mirror of
https://github.com/open-jarvis/OpenJarvis.git
synced 2026-07-28 14:07:55 +00:00
Elliot SluskyandGitHub
5bc8d3a2f6
Pin all base images and ollama to fixed versions + @sha256 digests (no floating :latest), run Docker images as an unprivileged openjarvis user (uid 10001), replace the curl|bash NodeSource install with a digest-pinned multi-stage copy, install from the committed uv.lock via uv export --frozen --no-dev (hash-verified, --no-deps), and add systemd sandboxing (NoNewPrivileges, ProtectSystem=strict, PrivateTmp, kernel/SUID protections). Closes #228, #563, #564, #565, #566, #567.
41 lines
1.3 KiB
Desktop File
41 lines
1.3 KiB
Desktop File
[Unit]
|
|
Description=OpenJarvis API Server
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=openjarvis
|
|
WorkingDirectory=/opt/openjarvis
|
|
ExecStart=/opt/openjarvis/.venv/bin/jarvis serve --host 0.0.0.0 --port 8000
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
Environment=HOME=/opt/openjarvis
|
|
# Binding 0.0.0.0 requires authentication. This file MUST exist and contain:
|
|
# OPENJARVIS_API_KEY=<key> (generate one: `jarvis auth generate-key`)
|
|
# It is not prefixed with "-", so the unit fails to start if the file is
|
|
# missing — preventing an accidentally unauthenticated public server.
|
|
# Keep secrets here (mode 0600, owned by root) rather than inline Environment=
|
|
# lines, which leak into `systemctl show` and the journal.
|
|
EnvironmentFile=/etc/openjarvis/env
|
|
|
|
# --- Sandboxing / hardening (#564) ---
|
|
# Conservative set: tightens the unit without blocking the server's normal I/O
|
|
# or local GPU inference. ProtectSystem=strict makes the whole filesystem
|
|
# read-only except ReadWritePaths, so $HOME (config/cache/state under
|
|
# /opt/openjarvis) stays writable.
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/opt/openjarvis
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
ProtectControlGroups=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelTunables=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|