one thing i really like about systemd is the unit sandboxing capabilities and how convenient it is
https://wiki.archlinux.org/title/Systemd/Sandboxing
heres an example from my tuwunel matrix systemd unit
[Unit]
Description=Tuwunel Matrix homeserver
#Requires=tuwunel.socket
Wants=network-online.target
After=network-online.target
Documentation=https://tuwunel.chat/
[Service]
User=tuwunel
Group=tuwunel
Type=notify
ReloadSignal=SIGUSR1
WatchdogSec=30
TTYPath=/dev/tty25
DeviceAllow=char-tty
StandardInput=tty-force
StandardOutput=tty
StandardError=journal+console
TTYReset=yes
# uncomment to allow buffer to be cleared every restart
TTYVTDisallocate=no
TTYColumns=120
TTYRows=40
Environment="TUWUNEL_CONFIG=/etc/tuwunel/tuwunel.toml"
ExecStart=/usr/sbin/tuwunel
ReadWritePaths=/var/lib/tuwunel /etc/tuwunel
AmbientCapabilities=
CapabilityBoundingSet=
ManagedOOMPreference=avoid
MemoryHigh=3G
MemoryMax=4G
DevicePolicy=closed
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
#ProcSubset=pid
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
PrivateDevices=yes
PrivateMounts=yes
PrivateTmp=yes
PrivateUsers=yes
PrivateIPC=yes
RemoveIPC=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service @resources
SystemCallFilter=~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc
SystemCallErrorNumber=EPERM
#StateDirectory=tuwunel
RuntimeDirectory=tuwunel
RuntimeDirectoryMode=0750
Restart=on-failure
RestartSec=5
TimeoutStopSec=2m
TimeoutStartSec=2m
StartLimitInterval=1m
StartLimitBurst=5
[Install]
WantedBy=multi-user.target
Alias=matrix-tuwunel.service
how can i replicate that kind of stuff with openrc?
guys i think we should all stop doing drugs ive looked into it more and i think theyre like illegal ????? which literally means theyre bad :/
also im pretty sure some of yall arent even rlly supposed to be transgender… can you stop please…
@fiore “what even is this thread”
click gort
“systemd…”
@ozzelot im pretty sure , yes .. yknow , you can watch them anyways if u give money to amazon!
@june no i meant like i was commenting on your systemd unit its so long
@georgia@netzsphaere.xyz @chjara@akko.tuxcrafting.xyz @stilic@social.oss.zone @FiringSquadsEnjoyer@social.xenofem.me @wyatt@soc.megatokyo.moe @june@ublog.kimapr.net Health is the antithesis of fun so I take from this little sisters are the best for sex.
@OneRatOneVerySmallTrenchCoat @wyatt @FiringSquadsEnjoyer @june I can’t believe I’m being admonished for my Anti-White racism what has this place come to 😔🥀🥀🥀
I think both of them are being silly, therefore the nonserious reply, since I do not do debates anymore
and I’ll have you know I actually have many french friends (I hope for them to get better eventually (the joke is that that’s not how it works))
also the context for the french comment is that I made a post earlier asking “where does this guy get his confidence to be anti-incest from when he’s french” alluding to the french stereotypes etc
@OneRatOneVerySmallTrenchCoat @wyatt @FiringSquadsEnjoyer @june @Primavera struggle session because some of us like the french a little too much ;p
@june stepping on femboys is very fun and rewarding tho… makes them squirm~
Ibly 🏳️⚧️