SysDeck https://dcos.net Manage system services and configuration Manage system services and configuration System policy prevents SysDeck from managing system services and configuration. System policy prevents SysDeck from managing system services and configuration. no auth_admin_keep auth_admin_keep /usr/bin/systemctl /usr/bin/hostnamectl /usr/bin/timedatectl /usr/bin/localectl /usr/bin/loginctl /usr/bin/machinectl Modify firewall rules (nftables + Cilium eBPF) Modify firewall rules (nftables + Cilium eBPF) System policy prevents SysDeck from modifying firewall rules. System policy prevents SysDeck from modifying firewall rules. no auth_admin_keep auth_admin_keep /usr/bin/nft /usr/sbin/nft /usr/sbin/iptables /usr/sbin/ip6tables /usr/bin/cilium /usr/sbin/cilium /usr/bin/cilium-agent /usr/sbin/cilium-agent /usr/bin/helm /usr/sbin/helm Install, remove, and upgrade system packages Install, remove, and upgrade system packages System policy prevents SysDeck from modifying installed packages. System policy prevents SysDeck from modifying installed packages. no auth_admin_keep auth_admin_keep /usr/bin/pacman /usr/bin/apt /usr/bin/dnf /usr/bin/yum Update firmware and manage TPM 2.0 state Update firmware and manage TPM 2.0 state System policy prevents SysDeck from modifying firmware or TPM state. System policy prevents SysDeck from modifying firmware or TPM state. no auth_admin_keep auth_admin_keep /usr/bin/fwupdmgr /usr/bin/tpm2 Manage LUKS encryption volumes Manage LUKS encryption volumes System policy prevents SysDeck from managing LUKS volumes. System policy prevents SysDeck from managing LUKS volumes. no auth_admin_keep auth_admin_keep /usr/sbin/cryptsetup Build system images and ISOs Build system images and ISOs System policy prevents SysDeck from building system images. System policy prevents SysDeck from building system images. no auth_admin_keep auth_admin_keep /usr/bin/mkosi /usr/bin/mkarchiso /usr/bin/vmdb2 /usr/bin/lb /usr/bin/pacman /usr/bin/apt-mark /usr/bin/dnf Manage SysDeck Fester build-farm orchestration Manage SysDeck Fester build-farm orchestration System policy prevents SysDeck Fester from managing build-farm services. System policy prevents SysDeck Fester from managing build-farm services. no auth_admin_keep auth_admin_keep /usr/bin/systemctl /usr/bin/journalctl Manage policy and permissions (ACLs, cgroups, VLANs, eBPF, file capabilities, LSM stack: AppArmor/Smack/TOMOYO/Yama/LoadPin/Lockdown/BPF-LSM/Landlock) Manage policy and permissions (ACLs, cgroups, VLANs, eBPF, file capabilities, LSM stack: AppArmor/Smack/TOMOYO/Yama/LoadPin/Lockdown/BPF-LSM/Landlock) System policy prevents SysDeck from modifying ACLs, cgroups, VLANs, eBPF programs, file capabilities, or LSM state. System policy prevents SysDeck from modifying ACLs, cgroups, VLANs, eBPF programs, file capabilities, or LSM state. no auth_admin_keep auth_admin_keep /usr/bin/setfacl /bin/setfacl /usr/bin/getfacl /bin/getfacl /bin/mkdir /usr/bin/mkdir /bin/mount /usr/bin/mount /usr/bin/ip /usr/sbin/ip /usr/sbin/vconfig /usr/bin/bpftool /usr/sbin/bpftool /usr/bin/lsns /usr/bin/aa-enforce /usr/sbin/aa-enforce /usr/bin/aa-complain /usr/sbin/aa-complain /usr/sbin/aa-status /usr/sbin/smackload /usr/sbin/smackcipsos /usr/sbin/smackcipso /usr/sbin/tomoyo-setprofile /usr/sbin/tomoyo-set-profile /usr/sbin/tomoyo-savepolicy /usr/sbin/tomoyo-init /usr/sbin/setcap /usr/bin/setcap /usr/sbin/getcap /usr/bin/getcap Start, stop, and restart database engines Start, stop, and restart database engines System policy prevents SysDeck from managing database engine services. System policy prevents SysDeck from managing database engine services. no auth_admin_keep auth_admin_keep /usr/bin/systemctl /usr/sbin/systemctl /bin/systemctl Start, stop, and restart the Jellyfin media server Start, stop, and restart the Jellyfin media server System policy prevents SysDeck from managing the Jellyfin media server. System policy prevents SysDeck from managing the Jellyfin media server. no auth_admin_keep auth_admin_keep /usr/bin/systemctl /usr/sbin/systemctl /bin/systemctl /usr/bin/jellyfin Start, stop, and restart photo management backends Start, stop, and restart photo management backends System policy prevents SysDeck from managing photo management backend services. System policy prevents SysDeck from managing photo management backend services. no auth_admin_keep auth_admin_keep /usr/bin/systemctl /usr/sbin/systemctl /bin/systemctl /usr/bin/photoprism Start, stop, and restart remote filesystem backends (Ceph, GlusterFS, MooseFS, BeeGFS, OrangeFS) Start, stop, and restart remote filesystem backends (Ceph, GlusterFS, MooseFS, BeeGFS, OrangeFS) System policy prevents SysDeck from managing remote filesystem backend services. System policy prevents SysDeck from managing remote filesystem backend services. no auth_admin_keep auth_admin_keep /usr/bin/systemctl /usr/sbin/systemctl /bin/systemctl /usr/bin/ceph /usr/sbin/ceph /usr/bin/gluster /usr/sbin/gluster /usr/bin/moosefs-cli /usr/sbin/moosefs-cli /usr/bin/beegfs-ctl /opt/beegfs/sbin/beegfs-ctl /usr/bin/pvfs2-server /usr/sbin/pvfs2-server Manage Kata Containers sandboxes and QCrows kernel bundles Manage Kata Containers sandboxes and QCrows kernel bundles System policy prevents SysDeck from managing Kata Containers. System policy prevents SysDeck from managing Kata Containers. no auth_admin_keep auth_admin_keep /usr/bin/kata-runtime /usr/sbin/kata-runtime /usr/bin/kata-monitor /usr/sbin/kata-monitor /usr/bin/ctr /usr/bin/crictl /usr/bin/qcrows-export /usr/bin/qcrows-initrd-regen /usr/bin/systemctl /usr/sbin/systemctl Manage Prometheus and Grafana monitoring services Manage Prometheus and Grafana monitoring services System policy prevents SysDeck from managing monitoring services. System policy prevents SysDeck from managing monitoring services. no auth_admin_keep auth_admin_keep /usr/bin/systemctl /usr/sbin/systemctl /bin/systemctl