Tomster/Fedora-CoreOS-Ignition
1
0
Fork 0
mirror of https://github.com/tommytran732/Fedora-CoreOS-Ignition synced 2024-10-29 16:01:34 -04:00
Code

Compare commits

base: Tomster:89d390ca5b34d1c018e82fc6e07b9d3821a1c0b1
Branches Tags
Tomster:main
..
compare: Tomster:7a207ba742ecadb8e9b4a5d683935843d3ac33ba
Branches Tags
Tomster:main

No commits in common. "89d390ca5b34d1c018e82fc6e07b9d3821a1c0b1" and "7a207ba742ecadb8e9b4a5d683935843d3ac33ba" have entirely different histories.
89d390ca5b ... 7a207ba742

2 changed files with 11 additions and 7 deletions
Show Stats Expand all files Collapse all files

2
x86-QEMU-Docker.ign
View File

@ -229,7 +229,7 @@
"name": "postinst2.service" "name": "postinst2.service"
}, },
{ {
"contents": "[Unit]\nDescription=Update gVisor\nRequires=network-online.target\nAfter=network-online.target\nBefore=docker.service\n\n[Service]\nType=oneshot\nRuntimeDirectory=gvisor-updater\nWorkingDirectory=/run/gvisor-updater\n\nExecStart=/usr/bin/sleep 5\nExecStart=curl -sS --remote-name-all 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512'\nExecStart=sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=+chown root:root runsc containerd-shim-runsc-v1\nExecStart=+chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=+mv -Z runsc containerd-shim-runsc-v1 /usr/local/bin/\n\nDynamicUser=true\nCapabilityBoundingSet=\nLockPersonality=true\nMemoryDenyWriteExecute=true\nNoNewPrivileges=true\nPrivateDevices=true\nPrivateIPC=true\nPrivateTmp=true\nProcSubset=pid\nProtectClock=true\nProtectControlGroups=true\nProtectHome=true\nProtectHostname=true\nProtectKernelLogs=true\nProtectKernelModules=true\nProtectKernelTunables=true\nProtectProc=invisible\nProtectSystem=strict\nRestrictAddressFamilies=\nRestrictNamespaces=true\nRestrictRealtime=true\nRestrictSUIDSGID=true\nRuntimeDirectoryMode=700\nSystemCallArchitectures=native\nSystemCallFilter=@system-service\nSystemCallFilter=~@obsolete\n\n[Install]\nWantedBy=multi-user.target\n", "contents": "[Unit]\nDescription=Update gVisor\nRequires=network-online.target\nAfter=network-online.target\nBefore=docker.service\n\n[Service]\nType=oneshot\nRuntimeDirectory=gvisor-updater\nWorkingDirectory=/run/gvisor-updater\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1\nExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512\nExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512\nExecStart=+/usr/bin/chown root:root runsc containerd-shim-runsc-v1\nExecStart=+/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1\nExecStart=+/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin\nExecStart=+/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc\n\nDynamicUser=true\nCapabilityBoundingSet=\nLockPersonality=true\nMemoryDenyWriteExecute=true\nNoNewPrivileges=true\nPrivateDevices=true\nPrivateIPC=true\nPrivateTmp=true\nProcSubset=pid\nProtectClock=true\nProtectControlGroups=true\nProtectHome=true\nProtectHostname=true\nProtectKernelLogs=true\nProtectKernelModules=true\nProtectKernelTunables=true\nProtectProc=invisible\nProtectSystem=strict\nRestrictAddressFamilies=\nRestrictNamespaces=true\nRestrictRealtime=true\nRestrictSUIDSGID=true\nRuntimeDirectoryMode=700\nSystemCallArchitectures=native\nSystemCallFilter=@system-service\nSystemCallFilter=~@obsolete\n\n[Install]\nWantedBy=multi-user.target\n",
"enabled": true, "enabled": true,
"name": "gvisor-updater.service" "name": "gvisor-updater.service"
}, },

16
x86-QEMU-Docker.yml
View File

@ -94,13 +94,17 @@ systemd:
Type=oneshot Type=oneshot
RuntimeDirectory=gvisor-updater RuntimeDirectory=gvisor-updater
WorkingDirectory=/run/gvisor-updater WorkingDirectory=/run/gvisor-updater
ExecStart=/usr/bin/sleep 5 ExecStart=/usr/bin/sleep 5
ExecStart=curl -sS --remote-name-all 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1' 'https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512' ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc
ExecStart=sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512 ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/runsc.sha512
ExecStart=+chown root:root runsc containerd-shim-runsc-v1 ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1
ExecStart=+chmod a+rx runsc containerd-shim-runsc-v1 ExecStart=/usr/bin/curl -sS -O https://storage.googleapis.com/gvisor/releases/release/latest/x86_64/containerd-shim-runsc-v1.sha512
ExecStart=+mv -Z runsc containerd-shim-runsc-v1 /usr/local/bin/ ExecStart=/usr/bin/sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
ExecStart=/usr/bin/rm -f runsc.sha512 containerd-shim-runsc-v1.sha512
ExecStart=+/usr/bin/chown root:root runsc containerd-shim-runsc-v1
ExecStart=+/usr/bin/chmod a+rx runsc containerd-shim-runsc-v1
ExecStart=+/usr/bin/mv runsc containerd-shim-runsc-v1 /var/usrlocal/bin
ExecStart=+/usr/bin/chcon system_u:object_r:container_runtime_exec_t:s0 /var/usrlocal/bin/runsc
DynamicUser=true DynamicUser=true
CapabilityBoundingSet= CapabilityBoundingSet=