Restrict permissions of container

2022-07-09 13:44:41 +02:00 · 2022-07-09 13:44:41 +02:00 · 05c1333ebb
commit 05c1333ebb
parent bcd7ec714b
1 changed files with 2 additions and 2 deletions
--- a/roles/matrix-bot-maubot/templates/systemd/matrix-bot-maubot.service.j2
+++ b/roles/matrix-bot-maubot/templates/systemd/matrix-bot-maubot.service.j2
@ -18,9 +18,9 @@ ExecStartPre=-{{ matrix_host_command_sh }} -c '{{ matrix_host_command_docker }}

 ExecStart={{ matrix_host_command_docker }} run --rm --name matrix-bot-maubot \
            --log-driver=none \
-            -e UID={{ matrix_user_uid }} \
-            -e GID={{ matrix_user_gid }} \
+			--user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
            --read-only \
+            --cap-drop=ALL \
            -v {{ matrix_bot_maubot_data_path }}:/data:z \
            {% for arg in matrix_bot_maubot_container_extra_arguments %}
            {{ arg }} \