20 lines
902 B
Bash
20 lines
902 B
Bash
#!/bin/sh
|
|
set -eu
|
|
test "$(id -u)" -eq 0
|
|
test "$(systemctl is-active user@1200.service || true)" = inactive
|
|
systemd-run --wait --pipe --collect --unit=le-app-codex-inert-test \
|
|
--uid=1200 --gid=1200 \
|
|
--setenv=DOCKER_HOST=unix:///run/user/1200/docker.sock \
|
|
--property=NetworkNamespacePath=/run/netns/le-app-codex \
|
|
--property=ProtectSystem=strict --property=PrivateTmp=yes \
|
|
--property=ProtectHome=yes --property=ProtectProc=invisible \
|
|
--property=TemporaryFileSystem=/srv:ro \
|
|
--property=BindPaths=/srv/le-app-codex:/srv/le-app-codex \
|
|
--property=TemporaryFileSystem=/var:ro \
|
|
--property=TemporaryFileSystem=/mnt:ro \
|
|
--property=TemporaryFileSystem=/media:ro \
|
|
--property=TemporaryFileSystem=/opt:ro \
|
|
--property=DevicePolicy=closed --property='DeviceAllow=/dev/fuse rw' \
|
|
--property='DeviceAllow=/dev/net/tun rw' \
|
|
/srv/le-app-codex/phase2b-tests/10-inert-containment.sh
|
|
|