Hailey @hailey@hails.org
Public

another good reason to Just Use Systemd instead of containers is all the hardening knobs that are readily available. You can block entire slices of the filesystem that your service shouldn't access. You can block all network access except what your program needs. You can block whole entire categories of syscalls and kernel features your program shouldn't use.

It is literally just a few lines of config to do all that and it might just save you from getting popped and running a cryptominer or worse next time a dependency you didn't know about of some random app you've deployed has some disastrous RCE

Hailey @hailey@hails.org
Public

If you want to know more, here's some good places to start in the systemd docs:

General hardening: freedesktop.org/software/syste

Network filtering: freedesktop.org/software/syste

+ honourable mention for SHH, a tool I haven't used but looks interesting, which can automatically generate hardening settings for you by observing what your service actually does at runtime: github.com/desbma/shh

systemd.exec

www.freedesktop.org

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://hails.org/users/hailey/statuses/115772427915685171 on your instance and quote it. (Note that quoting is not supported in Mastodon.)