customer-engineering/wallarm
3
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

feat: unshare -m bind mount for per-instance /opt/wallarm isolation

Browse source
This commit is contained in:
admin 2026-08-03 13:08:23 +00:00
parent b8b46daf00
commit 10fa528e77
1 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
python/deploy.py
View file

@ -184,13 +184,14 @@ Description=Wallarm Node - %i
After=network.target After=network.target
[Service] [Service]
Type=simple Type=simple
WorkingDirectory={BASE}/%i/wallarm # unshare -m creates private mount namespace for /opt/wallarm isolation
EnvironmentFile=-{BASE}/%i/wallarm/env.list # while keeping /opt/fw and everything else accessible
ExecStartPre=/bin/ln -sf {BASE}/%i/wallarm /opt/wallarm ExecStart=/bin/unshare -m /bin/sh -c '\
ExecStartPre=-{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf mount --bind {BASE}/%i/wallarm /opt/wallarm && \
ExecStartPre=/bin/sleep 1 {BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf && \
ExecStart={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf sleep 1 && \
ExecStop={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf shutdown exec {BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf'
ExecStop=/opt/fw/%i/wallarm/usr/bin/python3.10 /opt/fw/%i/wallarm/usr/bin/supervisord -c /opt/fw/%i/wallarm/etc/supervisord.conf shutdown
Restart=on-failure Restart=on-failure
RestartSec=5 RestartSec=5
User=root User=root