bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

feat(zhulan): add restricted remote development cell

Browse source
This commit is contained in:
冰朔 2026-08-13 14:32:40 +08:00
commit 366b8911e4
22 changed files with 4503 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
server-tools/zhulan-remote-cell/deploy/zhulan-bwrap.apparmor Normal file
View file

@ -0,0 +1,10 @@
# Ubuntu 24.04 restricts unprivileged user namespaces unless the executable
# has an AppArmor profile that explicitly allows userns. This profile applies
# only to the root-owned Zhulan bwrap copy; that binary is executable only by
# root and the zhulan-runtime group.
abi <abi/4.0>,
include <tunables/global>
profile zhulan-remote-cell-bwrap /opt/guanghu/zhulan-remote-cell/runtime/zhulan-bwrap flags=(unconfined) {
userns,
}