mirror of
https://github.com/tommytran732/Fedora-CoreOS-Ignition
synced 2024-10-29 16:01:34 -04:00
Compare commits
No commits in common. "89d390ca5b34d1c018e82fc6e07b9d3821a1c0b1" and "7a207ba742ecadb8e9b4a5d683935843d3ac33ba" have entirely different histories.
89d390ca5b
...
7a207ba742
@ -229,7 +229,7 @@
|
|||||||
"name": "postinst2.service"
|
"name": "postinst2.service"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"contents": "[Unit]\nDescription=Update gVisor\nRequires=network-online.target\nAfter=network-online.target\nBefore=docker.service\n\n[Service]\nType=oneshot\nRuntimeDirectory=gvisor-updater\nWorkingDirectory=/run/gvisor-updater\n\nExecStart=/usr/bin/sleep 5\nExecStart=curl -sS --remote-name-all 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512'\nExecStart=sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=+chown root:root runsc containerd-shim-runsc-v1\nExecStart=+chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=+mv -Z runsc containerd-shim-runsc-v1 /usr/local/bin/\n\nDynamicUser=true\nCapabilityBoundingSet=\nLockPersonality=true\nMemoryDenyWriteExecute=true\nNoNewPrivileges=true\nPrivateDevices=true\nPrivateIPC=true\nPrivateTmp=true\nProcSubset=pid\nProtectClock=true\nProtectControlGroups=true\nProtectHome=true\nProtectHostname=true\nProtectKernelLogs=true\nProtectKernelModules=true\nProtectKernelTunables=true\nProtectProc=invisible\nProtectSystem=strict\nRestrictAddressFamilies=\nRestrictNamespaces=true\nRestrictRealtime=true\nRestrictSUIDSGID=true\nRuntimeDirectoryMode=700\nSystemCallArchitectures=native\nSystemCallFilter=@system-service\nSystemCallFilter=~@obsolete\n\n[Install]\nWantedBy=multi-user.target\n",
|
"contents": "[Unit]\nDescription=Update gVisor\nRequires=network-online.target\nAfter=network-online.target\nBefore=docker.service\n\n[Service]\nType=oneshot\nRuntimeDirectory=gvisor-updater\nWorkingDirectory=/run/gvisor-updater\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=+/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=+/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=+/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=+/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\nDynamicUser=true\nCapabilityBoundingSet=\nLockPersonality=true\nMemoryDenyWriteExecute=true\nNoNewPrivileges=true\nPrivateDevices=true\nPrivateIPC=true\nPrivateTmp=true\nProcSubset=pid\nProtectClock=true\nProtectControlGroups=true\nProtectHome=true\nProtectHostname=true\nProtectKernelLogs=true\nProtectKernelModules=true\nProtectKernelTunables=true\nProtectProc=invisible\nProtectSystem=strict\nRestrictAddressFamilies=\nRestrictNamespaces=true\nRestrictRealtime=true\nRestrictSUIDSGID=true\nRuntimeDirectoryMode=700\nSystemCallArchitectures=native\nSystemCallFilter=@system-service\nSystemCallFilter=~@obsolete\n\n[Install]\nWantedBy=multi-user.target\n",
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
"name": "gvisor-updater.service"
|
"name": "gvisor-updater.service"
|
||||||
},
|
},
|
||||||
|
@ -94,13 +94,17 @@ systemd:
|
|||||||
Type=oneshot
|
Type=oneshot
|
||||||
RuntimeDirectory=gvisor-updater
|
RuntimeDirectory=gvisor-updater
|
||||||
WorkingDirectory=/run/gvisor-updater
|
WorkingDirectory=/run/gvisor-updater
|
||||||
|
|
||||||
ExecStart=/usr/bin/sleep 5
|
ExecStart=/usr/bin/sleep 5
|
||||||
ExecStart=curl -sS --remote-name-all 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512'
|
ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc
|
||||||
ExecStart=sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
|
ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
|
||||||
ExecStart=+chown root:root runsc containerd-shim-runsc-v1
|
ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
|
||||||
ExecStart=+chmod a+rx runsc containerd-shim-runsc-v1
|
ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512
|
||||||
ExecStart=+mv -Z runsc containerd-shim-runsc-v1 /usr/local/bin/
|
ExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
|
||||||
|
ExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512
|
||||||
|
ExecStart=+/usr/bin/chown root:root runsc containerd-shim-runsc-v1
|
||||||
|
ExecStart=+/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1
|
||||||
|
ExecStart=+/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin
|
||||||
|
ExecStart=+/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc
|
||||||
|
|
||||||
DynamicUser=true
|
DynamicUser=true
|
||||||
CapabilityBoundingSet=
|
CapabilityBoundingSet=
|
||||||
|
Loading…
Reference in New Issue
Block a user