40 lines
1.2 KiB
Text
40 lines
1.2 KiB
Text
[Unit]
|
|
Requires=le-app-codex-netns.service
|
|
After=le-app-codex-netns.service
|
|
|
|
[Service]
|
|
NetworkNamespacePath=/run/netns/le-app-codex
|
|
ProtectSystem=strict
|
|
PrivateTmp=yes
|
|
ProtectHome=yes
|
|
ProtectProc=invisible
|
|
ProcSubset=all
|
|
BindReadOnlyPaths=/etc/le-app-codex-runtime/resolv.conf:/etc/resolv.conf
|
|
TemporaryFileSystem=/srv:ro
|
|
BindPaths=/srv/le-app-codex:/srv/le-app-codex
|
|
TemporaryFileSystem=/var:ro
|
|
TemporaryFileSystem=/mnt:ro
|
|
TemporaryFileSystem=/media:ro
|
|
TemporaryFileSystem=/opt:ro
|
|
InaccessiblePaths=/var/www
|
|
InaccessiblePaths=/root
|
|
InaccessiblePaths=/home
|
|
InaccessiblePaths=/boot
|
|
InaccessiblePaths=/efi
|
|
InaccessiblePaths=/run/docker.sock
|
|
InaccessiblePaths=/var/run/docker.sock
|
|
InaccessiblePaths=/run/containerd/containerd.sock
|
|
InaccessiblePaths=/run/podman
|
|
InaccessiblePaths=/run/dbus/system_bus_socket
|
|
InaccessiblePaths=/run/systemd/private
|
|
InaccessiblePaths=/var/lib/docker
|
|
InaccessiblePaths=/var/lib/containerd
|
|
InaccessiblePaths=/var/lib/containers
|
|
InaccessiblePaths=/etc/docker
|
|
InaccessiblePaths=/etc/containers
|
|
InaccessiblePaths=/etc/ssh
|
|
InaccessiblePaths=/etc/NetworkManager/system-connections
|
|
InaccessiblePaths=/etc/wireguard
|
|
DevicePolicy=closed
|
|
DeviceAllow=/dev/fuse rw
|
|
DeviceAllow=/dev/net/tun rw
|