# LXC Container Configuration for a Sorcery-Go Sanctum
# File: /var/lib/lxc/<sanctum-name>/config
#
# A Sanctum must be "privileged" enough to handle mount syscalls for
# OverlayFS (used by the Cauldron sandbox), but restricted enough to
# protect the host from a misbehaving spell script.
#
# Security is enforced by eBPF (not AppArmor). The Tomb Guard LSM hook
# intercepts writes to /var/lib/sorcery-go/tomb/** at the kernel level.

# Core Isolation
lxc.include = /usr/share/lxc/config/common.conf
lxc.arch = x86_64

# eBPF handles MAC enforcement — set AppArmor to unconfined.
# The eBPF Tomb Guard LSM hook provides equivalent protection with
# better performance and runtime-agnostic enforcement.
lxc.apparmor.profile = unconfined
lxc.cap.drop =
lxc.mount.auto = proc:rw sys:rw cgroup:rw
lxc.autodev = 1

# Grant access to Fuse/Loop if you use them for disk-image spells
lxc.cgroup2.devices.allow = c 10:229 rwm

# Bind-mount the project source into the Sanctum (dev workflow)
# lxc.mount.entry = /home/you/sorcery-go var/lib/sorcery/go_src none bind,create=dir 0 0

# Read-only bind of the Tomb (enforced by eBPF at kernel level)
lxc.mount.entry = /var/lib/sorcery-go/tomb var/lib/sorcery-go/tomb none bind,ro,create=dir 0 0

# Network — restrict to the Coven's Ley-Line bridge
lxc.net.0.type = veth
lxc.net.0.link = br0
lxc.net.0.flags = up