| commit | ff7452b586134e18af9f1362d7b96dcb64aa8d71 | [log] [tgz] |
|---|---|---|
| author | Jan Schär <jan@monogon.tech> | Thu Nov 28 13:08:55 2024 +0100 |
| committer | Jan Schär <jan@monogon.tech> | Thu Nov 28 14:45:57 2024 +0000 |
| tree | 7e3b9fe5c161cedf1073a086d0b6e5511b20bd98 | |
| parent | 231ee041b652ab2aea6a64e0c4929fa4beb5851b [diff] |
m/node/kubernetes: mount PVs with noexec on the host Now that runc always replaces per-mount-point flags when bind-mounting volumes inside the container, we can mount them with noexec on the host without affecting workloads. This has some security advantages, as any executables in volumes are no longer executable from the host. Change-Id: Id5a8ea8caf702fca58d300fc9e17c21e94ebaf13 Reviewed-on: https://review.monogon.dev/c/monogon/+/3660 Reviewed-by: Lorenz Brun <lorenz@monogon.tech> Tested-by: Jenkins CI
This is the main repository containing the source code for the Monogon Platform.
This is pre-release software - take a look, and check back later! In the meantime, join us on Matrix (#monogon-os-community:matrix.org) or Discord.
Our build environment is self-contained and requires only minimal host dependencies:
/dev/kvm (if you want to run tests).Our docs assume that Bazelisk is available as bazel on your PATH.
Refer to SETUP.md for detailed instructions.
The source code lives in //metropolis (Metropolis is the codename of Monogon OS).
See the //metropolis/README.md for a developer quick start guide, or see the Monogon OS Handbook for user documentation.