konsthol/SecDep
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Who knows...

Browse Source
This commit is contained in:
konsthol
2023-09-05 16:34:47 +03:00
parent ad93c64862
commit ab40949ce1
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
harden
View File

@@ -7,7 +7,7 @@
# Using set to make the script safer # Using set to make the script safer
set -e # Exit on error set -e # Exit on error
set -u # Exit on undefined variable set -u # Exit on undefined variable
set -x # Print commands for debugging # set -x # Print commands for debugging
set -a # Export all variables set -a # Export all variables
set -C # Disable overwriting of files set -C # Disable overwriting of files
set -o pipefail # Exit on pipe error set -o pipefail # Exit on pipe error
@@ -325,9 +325,9 @@ EOF
# The runsc option --network=host and --ignore-cgroups=true will help with running runsc # The runsc option --network=host and --ignore-cgroups=true will help with running runsc
# with rootless docker without much hassle # with rootless docker without much hassle
sudo runuser - secdep -c 'mkdir -p /home/secdep/.config/docker' sudo runuser - secdep -c 'mkdir -p /home/secdep/.config/docker'
# "icc": false to disable inter-container communication, does not work without br_netfilter module loaded # "icc": false to disable inter-container communication, does not work without br_netfilter module loaded
# and it is sometimes prohibited by the hosting provider # and it is sometimes prohibited by the hosting provider
# so we'll leave it out # so we'll leave it out of the daemon config
DOCKERD_CONFIG=$(cat <<'EOF' DOCKERD_CONFIG=$(cat <<'EOF'
{ {
"no-new-privileges": true, "no-new-privileges": true,