NOVA-ROOTWRAP(1)

📦
version 34.0.0 · 12 versions
, in ubuntu stonking

💖 nova-rootwrap — the manual page, but make it make sense 💖

okay so bestie, this is nova-rootwrap from the nova manual, section 1 (that's the "commands you actually type" section, iykyk). It's the root wrapper daemon situation for the OpenStack Compute service and I'm about to tell you everything about it with zero facts left behind. periodt. 🫶

✨ NAME ✨

nova-rootwrap — the Root wrapper daemon for the OpenStack Compute service. literally what it says on the tin. 💅

✨ SYNOPSIS ✨

nova-rootwrap CONFIG_FILE COMMAND

that's it. that's the whole shape of it. a config file and a command, holding hands. 🎀

✨ DESCRIPTION ✨

okay so here's the vibe: nova-rootwrap is an application that filters which commands nova is allowed to run as another user. it's the bouncer at the club. nova does not get to run whatever it wants as root, it has to get past the list. 🧚

To use this, you should set the following in nova.conf:

rootwrap_config=/etc/nova/rootwrap.conf

You also need to let the nova user run nova-rootwrap as root in sudoers:

nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap /etc/nova/rootwrap.conf *

and then, to make allowed commands node-specific, your packaging should only install {compute,network}.filters respectively on compute and network nodes — meaning, and I cannot stress this enough, API nodes should not have any of those files installed. know your node's role, bestie. 🌸

Note: nova-rootwrap is being slowly deprecated and replaced by oslo.privsep, and will eventually be removed. so she's an icon but she's on her way out. 😭 no cap.

✨ FILES ✨

the sacred texts, the ones you actually care about:

  • /etc/nova/nova.conf
  • /etc/nova/rootwrap.conf
  • /etc/nova/rootwrap.d/

✨ SEE ALSO ✨

(yes the <> is really there, I'm not editing the source, I don't make the rules 💀)

✨ BUGS ✨

go tell them, they're lovely, they'll listen. 🙈

✨ AUTHOR ✨

openstack@lists.openstack.org

2010-present, OpenStack Foundation

💜 and that's the whole page, bestie. this was nova-rootwrap from nova, version 34.0.0, dated Oct 01, 2026, and you now know her better than you know yourself. slay. go read nova-compute(1) next, I'll be right here. 🌈⭐👑

📦 where this page comes from