Post #2416619

2025-12-24 03:16 UTC

another good reason to Just Use Systemd instead of containers is all the hardening knobs that are readily available. You can block entire slices of the filesystem that your service shouldn&#39;t access. You can block all network access except what your program needs. You can block whole entire categories of syscalls and kernel features your program shouldn&#39;t use. It is literally just a few lines of config to do all that and it might just save you from getting popped and running a cryptominer or worse next time a dependency you didn&#39;t know about of some random app you&#39;ve deployed has some disastrous RCE

Replies (6)

@hailey@hails.org 2025-12-24 03:30

If you want to know more, here's some good places to start in the systemd docs: General hardening: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Sandboxing Network filtering: https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#Network%20Accounting%20and%20Control + honourable mention for SHH, a tool I haven't used but looks interesting, which can automatically generate hardening settings for you by observing what your service actually does at runtime: https://github.com/desbma/shh

Open ##3024013
@whitequark@mastodon.social 2025-12-24 03:19

@hailey@hails.org yeah this was my response to "please add [hardening]" to git-pages getting hardening inside an app is _hard_ and things like seccomp/pledge barely do anything for a web application anyway, the trust boundaries are squishy and between requests systemd already does most of what you'd be able to get with pledge or landlock in best case. and go-landlock is cursed (check it out)

Open ##3024014
@dmnelson@mastodon.social 2025-12-24 04:45

@hailey@hails.org Thank you! I didn’t realize systemd could enforce these kinds of restrictions. I’ve got some reading to do… 🙂

Open ##3024026
@vojta001@gts.vkane.cz 2025-12-24 07:51

@hailey@hails.org Exactly! We already have containers at home and it's called services. The stupid thing about systemd unit hardening though is that most of the options are silently ignored if their initialization fails for whatever reason. It surely helps unit files portability, but one can't rely on the security features ☹️

Open ##3024030
@schoentoon@mastodon.schoentoon.com 2025-12-24 08:57

@hailey@hails.org Quite frankly, if you really must use containers. Using rootless podman through quadlet (which is really just systemd) is probably the nicest way either way, for single host at least.

Open ##3024031
@foophoof@tech.lgbt 2026-04-30 13:48

@hailey@hails.org i’ve been digging into how to make restic take backups of my btrfs snapshots, which needs some weird mount rebinding in order to make restic see the path at the right place for deduplication purposes (i.e. not have the ever changing snapshot number in the path), and after digging through a bunch of options i kinda landed on systemd for similar reasons, it’s got the flags for everything, no need to juggle a bash script with chroot and manual mounts…

Open ##3024032