ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-bootstrap.service

@@ -0,0 +1,37 @@
+[Unit]
+Description=Bootstrap OCI L4 relay
+Wants=network-online.target
+After=network-online.target nftables.service
+ConditionPathExists=/etc/oci-l4-relay/config.json
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/oci-l4-relay-guest bootstrap
+RemainAfterExit=true
+LogNamespace=oci-l4-relay
+CapabilityBoundingSet=CAP_NET_ADMIN
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectSystem=strict
+ReadWritePaths=/etc/oci-l4-relay /etc/sysconfig /etc/sysctl.d /var/lib/oci-l4-relay
+RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+Restart=on-failure
+RestartSec=15
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target