4 ms·
As a systemd hater, I have to say that I like the systemd approach here better than messing with iptables. The locality of behavior is nice.
by traverseda 4y ago
As a systemd hater, I have to say that I like the systemd approach here better than messing with iptables. The locality of behavior is nice.
- andrewstuart 4y agosystemd has a bunch of other application/service level resource control stuff you might like, besides IPAddressDeny, listed here: https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html https://www.freedesktop.org/software/systemd/man/systemd.res... Also you might like nspawn it's a pretty cool alternative to chroot: https://wiki.archlinux.org/title/systemd-nspawn https://wiki.archlinux.org/title/systemd-nspawn https://www.freedesktop.org/software/systemd/man/systemd-nspawn.html https://www.freedesktop.org/software/systemd/man/systemd-nsp...
- traverseda 4y agoNah, I'm still passed off about nspawn. Broke chroots for me in some embedded linux contexts, well the fact that you have to use nspawn in order to launch systemd services.
- throw0101c 4y ago> As a systemd hater, I have to say that I like the systemd approach here better than messing with iptables. The locality of behavior is nice. Until someone new comes along and is not aware of this seemingly obscure feature and can't figure why traffic is not getting to the app: nothing in iptables, tcpdump shows the packets getting to the system… WTF? Looking at a service's systemd unit file would be the last place I would think for network filtering configuration. Or does systemd place the appropriate lines into iptables (or nftables nowadays) on your behalf?