customer-engineering/wallarm
3
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

feat: unshare -m bind mount for per-instance /opt/wallarm isolation

Browse source
This commit is contained in:
admin 2026-08-03 13:08:23 +00:00
parent b8b46daf00
commit 10fa528e77
1 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
python/deploy.py
View file

@ -184,13 +184,14 @@ Description=Wallarm Node - %i
After=network.target
[Service]
Type=simple
WorkingDirectory={BASE}/%i/wallarm
EnvironmentFile=-{BASE}/%i/wallarm/env.list
ExecStartPre=/bin/ln -sf {BASE}/%i/wallarm /opt/wallarm
ExecStartPre=-{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf
ExecStartPre=/bin/sleep 1
ExecStart={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf
ExecStop={BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf shutdown
# unshare -m creates private mount namespace for /opt/wallarm isolation
# while keeping /opt/fw and everything else accessible
ExecStart=/bin/unshare -m /bin/sh -c '\
mount --bind {BASE}/%i/wallarm /opt/wallarm && \
{BASE}/%i/wallarm/nginx/sbin/nginx -c {BASE}/%i/wallarm/nginx/conf/nginx.conf && \
sleep 1 && \
exec {BASE}/%i/wallarm/usr/bin/python3.10 {BASE}/%i/wallarm/usr/bin/supervisord -c {BASE}/%i/wallarm/etc/supervisord.conf'
ExecStop=/opt/fw/%i/wallarm/usr/bin/python3.10 /opt/fw/%i/wallarm/usr/bin/supervisord -c /opt/fw/%i/wallarm/etc/supervisord.conf shutdown
Restart=on-failure
RestartSec=5
User=root