Hacker News Reader

Comment by kenniskrag | Hacker News Reader

if you want to test these settings I can recommend `sudo systemd-run -p "DynamicUser=yes" -p "ProtectSystem=yes" -p "ProtectHome=yes" --shell` but be in a readable directory like /tmp or you receive an error.

View on HN

This is a very handy command in day-to-day work, actually. For example, I use to limit the total amount of memory available to an application, including page cache:

  $ systemd-run --user --scope --property=MemoryHigh=1G qbittorrent

It works just as you'd expect — if qbittorrent's working set goes above 1024 MiB, it pushes the least recently used page out of the page cache. Doesn't really have any effects on upload or download speeds, while helping to keep more useful data in memory.

Many isolation flags are not available in `systemd-run --user`, though, so if you'd like to have some protection you either have to combine `sudo systemd-run` with `su -c`, or wrap the command in firejail.

https://github.com/netblue30/firejail/

I have a bash alias for `make` and `ninja` to do something similar. Just having all the spawned processes in a cgroup helps with system interactivity while building. This works because the kernel will then schedule the whole build as a single unit against the other work on the system, rather than scheduling each process that the build spawns against every other process that I'm running.

Interesting, a few months ago I tried using systemd-run to implement unprivileged memory limits for a process and I'm pretty sure it didn't work with the user manager. Is this a recent addition? (I'm not sure what version of systemd I had at the time.)

Ooh, is this a good way to sandbox execs like ImageMagick or stuff like that?

Use firejail, it's a "one click" solution with prepackaged profiles.

https://github.com/netblue30/firejail/

It uses the same kernel knobs as systemd does, but is more user-friendly and has more features.

I use it for every application that handles data received from other machines: books, images, documents, whatever.

You can also use Bubblewrap, but getting it up and running requires a lot more fiddling around. For example, this is what I use to isolate Zoom from the rest of my system: https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6...

In my case I'm using Bubblewrap because Firejail was only used for Zoom, and this felt a bit of a waste considering Bubblewrap was already installed.

Reply on news.ycombinator.com