAME
.containerignore(.dockerignore) - files to ignore buildah or podman build context directory

## INTRODUCTION
Before container engines build an image, they look for a file named .containerignore or .dockerignore in the root context directory. If one of these file exists, the CLI modifies the context to exclude files and directories that match patterns specified in the file. This avoids adding them to images using the ADD or COPY instruction.

The CLI interprets the .containerignore or .dockerignore file as a newline-separated list of patterns similar to the file globs of Unix shells. For the purposes of matching, the root of the context is considered to be both the working and the root directory. For example, the patterns /foo/bar and foo/bar both exclude a file or directory named bar in the foo subdirectory of PATH or in the root of the git repository located at URL. Neither excludes anything else.

If a line in .containerignore or .dockerignore file starts with # in column 1, then this line is considered as a comment and is ignored before interpreted by the CLI.

## EXAMPLES
Here is an example .containerignore file:

```
# comment
*/temp*
*/*/temp*
temp?
```

This file causes the following build behavior: Rule Behavior

```
# comment 	Ignored.
*/temp* 	Exclude files and directories whose names start with temp in any immediate subdirectory of the root.
For example, the plain file /somedir/temporary.txt is excluded, as is the directory /somedir/temp.
*/*/temp* 	Exclude files and directories starting with temp from any subdirectory that is two levels below the
root. For example, /somedir/subdir/temporary.txt is excluded.
temp? 	Exclude files and directories in the root directory whose names are a one-character extension of temp. For example, /tempa and /tempb are excluded.
```

Matching is done using Go’s filepath.Match rules. A preprocessing step removes leading and trailing whitespace and eliminates . and .. elements using Go’s filepath.Clean. Lines that are blank after preprocessing are ignored.

Beyond Go’s filepath.Match rules, Docker also supports a special wildcard string ** that matches any number of directories (including zero). For example, */.go will exclude all files that end with .go that are found in all directories, including the root of the build context.

Lines starting with ! (exclamation mark) can be used to make exceptions to exclusions. The following is an example .containerignore file that uses this mechanism:

```
*.md
!README.md
```

All markdown files except README.md are excluded from the context.

The placement of ! exception rules influences the behavior: the last line of the .containerignore that matches a particular file determines whether it is included or excluded. Consider the following example:

```
*.md
!README*.md
README-secret.md
```

No markdown files are included in the context except README files other than README-secret.md.

Now consider this example:

```
*.md
README-secret.md
!README*.md
```

All of the README files are included. The middle line has no effect because !README*.md matches README-secret.md and comes last.

You can even use the .containerignore file to exclude the Containerfile or Dockerfile and .containerignore files. These files are still sent to the daemon because it needs them to do its job. But the ADD and COPY instructions do not copy them to the image.

Finally, you may want to specify which files to include in the context, rather than which to exclude. To achieve this, specify * as the first pattern, followed by one or more ! exception patterns.

## SEE ALSO
buildah-build(1), podman-build(1), docker-build(1)

## HISTORY
*Sep 2021, Compiled by Dan Walsh (dwalsh at redhat dot com) based on docker.com .dockerignore documentation.