ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-guest/image/systemd/oci-l4-relay-journal-upload.service

@@ -0,0 +1,46 @@
+[Unit]
+Description=Upload OCI L4 relay journal namespace to vlagent
+Requires=oci-l4-relay-vlagent.service
+After=oci-l4-relay-vlagent.service [email protected]
+ConditionPathExists=/etc/oci-l4-relay/log-ingest.token
+PartOf=oci-l4-relay-logs.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+User=systemd-journal-upload
+SupplementaryGroups=systemd-journal
+StateDirectory=systemd/journal-upload
+ExecStart=/usr/lib/systemd/systemd-journal-upload --namespace=oci-l4-relay --url=http://127.0.0.1:19532/insert/journald --save-state --system --follow
+Restart=on-failure
+RestartSec=10s
+RestartSteps=10
+RestartMaxDelaySec=60
+Slice=oci-l4-relay-logs.slice
+WatchdogSec=3min
+CapabilityBoundingSet=
+IPAddressDeny=any
+IPAddressAllow=localhost
+LockPersonality=true
+MemoryDenyWriteExecute=true
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+ProtectSystem=strict
+ReadWritePaths=/var/lib/systemd/journal-upload
+RestrictAddressFamilies=AF_UNIX AF_INET
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+UMask=0077
+LimitNOFILE=524288