diff options
| author | Daniel Golle <daniel@makrotopia.org> | 2022-09-25 01:28:43 +0100 |
|---|---|---|
| committer | Daniel Golle <daniel@makrotopia.org> | 2022-09-25 01:38:09 +0100 |
| commit | 0f3d48a3784fb495ffdfe4a83f540ad42fab89df (patch) | |
| tree | 0c1c92fd8745aa615508bebc40385225b1e7ed39 /lang/python/python3 | |
| parent | cf120a7effd5d13a7f705b5eb9d22410b73d71f3 (diff) | |
snowflake: run snowflake-proxy with procd-ujail
snowflake-proxy doesn't write any files
=> run in read-only rootfs environment
the process needs to read SSL certs but no other files
=> only exposed path is /etc/ssl/certificates (read-only)
running as unpriviledged user with no additional capabilities
=> set no-new-privs bit
By default procd-ujail also isolates the process by executing it in
a separate new IPC and PID namespace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Diffstat (limited to 'lang/python/python3')
0 files changed, 0 insertions, 0 deletions