jailConfig.cfg

name: "ssx-sandbox-compilation"

mode: ONCE
log_level: FATAL
hostname: "HC-sandbox"

# keep_caps: true
cap: "CAP_SETUID"
cap: "CAP_SETGID"
cap: "CAP_KILL"
# clone_newipc: false
# clone_newuser: false
envar: "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:."
mount_proc: true

# Hard Limit
# time_limit: 10
# rlimit_fsize: 256

mount {
    src: '/usr'
    dst: '/usr'
    is_bind: true
    mandatory: true
}

mount {
    src: '/etc'
    dst: '/etc'
    is_bind: true
    mandatory: true
}

# mount {
#     src: "/dev"
#     dst: "/dev"
#     is_bind: true
# }

mount {
    src: "/dev/random"
    dst: "/dev/random"
    is_bind: true
}
mount {
    src: "/dev/urandom"
    dst: "/dev/urandom"
    is_bind: true
}

# mount {
#     src: "/proc/self/fd/0"
#     dst: "/dev/stdin"
#     is_bind: true
#     is_symlink: true
# }
# mount {
#     src: "/proc/self/fd/1"
#     dst: "/dev/stdout"
#     is_bind: true
#     is_symlink: true
# }
# mount {
#     src: "/proc/self/fd/2"
#     dst: "/dev/stderr"
#     is_bind: true
#     is_symlink: true
# }

mount {
    src: "/lib"
    dst: "/lib"
    is_bind: true
}

mount {
    src: "/bin"
    dst: "/bin"
    is_bind: true
}

mount {
    src: "/sbin"
    dst: "/sbin"
    is_bind: true
}

mount {
    src: "/lib64"
    dst: "/lib64"
    is_bind: true
}

mount {
    src: "/var"
    dst: "/var"
    is_bind: true
}

mount {
    src: "/run"
    dst: "/run"
    is_bind: true
}

mount {
    src: '/sys/fs/cgroup'
    dst: '/sys/fs/cgroup'
    is_bind: true
    mandatory: true
}