20 lines
1.1 KiB
Plaintext
Executable File
20 lines
1.1 KiB
Plaintext
Executable File
# Podman Container Configuration for a Sorcery-Go Sanctum
|
|
# File: Referenced by pkg/runtime/podman.go
|
|
#
|
|
# This file documents the Podman-specific options used when creating
|
|
# a Sorcery-Go sanctum. The actual container creation is done via the
|
|
# pkg/runtime/podman.go adapter, but this file serves as documentation
|
|
# and can be used with `podman play kube` for declarative workflows.
|
|
#
|
|
# Security is enforced by eBPF (not AppArmor/SELinux).
|
|
# The Tomb Guard LSM hook intercepts writes at kernel level.
|
|
|
|
# --security-opt apparmor=unconfined # eBPF handles MAC
|
|
# --security-opt seccomp=unconfined # eBPF LSM replaces seccomp for Tomb
|
|
# --cap-drop ALL # Drop all capabilities
|
|
# --cap-add CAP_SYS_ADMIN # Required for OverlayFS in build sandbox
|
|
# --cap-add CAP_SYS_CHROOT # Required for chroot in baremetal exec
|
|
# --memory 512m # Default memory limit
|
|
# --network bridge:br0 # Coven Ley-Line bridge
|
|
# --mount type=bind,src=/var/lib/sorcery-go/tomb,dst=/var/lib/sorcery-go/tomb,ro
|
|
# --security-opt label=disable # Disable SELinux labeling (eBPF handles it) |