Daniel Golle 0f3d48a378 snowflake: run snowflake-proxy with procd-ujail ...

snowflake-proxy doesn't write any files
 => run in read-only rootfs environment

the process needs to read SSL certs but no other files
 => only exposed path is /etc/ssl/certificates (read-only)

running as unpriviledged user with no additional capabilities
 => set no-new-privs bit

By default procd-ujail also isolates the process by executing it in
a separate new IPC and PID namespace.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

2022-09-25 01:38:09 +01:00

..

snowflake-proxy.init

snowflake: run snowflake-proxy with procd-ujail

2022-09-25 01:38:09 +01:00