94ab6043e7
Add the files that land in the image, organised as layered rootfs trees (base first, then the edition layer wins on conflict). - base: hardened kernel cmdline + sysctl, default-deny nftables, key-only ssh, persistent journald, module blacklist, no core dumps, snapshot timer units, motd. - server: Prometheus + auto-provisioned Grafana + Loki + promtail. - workstation: dev profile and desktop sysctl relaxations (perf, rootless containers). - cloud: cloud-init provisioning config.
13 lines
471 B
Plaintext
13 lines
471 B
Plaintext
# Arcline Workstation — desktop relaxation overrides
|
|
# The base hardening is strict (perf_event_paranoid=3 blocks `perf` for
|
|
# unprivileged users). A workstation developer wants perf, tracing, and
|
|
# unprivileged user namespaces (used by podman/rootless containers). These
|
|
# lines land AFTER the base file, so they win.
|
|
|
|
kernel.perf_event_paranoid=1
|
|
kernel.unprivileged_bpf_disabled=0
|
|
kernel.yama.ptrace_scope=0
|
|
|
|
# rootless containers
|
|
kernel.unprivileged_userns_clone=1
|