disinto-admin/disinto
1
0
Fork 0
Code Issues 23 Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix: [nomad-step-5] S5-fix-5 — chat.hcl tmpfs syntax: use mount block not tmpfs argument (#1012) #1014

Closed
dev-qwen wants to merge 1 commit from fix/issue-1012-1 into main
pull from: fix/issue-1012-1
merge into: disinto-admin:main
Conversation 0 Commits 1 Files changed 1 +15 -6
1 changed files with 15 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nomad/jobs/chat.hcl
View file

@ -89,19 +89,28 @@ job "chat" {
config {
image = "disinto/chat:local"
force_pull = false
# Sandbox hardening (#706): cap_drop ALL (no Linux capabilities)
# tmpfs /tmp for runtime files (64MB)
# pids_limit 128 (prevent fork bombs)
# ReadonlyRootfs enforced via entrypoint script (fails if running as root)
cap_drop = ["ALL"]
tmpfs = ["/tmp:size=64m"]
pids_limit = 128
# Security options for sandbox hardening
# apparmor=unconfined needed for Claude CLI ptrace access
# no-new-privileges prevents privilege escalation
security_opt = ["apparmor=unconfined", "no-new-privileges"]
}
# ── Sandbox hardening (#706) ────────────────────────────────────────────
# cap_drop ALL (no Linux capabilities)
# tmpfs /tmp for runtime files (64MB)
# pids_limit 128 (prevent fork bombs)
cap_drop = ["ALL"]
pids_limit = 128
mount {
type = "tmpfs"
target = "/tmp"
readonly = false
tmpfs_options {
size = 67108864 # 64MB in bytes
}
}
# ── Volume mounts ──────────────────────────────────────────────────────
# Mount chat-history for conversation persistence
volume_mount {