bottlerocket-os / bottlerocket-os/bottlerocket-core-kit
Sandbox privileged third party systemd services (part 1)
Open
- Dominant language
- Rust
- Stars
- 34
- Forks
- 77
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 23
Description
**What I'd like:**
In the spirit of bottlerocket-os/bottlerocket#808, we should reduce the exposure rating of the third party systemd services. This is the first part of the third party systemd services to be sandboxed:
* nvidia-k8s-device-plugin.service
* acpid.service
* chronyd.service
**Any alternatives you've considered:**
N / A
Contributor guide
Assessment
This issue has not been assessed yet.