search

coredns / deployment

Scripts, utilities, and examples for deploying CoreDNS.
Apache License 2.0
549 stars 535 forks source link

systemd sandboxing #292

Closed nser77 closed 2 months ago

nser77 commented 1 year ago

Hi all, I hope this PR will be helpful and appreciated.

I needed to run coredns with systemd and I noticed that we can try to sandboxing it a bit more; I ran this step in my environment for a while with different plugins with no issues.

The new coredns systemd unit file is partially based on acassen/keepalived/blob/master/keepalived/keepalived-non-root.service.in with some additional restrictions and customizations.

Please, let me know if you want me to detail this patch a bit more.

nser77 commented 1 year ago

I'm so sorry, just one more thing:

If your version of systemd is v228 or older, edit this file to change
  "AmbientCapabilities=" to "Capabilities=". If that still doesn't work,
  use setcap(8) to set the capabilities listed below on the
  executable file.