mirror of
https://github.com/zrepl/zrepl.git
synced 2025-01-23 14:48:47 +01:00
12018b3685
Go 1.19 uses it during startup. From the Go changelog: > On Unix operating systems, Go programs that import package os now > automatically increase the open file limit (RLIMIT_NOFILE) to the > maximum allowed value; that is, they change the soft limit to match the > hard limit. This corrects artificially low limits set on some systems > for compatibility with very old C programs using the select system call. > Go programs are not helped by that limit, and instead even simple > programs like gofmt often ran out of file descriptors on such systems > when processing many files in parallel. One impact of this change is > that Go programs that in turn execute very old C programs in child > processes may run those programs with too high a limit. This can be > corrected by setting the hard limit before invoking the Go program.
35 lines
1.1 KiB
Desktop File
35 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=zrepl daemon
|
|
Documentation=https://zrepl.github.io
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStartPre=/usr/local/bin/zrepl --config /etc/zrepl/zrepl.yml configcheck
|
|
ExecStart=/usr/local/bin/zrepl --config /etc/zrepl/zrepl.yml daemon
|
|
RuntimeDirectory=zrepl zrepl/stdinserver
|
|
RuntimeDirectoryMode=0700
|
|
|
|
ProtectSystem=strict
|
|
#PrivateDevices=yes # TODO ZFS needs access to /dev/zfs, could we limit this?
|
|
ProtectKernelTunables=yes
|
|
ProtectControlGroups=yes
|
|
PrivateTmp=yes
|
|
#PrivateUsers=yes # TODO Does not work, why?
|
|
ProtectKernelModules=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=yes
|
|
SystemCallArchitectures=native
|
|
|
|
ProtectHome=read-only
|
|
# ProtectHome=tmpfs totally possible, not by default though because of Debian stretch
|
|
|
|
# SystemCallFilter
|
|
# ~@privileged doesn't work with Ubuntu 18.04 ssh
|
|
SystemCallFilter=~ @mount @cpu-emulation @keyring @module @obsolete @raw-io @debug @clock @resources
|
|
# Go1.19 added automatic RLIMIT_NOFILE changes, so, we need to allow that
|
|
SystemCallFilter= setrlimit
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|