| 1 | package host |
| 2 | |
| 3 | const claimBoundTemplate = `[Unit] |
| 4 | Description=carlos exec-backed instance %I |
| 5 | Requires=data-instances.mount run-carlos-instances.mount run-carlos-logs.mount |
| 6 | After=data-instances.mount run-carlos-instances.mount run-carlos-logs.mount |
| 7 | |
| 8 | [Service] |
| 9 | Type=simple |
| 10 | ExecStart=/opt/carlos/carlos instance-exec run %I |
| 11 | ExecStopPost=/opt/carlos/carlos instance-exit run %I |
| 12 | User=carlos |
| 13 | Group=carlos |
| 14 | Slice=carlos-instances-%i.slice |
| 15 | Restart=no |
| 16 | KillMode=mixed |
| 17 | TimeoutStopSec=20 |
| 18 | SuccessExitStatus=129 130 141 143 |
| 19 | StandardOutput=file:/run/carlos/logs/%I.run.sock |
| 20 | StandardError=inherit |
| 21 | BindPaths=/data/instances/%I /run/carlos/instances/%I |
| 22 | ReadWritePaths=/data/instances/%I /run/carlos/instances/%I |
| 23 | WorkingDirectory=/data/instances/%I |
| 24 | BindReadOnlyPaths=/run/carlos-control/exe/%I/app:/opt/carlos/app /run/carlos-control/exe/%I/live:/opt/carlos/live |
| 25 | |
| 26 | ProtectSystem=strict |
| 27 | TemporaryFileSystem=/data:ro |
| 28 | TemporaryFileSystem=/run/carlos:ro |
| 29 | TemporaryFileSystem=/var/cache:ro |
| 30 | TemporaryFileSystem=/var/lib:ro |
| 31 | TemporaryFileSystem=/opt/carlos:ro |
| 32 | BindReadOnlyPaths=/opt/carlos/carlos |
| 33 | InaccessiblePaths=/etc/carlos /run/carlos-control |
| 34 | ProtectHome=yes |
| 35 | PrivateTmp=yes |
| 36 | PrivateDevices=yes |
| 37 | TemporaryFileSystem=/dev/shm:mode=1777,nosuid,nodev |
| 38 | PrivateIPC=yes |
| 39 | TemporaryFileSystem=/dev/mqueue:ro |
| 40 | ProtectControlGroups=yes |
| 41 | ProtectProc=invisible |
| 42 | ProcSubset=pid |
| 43 | PrivatePIDs=yes |
| 44 | RestrictNamespaces=yes |
| 45 | NoNewPrivileges=yes |
| 46 | CapabilityBoundingSet= |
| 47 | RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX |
| 48 | IPAddressDeny=localhost multicast 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 169.254.0.0/16 169.254.169.254/32 172.16.0.0/12 192.0.0.0/24 192.168.0.0/16 198.18.0.0/15 240.0.0.0/4 64:ff9b::/96 fc00::/7 fd00:ec2::254/128 fe80::/10 fec0::/10 |
| 49 | BindReadOnlyPaths=-/run/systemd/resolve/resolv.conf:/etc/resolv.conf |
| 50 | ProtectKernelTunables=yes |
| 51 | ProtectKernelModules=yes |
| 52 | ProtectKernelLogs=yes |
| 53 | ProtectClock=yes |
| 54 | ProtectHostname=yes |
| 55 | RemoveIPC=yes |
| 56 | LockPersonality=yes |
| 57 | RestrictRealtime=yes |
| 58 | MemoryDenyWriteExecute=yes |
| 59 | SystemCallArchitectures=native |
| 60 | |
| 61 | TasksMax=256 |
| 62 | OOMScoreAdjust=500 |
| 63 | OOMPolicy=kill |
| 64 | ` |
| 65 | |
amadan