vyos-documentation.git, branch mergify/bp/circinus/pr-2244

container: document remaining per-container options and network types (#2244)

2026-10-22T17:55:24+00:00

* container: document remaining per-container options and network types The container page covered 44 of the 53 nodes in container.xml.in. Add the eight that were missing, grouped where they belong on the page: - allow-host-cgroups, next to allow-host-pid - network mac, next to the network address option - volume propagation, with all six modes - stop-timeout, next to restart - shared-memory, next to memory - network type bridge / type macvlan mode / type macvlan parent The network type is the notable gap: MACVLAN was entirely undocumented, although it is the way to put containers directly on a parent network instead of behind the host bridge and NAT. The page now states that parent and mode are both required, that the parent must exist, and that MACVLAN networks cannot be assigned to a VRF - all three are enforced by verify() in src/conf_mode/container.py. Defaults and ranges are taken from container.xml.in; the "--cgroupns host" note matches what the quadlet generator emits. * container: describe volume propagation in terms of mount events The six propagation modes were described in terms of sub-mount visibility, taken from the text in container.xml.in. That is not what the modes do - mount(2)/umount(2) event propagation is. Per mount_namespaces(7): - MS_SHARED propagates events *both ways* between members of the peer group, not only from the original mount to the replica - MS_PRIVATE propagates no events out of or into the mount; it does not hide sub-mounts within it Also note the constraint the host side imposes, which is easy to trip over: per docker-run(1)/podman, shared propagation requires the source mount to be shared and slave requires it to be shared or slave, or the requested mode silently does not take effect. Added the findmnt invocation to check it. Raised by CodeRabbit on #2244. * container: document stop-timeout range and MACVLAN private mode precisely (cherry picked from commit de45e02be519513c45229db2f9d1db6cc759970d) # Conflicts: # docs/configuration/container/index.md

Merge pull request #2354 from vyos/mergify/bp/circinus/pr-2341

2026-10-19T18:25:50+00:00

T861: secure-boot: document show secure-boot op-mode commands (backport #2341)

T861: secure-boot: replace install mok with mokutil

2026-10-19T18:24:04+00:00

Enrolling a MOK is only needed for development with custom signed images. Official LTS images ship officially signed binaries and boot out of the box. (cherry picked from commit 07df2e477ba2c6846ca5626fd5e8c2e9a96cfd3a)

Apply formatting suggestion from @github-actions[bot]

2026-10-19T15:13:37+00:00

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> (cherry picked from commit 2277fc507fa87d3c1ade5b477c7c139dc3e970c0)

T861: secure-boot: document show secure-boot op-mode commands

2026-10-19T15:13:36+00:00

Add an Operation section with {opcmd} entries for 'show secure-boot' and 'show secure-boot detail', and reference it from the installation verification step. (cherry picked from commit 8a30d067745b07146768fd4e1e428cdf98c6407c)

Merge pull request #2353 from vyos/mergify/bp/circinus/pr-2340

2026-10-17T17:55:56+00:00

container: T9453: explain migration to kernel overlayfs from fuse-overlayfs (backport #2340)

container: T9453: explain migration to kernel overlayfs from fuse-overlayfs

2026-10-17T17:55:06+00:00

(cherry picked from commit 6fb26907c617758fe2f27546b7a50d0f0da5aada)

Merge pull request #2325 from LiudmylaNad/mergify/bp/circinus/pr-2174

2026-10-14T14:09:32+00:00

docs: igmp-proxy: document firewall requirements and operational commands (backport #2174, conflict resolved)

Merge pull request #2344 from vyos/mergify/bp/circinus/pr-2327

2026-10-13T16:26:15+00:00

docs: Update IPv6 page to VyOS 1.5 standards (backport #2327)

docs: Update IPv6 page to VyOS 1.5 standards (#2327)

2026-10-13T16:20:20+00:00

(cherry picked from commit 3eef24ea4e11aab0f1bbe47012161c18b3e46838)