From 06c1ecfe8537426a433eba970f3ec4ae10ed189c Mon Sep 17 00:00:00 2001
From: admin <admin@sechpoint.com>
Date: Mon, 3 Aug 2026 12:58:35 +0000
Subject: [PATCH] feat: systemd PrivateMounts bind-mount isolation, port
 offsets kept

---
 python/deploy.py | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/python/deploy.py b/python/deploy.py
index ae3725b..36b7d7e 100644
--- a/python/deploy.py
+++ b/python/deploy.py
@@ -161,31 +161,29 @@ http {{
         run(f"cp -a {DEPLOY_TO} {instance}", timeout=30)
         shutil.rmtree(DEPLOY_TO, ignore_errors=True)
 
-    # Patch paths + ports
+    # PrivateMounts handles filesystem isolation (/opt/wallarm == instance dir)
+    # Still need port offsets for internal services (wstore, api-firewall)
     offset = hash_port(instance)
-    for pattern in ("*.sh", "*.list", "*.conf", "*.yaml", "*.yml"):
+    for pattern in ("*.yaml", "*.yml", "*.conf"):
         for f in Path(instance).rglob(pattern):
             content = f.read_text()
-            content = content.replace("/opt/wallarm", instance)
             for port_num in (3313, 6388, 9001, 8088, 9667, 6060, 5005):
                 content = content.replace(f":{port_num}", f":{port_num + offset}")
             f.write_text(content)
 
-    # Add -cfg flag to wcli so it reads its own node.yaml
-    for conf in Path(f"{instance}/etc").glob("*.conf"):
-        c = conf.read_text()
-        if "wcli run" in c and "-cfg" not in c:
-            conf.write_text(c.replace("wcli run", f"wcli run -cfg {instance}/etc/wallarm/node.yaml"))
-
     # Systemd
+    # Systemd template with private /opt/wallarm per instance
     tmpl = f"""[Unit]
 Description=Wallarm Node - %i
 After=network.target
+
 [Service]
 Type=simple
 WorkingDirectory={BASE}/%i/wallarm
 EnvironmentFile=-{BASE}/%i/wallarm/env.list
-ExecStartPre=/bin/ln -sf {BASE}/%i/wallarm /opt/wallarm
+# Private mount namespace isolates /opt/wallarm per instance
+PrivateMounts=yes
+ExecStartPre=/bin/mount --bind {BASE}/%i/wallarm /opt/wallarm
 ExecStartPre=-{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf
 ExecStartPre=/bin/sleep 1
 ExecStart={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf
@@ -193,6 +191,7 @@ ExecStop={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervis
 Restart=on-failure
 RestartSec=5
 User=root
+
 [Install]
 WantedBy=multi-user.target
 """