Add some sandboxing

This commit is contained in:
iacore 2023-10-01 08:34:34 +00:00
parent 4ff54e8fdf
commit 01d5c9aec1
Signed by: iacore
GPG key ID: F8C16E5157A63006

View file

@ -5,7 +5,7 @@
type = process
# change the following line based on where the executable is
command = /usr/bin/env PORT=/srv/http/pages/status /opt/status/status
command = /usr/bin/bwrap --bind / / --tmpfs /home --unshare-all --share-net /opt/status/status
working-dir = /opt/status
logfile = $HOME/.log/exozyme-status.log
load-options = sub-vars