4 ms·

if you want to test these settings I can recommend `sudo systemd-run -p "DynamicUser=yes" -p "ProtectSystem=yes" -p "ProtectHome=yes" --shell` but be in a reada

if you want to test these settings I can recommend `sudo systemd-run -p "DynamicUser=yes" -p "ProtectSystem=yes" -p "ProtectHome=yes" --shell` but be in a readable directory like /tmp or you receive an error.

5e92cb50239222b 5y ago
This is a very handy command in day-to-day work, actually. For example, I use to limit the total amount of memory available to an application, including page cache: $ systemd-run --user --scope --property=MemoryHigh=1G qbittorrent It works just as you'd expect — if qbittorrent's working set goes above 1024 MiB, it pushes the least recently used page out of the page cache. Doesn't really have any effects on upload or download speeds, while helping to keep more useful data in memory. Many isolation flags are not available in `systemd-run --user`, though, so if you'd like to have some protection you either have to combine `sudo systemd-run` with `su -c`, or wrap the command in firejail. https://github.com/netblue30/firejail/ https://github.com/netblue30/firejail/
- wmanley 5y ago
  I have a bash alias for `make` and `ninja` to do something similar. Just having all the spawned processes in a cgroup helps with system interactivity while building. This works because the kernel will then schedule the whole build as a single unit against the other work on the system, rather than scheduling each process that the build spawns against every other process that I'm running.
- t0astbread 5y ago
  Interesting, a few months ago I tried using systemd-run to implement unprivileged memory limits for a process and I'm pretty sure it didn't work with the user manager. Is this a recent addition? (I'm not sure what version of systemd I had at the time.)
pram 5y ago
Ooh, is this a good way to sandbox execs like ImageMagick or stuff like that?
- 5e92cb50239222b 5y ago
  Use firejail, it's a "one click" solution with prepackaged profiles. https://github.com/netblue30/firejail/ https://github.com/netblue30/firejail/ It uses the same kernel knobs as systemd does, but is more user-friendly and has more features. I use it for every application that handles data received from other machines: books, images, documents, whatever.
  - YorickPeterse 5y ago
    You can also use Bubblewrap, but getting it up and running requires a lot more fiddling around. For example, this is what I use to isolate Zoom from the rest of my system: https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6fb7629fd9b482353e36798c7bf31a/dotfiles/bin/zoom-jail https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6... In my case I'm using Bubblewrap because Firejail was only used for Zoom, and this felt a bit of a waste considering Bubblewrap was already installed.

5e92cb50239222b 5y ago

This is a very handy command in day-to-day work, actually. For example, I use to limit the total amount of memory available to an application, including page cache: $ systemd-run --user --scope --property=MemoryHigh=1G qbittorrent It works just as you'd expect — if qbittorrent's working set goes above 1024 MiB, it pushes the least recently used page out of the page cache. Doesn't really have any effects on upload or download speeds, while helping to keep more useful data in memory. Many isolation flags are not available in `systemd-run --user`, though, so if you'd like to have some protection you either have to combine `sudo systemd-run` with `su -c`, or wrap the command in firejail. https://github.com/netblue30/firejail/ https://github.com/netblue30/firejail/

wmanley 5y ago
I have a bash alias for `make` and `ninja` to do something similar. Just having all the spawned processes in a cgroup helps with system interactivity while building. This works because the kernel will then schedule the whole build as a single unit against the other work on the system, rather than scheduling each process that the build spawns against every other process that I'm running.
t0astbread 5y ago
Interesting, a few months ago I tried using systemd-run to implement unprivileged memory limits for a process and I'm pretty sure it didn't work with the user manager. Is this a recent addition? (I'm not sure what version of systemd I had at the time.)

pram 5y ago

Ooh, is this a good way to sandbox execs like ImageMagick or stuff like that?

5e92cb50239222b 5y ago
Use firejail, it's a "one click" solution with prepackaged profiles. https://github.com/netblue30/firejail/ https://github.com/netblue30/firejail/ It uses the same kernel knobs as systemd does, but is more user-friendly and has more features. I use it for every application that handles data received from other machines: books, images, documents, whatever.
- YorickPeterse 5y ago
  You can also use Bubblewrap, but getting it up and running requires a lot more fiddling around. For example, this is what I use to isolate Zoom from the rest of my system: https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6fb7629fd9b482353e36798c7bf31a/dotfiles/bin/zoom-jail https://gitlab.com/yorickpeterse/dotfiles/-/blob/0a0492c78b6... In my case I'm using Bubblewrap because Firejail was only used for Zoom, and this felt a bit of a waste considering Bubblewrap was already installed.