From 10fa528e7779d3cb53b3e2b8a1dca41a5c7e8452 Mon Sep 17 00:00:00 2001
From: admin <admin@sechpoint.com>
Date: Mon, 3 Aug 2026 13:08:23 +0000
Subject: [PATCH] feat: unshare -m bind mount for per-instance /opt/wallarm
 isolation

---
 python/deploy.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/python/deploy.py b/python/deploy.py
index 6bff092..69f32b2 100644
--- a/python/deploy.py
+++ b/python/deploy.py
@@ -184,13 +184,14 @@ Description=Wallarm Node - %i
 After=network.target
 [Service]
 Type=simple
-WorkingDirectory={BASE}/%i/wallarm
-EnvironmentFile=-{BASE}/%i/wallarm/env.list
-ExecStartPre=/bin/ln -sf {BASE}/%i/wallarm /opt/wallarm
-ExecStartPre=-{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf
-ExecStartPre=/bin/sleep 1
-ExecStart={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf
-ExecStop={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf shutdown
+# unshare -m creates private mount namespace for /opt/wallarm isolation
+# while keeping /opt/fw and everything else accessible
+ExecStart=/bin/unshare -m /bin/sh -c '\
+  mount --bind {BASE}/%i/wallarm /opt/wallarm && \
+  {BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf && \
+  sleep 1 && \
+  exec {BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf'
+ExecStop=/opt/fw/%i/wallarm/usr/bin/python3.10 /opt/fw/%i/wallarm/usr/bin/supervisord -c /opt/fw/%i/wallarm/etc/supervisord.conf shutdown
 Restart=on-failure
 RestartSec=5
 User=root