94ab6043e7
Add the files that land in the image, organised as layered rootfs trees (base first, then the edition layer wins on conflict). - base: hardened kernel cmdline + sysctl, default-deny nftables, key-only ssh, persistent journald, module blacklist, no core dumps, snapshot timer units, motd. - server: Prometheus + auto-provisioned Grafana + Loki + promtail. - workstation: dev profile and desktop sysctl relaxations (perf, rootless containers). - cloud: cloud-init provisioning config.
10 lines
225 B
Plaintext
10 lines
225 B
Plaintext
# Arcline OS — systemd manager hardening
|
|
# Global defaults applied to every unit. No core dumps on disk, sane limits.
|
|
|
|
[Manager]
|
|
DefaultLimitNOFILE=65535
|
|
DefaultLimitNPROC=4096
|
|
DefaultLimitCORE=0
|
|
DumpCore=no
|
|
CoreDumpSize=0
|