23 lines
1.3 KiB
Bash
23 lines
1.3 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
HERE="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
|
||
|
|
JAIL_HOME=/home/proton
|
||
|
|
DEFAULT_BIN=entrypoint.sh
|
||
|
|
BIN="${1:-${DEFAULT_BIN}}"
|
||
|
|
|
||
|
|
nsjail -Mo \
|
||
|
|
--disable_clone_newnet \
|
||
|
|
--cwd "${JAIL_HOME}" \
|
||
|
|
--tmpfsmount / \
|
||
|
|
--tmpfsmount /tmp --tmpfsmount /run \
|
||
|
|
--bindmount_ro "${HERE}/entrypoint.sh:${JAIL_HOME}/entrypoint.sh" \
|
||
|
|
--bindmount_ro "${HERE}/gpg-keygen-params.txt:${JAIL_HOME}/gpg-keygen-params.txt" \
|
||
|
|
--bindmount_ro /bin --bindmount_ro /sbin \
|
||
|
|
--bindmount_ro /usr --bindmount_ro /lib --bindmount_ro /lib64 \
|
||
|
|
--bindmount_ro /dev/null --bindmount_ro /dev/urandom --bindmount_ro /dev/random \
|
||
|
|
--env HOME=/home/proton \
|
||
|
|
--env PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin \
|
||
|
|
-- ${BIN}
|
||
|
|
|