jailmaker/templates/lxd/config

60 lines
2.0 KiB
Plaintext
Raw Normal View History

2024-02-25 15:19:48 +00:00
# WARNING: EXPERIMENTAL CONFIG TEMPLATE!
startup=0
gpu_passthrough_intel=0
2024-02-25 15:19:48 +00:00
gpu_passthrough_nvidia=0
# Turning off seccomp filtering improves performance at the expense of security
# TODO: don't disable seccomp but specify which syscalls should be allowed
seccomp=0
2024-06-23 16:33:20 +00:00
# Use bridge networking to provide an isolated network namespace,
# so lxd can manage firewall rules
# Alternatively use --network-macvlan=eno1 instead of --network-bridge
# Ensure to change eno1/br1 to the interface name you want to use
# You may want to add additional options here, e.g. bind mounts
# TODO: don't use --capability=all but specify only the required capabilities
2024-02-15 16:23:57 +00:00
systemd_nspawn_user_args=--network-bridge=br1
--resolv-conf=bind-host
--capability=all
--bind=/dev/fuse
--bind=/dev/kvm
--bind=/dev/vsock
--bind=/dev/vhost-vsock
# Script to run on the HOST before starting the jail
# Load kernel module and config kernel settings required for lxd
pre_start_hook=#!/usr/bin/bash
2024-02-25 15:19:48 +00:00
set -euo pipefail
echo 'PRE_START_HOOK'
echo 1 > /proc/sys/net/ipv4/ip_forward
modprobe br_netfilter
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
echo 1 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
modprobe vhost_vsock
2024-02-25 15:19:48 +00:00
# Only used while creating the jail
distro=ubuntu
2024-06-21 11:58:14 +00:00
release=noble
2024-02-25 15:19:48 +00:00
initial_setup=#!/usr/bin/bash
2024-02-15 16:23:57 +00:00
set -euo pipefail
# https://discuss.linuxcontainers.org/t/snap-inside-privileged-lxd-container/13691/8
2024-02-15 16:23:57 +00:00
ln -sf /bin/true /usr/local/bin/udevadm
apt-get update
apt-get install -y --no-install-recommends snapd
snap install lxd
# You generally will not need to change the options below
systemd_run_default_args=--property=KillMode=mixed
2024-02-25 15:19:48 +00:00
--property=Type=notify
--property=RestartForceExitStatus=133
--property=SuccessExitStatus=133
--property=Delegate=yes
--property=TasksMax=infinity
--collect
--setenv=SYSTEMD_NSPAWN_LOCK=0
systemd_nspawn_default_args=--keep-unit
2024-02-25 15:19:48 +00:00
--quiet
--boot
--bind-ro=/sys/module
--inaccessible=/sys/module/apparmor