mirror of
https://github.com/alexbelgium/hassio-addons.git
synced 2026-11-04 03:42:14 +00:00
831c5eec82
* add letta_code addon * address pr review comments * tweak env_vars regex and readme port note * drop nginx, wrap upstream entrypoint, simplify build * secure system cron paths and doc bearer auth * persist cron paths in config with non-root sanitization * letta_code: drop PUID/PGID and the cron sanitizer, run as root like upstream The non-root branch rewrote cron field 6 root->node, which misses @reboot/@daily lines (user is field 2) and mapped to node, not PUID. Upstream's entrypoint installs cron and starts it as root before gosu anyway. Run as root like the upstream image: drop gosu, the PUID/PGID options, the recursive chown and the extra cron dirs (the entrypoint creates them under ~/.letta, linked to /config/.letta). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * letta_code: drop trailing blank line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: BirdNET-Go Addon Builder <addon-builder@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
1.1 KiB
Plaintext
52 lines
1.1 KiB
Plaintext
#include <tunables/global>
|
|
|
|
profile letta_code_addon flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
|
|
capability chown,
|
|
capability dac_override,
|
|
capability fowner,
|
|
capability setgid,
|
|
capability setuid,
|
|
capability sys_chroot,
|
|
file,
|
|
signal,
|
|
network udp,
|
|
network tcp,
|
|
network dgram,
|
|
network stream,
|
|
network inet,
|
|
network inet6,
|
|
network unix dgram,
|
|
|
|
# Entrypoint stack
|
|
/init ix,
|
|
/run/{s6,s6-rc*,service}/** ix,
|
|
/package/** ix,
|
|
/command/** ix,
|
|
/run/{,**} rwk,
|
|
/dev/tty rw,
|
|
/bin/** ix,
|
|
/usr/bin/** ix,
|
|
/usr/lib/bashio/** ix,
|
|
/etc/s6/** rix,
|
|
/run/s6/** rix,
|
|
/etc/services.d/** rwix,
|
|
/etc/cont-init.d/** rwix,
|
|
/etc/cont-finish.d/** rwix,
|
|
/init rix,
|
|
/var/run/** mrwkl,
|
|
/var/run/ mrwkl,
|
|
/tmp/** mrkwl,
|
|
|
|
# Data access
|
|
/data/** rw,
|
|
/config/** rw,
|
|
|
|
# suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
|
|
ptrace (trace,read) peer=docker-default,
|
|
|
|
# docker daemon confinement requires explicit allow rule for signal
|
|
signal (receive) set=(kill,term) peer=/usr/bin/docker,
|
|
}
|