diff --git a/nixos/doc/manual/administration/container-networking.section.md b/nixos/doc/manual/administration/container-networking.section.md
new file mode 100644
index 000000000000..0873768376cc
--- /dev/null
+++ b/nixos/doc/manual/administration/container-networking.section.md
@@ -0,0 +1,44 @@
+# Container Networking {#sec-container-networking}
+
+When you create a container using `nixos-container create`, it gets it
+own private IPv4 address in the range `10.233.0.0/16`. You can get the
+container's IPv4 address as follows:
+
+```ShellSession
+# nixos-container show-ip foo
+10.233.4.2
+
+$ ping -c1 10.233.4.2
+64 bytes from 10.233.4.2: icmp_seq=1 ttl=64 time=0.106 ms
+```
+
+Networking is implemented using a pair of virtual Ethernet devices. The
+network interface in the container is called `eth0`, while the matching
+interface in the host is called `ve-container-name` (e.g., `ve-foo`).
+The container has its own network namespace and the `CAP_NET_ADMIN`
+capability, so it can perform arbitrary network configuration such as
+setting up firewall rules, without affecting or having access to the
+host's network.
+
+By default, containers cannot talk to the outside network. If you want
+that, you should set up Network Address Translation (NAT) rules on the
+host to rewrite container traffic to use your external IP address. This
+can be accomplished using the following configuration on the host:
+
+```nix
+networking.nat.enable = true;
+networking.nat.internalInterfaces = ["ve-+"];
+networking.nat.externalInterface = "eth0";
+```
+
+where `eth0` should be replaced with the desired external interface.
+Note that `ve-+` is a wildcard that matches all container interfaces.
+
+If you are using Network Manager, you need to explicitly prevent it from
+managing container interfaces:
+
+```nix
+networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
+```
+
+You may need to restart your system for the changes to take effect.
diff --git a/nixos/doc/manual/administration/container-networking.xml b/nixos/doc/manual/administration/container-networking.xml
deleted file mode 100644
index 42486f01fe8c..000000000000
--- a/nixos/doc/manual/administration/container-networking.xml
+++ /dev/null
@@ -1,59 +0,0 @@
-
- Container Networking
-
-
- When you create a container using nixos-container create,
- it gets it own private IPv4 address in the range
- 10.233.0.0/16. You can get the container’s IPv4 address
- as follows:
-
-# nixos-container show-ip foo
-10.233.4.2
-
-$ ping -c1 10.233.4.2
-64 bytes from 10.233.4.2: icmp_seq=1 ttl=64 time=0.106 ms
-
-
-
-
- Networking is implemented using a pair of virtual Ethernet devices. The
- network interface in the container is called eth0, while
- the matching interface in the host is called
- ve-container-name (e.g.,
- ve-foo). The container has its own network namespace and
- the CAP_NET_ADMIN capability, so it can perform arbitrary
- network configuration such as setting up firewall rules, without affecting or
- having access to the host’s network.
-
-
-
- By default, containers cannot talk to the outside network. If you want that,
- you should set up Network Address Translation (NAT) rules on the host to
- rewrite container traffic to use your external IP address. This can be
- accomplished using the following configuration on the host:
-
- = true;
- = ["ve-+"];
- = "eth0";
-
- where eth0 should be replaced with the desired external
- interface. Note that ve-+ is a wildcard that matches all
- container interfaces.
-
-
-
- If you are using Network Manager, you need to explicitly prevent it from
- managing container interfaces:
-
-networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
-
-
-
-
- You may need to restart your system for the changes to take effect.
-
-
diff --git a/nixos/doc/manual/administration/containers.xml b/nixos/doc/manual/administration/containers.xml
index f149ce7bbfe6..8e0e300f367b 100644
--- a/nixos/doc/manual/administration/containers.xml
+++ b/nixos/doc/manual/administration/containers.xml
@@ -30,5 +30,5 @@
-
+
diff --git a/nixos/doc/manual/from_md/administration/container-networking.section.xml b/nixos/doc/manual/from_md/administration/container-networking.section.xml
new file mode 100644
index 000000000000..788a2b7b0acb
--- /dev/null
+++ b/nixos/doc/manual/from_md/administration/container-networking.section.xml
@@ -0,0 +1,54 @@
+
+ Container Networking
+
+ When you create a container using
+ nixos-container create, it gets it own private
+ IPv4 address in the range 10.233.0.0/16. You can
+ get the container’s IPv4 address as follows:
+
+
+# nixos-container show-ip foo
+10.233.4.2
+
+$ ping -c1 10.233.4.2
+64 bytes from 10.233.4.2: icmp_seq=1 ttl=64 time=0.106 ms
+
+
+ Networking is implemented using a pair of virtual Ethernet devices.
+ The network interface in the container is called
+ eth0, while the matching interface in the host is
+ called ve-container-name (e.g.,
+ ve-foo). The container has its own network
+ namespace and the CAP_NET_ADMIN capability, so it
+ can perform arbitrary network configuration such as setting up
+ firewall rules, without affecting or having access to the host’s
+ network.
+
+
+ By default, containers cannot talk to the outside network. If you
+ want that, you should set up Network Address Translation (NAT) rules
+ on the host to rewrite container traffic to use your external IP
+ address. This can be accomplished using the following configuration
+ on the host:
+
+
+networking.nat.enable = true;
+networking.nat.internalInterfaces = ["ve-+"];
+networking.nat.externalInterface = "eth0";
+
+
+ where eth0 should be replaced with the desired
+ external interface. Note that ve-+ is a wildcard
+ that matches all container interfaces.
+
+
+ If you are using Network Manager, you need to explicitly prevent it
+ from managing container interfaces:
+
+
+networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
+
+
+ You may need to restart your system for the changes to take effect.
+
+