149 lines
3.2 KiB
YAML
149 lines
3.2 KiB
YAML
# native Landlock sandbox configuration
|
|
filesystem:
|
|
ro:
|
|
- "{XDG_CONFIG_HOME}/git"
|
|
- "{HOME}/.netrc"
|
|
- "/etc/gitconfig"
|
|
- "/etc/gitattributes"
|
|
- "/etc/ssh/ssh_config"
|
|
- "/etc/ssh/ssh_known_hosts"
|
|
- "/etc/magic"
|
|
- "/var/log"
|
|
- "/run/systemd"
|
|
- "/var/log/journal"
|
|
- "/etc/systemd"
|
|
- "/proc"
|
|
- "/sys"
|
|
- "{HOME}/.jenkins"
|
|
- "{HOME}/.psqlrc"
|
|
- "{HOME}/.pgpass"
|
|
- "{HOME}/.aws"
|
|
- "{HOME}/.ansible"
|
|
- "{HOME}/.ansible.cfg"
|
|
- "{HOME}/.jira.d"
|
|
- "{HOME}/.my.cnf"
|
|
- "{HOME}/.mylogin.cnf"
|
|
- "{XDG_CONFIG_HOME}/gh"
|
|
- "{XDG_DATA_HOME}/gh/extensions"
|
|
- "/dev"
|
|
- "{HOME}/img"
|
|
- "{XDG_CONFIG_HOME}/ollie"
|
|
rw:
|
|
- "{HOME}/.ssh/known_hosts"
|
|
- "{HOME}/pCloudDrive"
|
|
- "{HOME}/.pcloud"
|
|
- "{HOME}/.git-credentials"
|
|
- "{XDG_CONFIG_HOME}/git/credentials"
|
|
- "{XDG_RUNTIME_DIR}/git/"
|
|
- "{HOME}/.mcpt"
|
|
- "{HOME}/doc"
|
|
- "{HOME}/.cache/mise"
|
|
- "{HOME}/.locale/state/mise"
|
|
- "{HOME}/.gnupg"
|
|
- "{XDG_DOCUMENTS_DIR}"
|
|
- "{XDG_CONFIG_HOME}/.jira"
|
|
- "{HOME}/.m2"
|
|
- "{HOME}/.gradle"
|
|
- "/var/run/docker.sock"
|
|
- "{HOME}/.docker"
|
|
- "{HOME}/.pnpm-store"
|
|
- "{XDG_CONFIG_HOME}/yarn"
|
|
- "{HOME}/.yarnrc.yml"
|
|
- "{HOME}/.npmrc"
|
|
- "{HOME}/.ansible/tmp"
|
|
- "{XDG_RUNTIME_DIR}"
|
|
- "{XDG_DATA_HOME}/containers"
|
|
- "{XDG_CONFIG_HOME}/containers"
|
|
- "{XDG_CONFIG_HOME}/pip"
|
|
- "{HOME}/.pip"
|
|
- "{HOME}/.cargo"
|
|
- "{HOME}/.rustup"
|
|
- "{XDG_CONFIG_HOME}/nvim"
|
|
- "{XDG_CONFIG_HOME}/vim"
|
|
- "{XDG_DATA_HOME}/nvim"
|
|
- "{XDG_STATE_HOME}/nvim"
|
|
- "{HOME}/.vimrc"
|
|
- "{HOME}/.vim"
|
|
- "/etc"
|
|
- "/usr/local/etc"
|
|
- "/dev/urandom"
|
|
- "/dev/random"
|
|
- "/dev/null"
|
|
- "/dev/fuse"
|
|
- "{XDG_DATA_HOME}/ollie"
|
|
- "{HOME}/notes"
|
|
rox:
|
|
- "/usr"
|
|
- "/lib"
|
|
- "/lib64"
|
|
- "/bin"
|
|
- "/sbin"
|
|
- "{HOME}/go/bin"
|
|
- "{HOME}/env"
|
|
- "/proc/self/fd"
|
|
- "/proc/self/cmdline"
|
|
rwx:
|
|
- "{CWD}"
|
|
- "{HOME}/Qt"
|
|
- "{HOME}/.local"
|
|
- "{HOME}/prj/aicoder"
|
|
- "{TMPDIR}"
|
|
- "{PLAN9}"
|
|
- "{HOME}/.cache/uv"
|
|
- "{HOME}/bin"
|
|
- "{OLLIE}"
|
|
- "{TMPDIR}/ollie"
|
|
- "{HOME}/.pyenv"
|
|
- "{HOME}/.sdkman"
|
|
- "{HOME}/go"
|
|
- "{HOME}/.cache/go-build"
|
|
- "{HOME}/opt"
|
|
- "{HOME}/src"
|
|
- "{HOME}/prj"
|
|
- "{HOME}/.nvm"
|
|
- "{HOME}/.please"
|
|
- "{HOME}/.npm"
|
|
- "{HOME}/.mcp-auth"
|
|
- "{HOME}/.yarn"
|
|
- "{HOME}/.local/share/mise"
|
|
- "{PCFS}"
|
|
- "{XDG_RUNTIME_DIR}/{WAYLAND_DISPLAY}"
|
|
- "{HOME}/ws"
|
|
- "{XDG_CONFIG_HOME}/ollie/tools"
|
|
- "{XDG_CONFIG_HOME}/ollie/optmem"
|
|
env:
|
|
- PATH
|
|
- NAMESPACE
|
|
- OLLIE
|
|
- OLLIE_DEFAULT_AGENT
|
|
- OLLIE_SESSION_ID
|
|
- OLLIE_ELEVATE_SOCKET
|
|
- OLLIE_UNAME
|
|
- OLLIE_LOGSEQ_TOKEN
|
|
- HOME
|
|
- TMPDIR
|
|
- PLAN9
|
|
- JENKINS_USER_ID
|
|
- JENKINS_API_TOKEN
|
|
- JENKINS_MCP_AUTH
|
|
- JIRA_API_TOKEN
|
|
- BITBUCKET_ACCESS_TOKEN
|
|
- BITBUCKET_TOKEN
|
|
- BITBUCKET_USERNAME
|
|
- PCLOUD_USER
|
|
- EDITOR
|
|
- GIT_SEQUENCE_EDITOR
|
|
- DISPLAY
|
|
- DBUS_SESSION_BUS_ADDRESS
|
|
- PCFS
|
|
- SSH_AUTH_SOCK
|
|
- XDG_SESSION_TYPE
|
|
- XDG_RUNTIME_DIR
|
|
- XDG_CONFIG_HOME
|
|
- XDG_DATA_HOME
|
|
- XDG_STATE_HOME
|
|
- XDG_CACHE_HOME
|
|
- WAYLAND_DISPLAY
|
|
network:
|
|
unrestricted: true
|