systemd question: I have a service that does a lot of cgroups things. I would like systemd to stay far away from its settings, so using iptables and other subprocess namespacing is the same as running the service as root under screen.
I found delegate=yes, which helps. But there’s still some iptables oddity under systemd. What else should I look at?
David Crawshaw
npub1zl…hlytv
2025-02-14 22:31:45 UTC
Author Public Key
npub1zlv43zfyah2arh89x0d67gh7xlep4lm9u6ggvw2sje6c95aravtq0hlytvSeen on
wss://relay.momostr.pinkPublished at
2025-02-14 22:31:45 UTCEvent JSON
{
"id": "844ec3b8644064b118d8a9aefef65bdbaa55b37485377c399898cf08ab5f4514",
"pubkey": "17d9588924edd5d1dce533dbaf22fe37f21aff65e690863950967582d3a3eb16",
"created_at": 1739572305,
"kind": 1,
"tags": [
[
"proxy",
"https://inuh.net/@crawshaw/114004610643580821",
"web"
],
[
"proxy",
"https://inuh.net/users/crawshaw/statuses/114004610643580821",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://inuh.net/users/crawshaw/statuses/114004610643580821",
"pink.momostr"
],
[
"-"
]
],
"content": "systemd question: I have a service that does a lot of cgroups things. I would like systemd to stay far away from its settings, so using iptables and other subprocess namespacing is the same as running the service as root under screen.\n\nI found delegate=yes, which helps. But there’s still some iptables oddity under systemd. What else should I look at?",
"sig": "6782a736d01c3e25b8fb24e1ff7accfa6bcc9bdc2a2e274ad02b7b58f92d537822c262b4c66f9b135e335cec0ac720b9e82cea25787ecad281aad8b94b02d7d5"
}