Skip to content

Commit

Permalink
Links added
Browse files Browse the repository at this point in the history
Signed-off-by: Ilia Markelov <imarkelo@redhat.com>
  • Loading branch information
ilimarx committed Jan 28, 2025
1 parent dd8cc15 commit 8626f55
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion qm.container
Original file line number Diff line number Diff line change
Expand Up @@ -40,13 +40,14 @@ TasksMax=50%
# Add these capabilities, in addition to the default Podman capability set, to the container.
# If set to all, grants all capabilities to the container, increasing flexibility but significantly
# reducing security.
# For details see: https://docs.podman.io/en/v4.4/markdown/podman-systemd.unit.5.html#addcapability
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#addcapability
AddCapability=all

# Unmask
# -------
# Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*):
# If set to ALL, Podman will unmask all the paths that are masked or made read-only by default.
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#unmask
Unmask=ALL
SecurityLabelNested=true
SeccompProfile=/usr/share/qm/seccomp.json
Expand All @@ -55,6 +56,7 @@ SeccompProfile=/usr/share/qm/seccomp.json
# ---------
# Disables the PID limit for the container by setting it to -1.
# Without a limit, the container can spawn unlimited processes, potentially exhausting system resources.
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#pidslimit
PidsLimit=-1

# Comment DropCapability this will allow FFI Tools to surpass their defaults.
Expand All @@ -75,6 +77,7 @@ ReadOnly=true
# ------
# Defines the root filesystem location for QM partition.
# By default the '${ROOTFS}' variable points to /usr/lib/qm/rootfs.
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#rootfs
Rootfs=${ROOTFS}

SecurityLabelNested=true
Expand Down

0 comments on commit 8626f55

Please sign in to comment.