disinto-admin/disinto
1
0
Fork 0
Code Issues 23 Pull requests 2 Projects Releases Packages Wiki Activity Actions

fix: [nomad-step-5] S5-fix-5 — chat.hcl tmpfs syntax: use mount block not tmpfs argument (#1012)
Some checks failed
ci/woodpecker/pr/nomad-validate Pipeline is pending
Details
ci/woodpecker/pr/secret-scan Pipeline is pending
Details
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/nomad-validate Pipeline failed
Details
ci/woodpecker/pr/ci Pipeline failed
Details

Browse source
This commit is contained in:
Agent 2026-04-18 12:29:41 +00:00
parent f98338cec7
commit 19ec91ae5a
1 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nomad/jobs/chat.hcl
View file

@ -89,17 +89,19 @@ job "chat" {
config { config {
image = "disinto/chat:local" image = "disinto/chat:local"
force_pull = false force_pull = false
# Sandbox hardening (#706): cap_drop ALL (no Linux capabilities) # Sandbox hardening (#706):
# tmpfs /tmp for runtime files (64MB) # - cap_drop ALL (no Linux capabilities)
# pids_limit 128 (prevent fork bombs) # - tmpfs /tmp for runtime files (64MB)
# - pids_limit 128 (prevent fork bombs)
# ReadonlyRootfs enforced via entrypoint script (fails if running as root) # ReadonlyRootfs enforced via entrypoint script (fails if running as root)
cap_drop = ["ALL"] # Security options:
tmpfs = ["/tmp:size=64m"] # - apparmor=unconfined for Claude CLI ptrace access
pids_limit = 128 # - no-new-privileges prevents privilege escalation
# Security options for sandbox hardening cap_drop = ["ALL"]
# apparmor=unconfined needed for Claude CLI ptrace access pids_limit = 128
# no-new-privileges prevents privilege escalation
security_opt = ["apparmor=unconfined", "no-new-privileges"] security_opt = ["apparmor=unconfined", "no-new-privileges"]
# tmpfs mounts via volumes config (Nomad Docker driver)
volumes = ["tmpfs:/tmp:size=64m"]
} }
# ── Volume mounts ────────────────────────────────────────────────────── # ── Volume mounts ──────────────────────────────────────────────────────