From 22a76436ca9acced00c517b57ae2f2b73a197de0 Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Thu, 13 Aug 2026 22:18:47 +0300 Subject: Update immich jail --- roles/jails/20_immich/templates/jail.conf.j2 | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) (limited to 'roles/jails/20_immich/templates/jail.conf.j2') diff --git a/roles/jails/20_immich/templates/jail.conf.j2 b/roles/jails/20_immich/templates/jail.conf.j2 index 47a0454..6486677 100644 --- a/roles/jails/20_immich/templates/jail.conf.j2 +++ b/roles/jails/20_immich/templates/jail.conf.j2 @@ -1,11 +1,14 @@ +{% set devfs_ruleset = 4 -%} {{ jail.name }} { vnet; exec.clean; allow.raw_sockets; - mount.devfs; - enforce_statfs = 1; - devfs_ruleset = 4; + mount.devfs; # Mount /dev according to devfs_ruleset + devfs_ruleset = {{ devfs_ruleset }}; + + enforce_statfs = 1; # Let jail see own mounts + host.hostname = "${name}"; path = "/usr/local/jails/containers/${name}"; @@ -25,10 +28,10 @@ {% for img in oci_images %} # Mounts for {{ img.name }} rootfs - mount += "linprocfs $path/image/{{ img.name }}/proc linprocfs rw 0 0"; - mount += "linsysfs $path/image/{{ img.name }}/sys linsysfs rw 0 0"; - mount += "devfs $path/image/{{ img.name }}/dev devfs rw 0 0"; - mount += "tmpfs $path/image/{{ img.name }}/tmp tmpfs rw 0 0"; - mount += "tmpfs $path/image/{{ img.name }}/run tmpfs rw 0 0"; + mount += "devfs $path/image/{{ img.name }}/dev devfs rw,ruleset={{ devfs_ruleset }} 0 0"; + mount += "linprocfs $path/image/{{ img.name }}/proc linprocfs rw 0 0"; + mount += "linsysfs $path/image/{{ img.name }}/sys linsysfs rw 0 0"; + mount += "tmpfs $path/image/{{ img.name }}/tmp tmpfs rw 0 0"; + mount += "tmpfs $path/image/{{ img.name }}/run tmpfs rw 0 0"; {% endfor %} } -- cgit v1.3