57 lines
1.7 KiB
Desktop File
57 lines
1.7 KiB
Desktop File
[Unit]
|
|
Description=Morphit trivy monitor — Docker image vulnerability rescan
|
|
Documentation=https://git.agorise.net/agorise/morphit
|
|
After=network-online.target docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# Needs Docker daemon access. Could run as a non-root user in
|
|
# the `docker` group; running as root is the conservative
|
|
# default since we apply tight syscall + capability filters
|
|
# below.
|
|
User=root
|
|
Group=root
|
|
|
|
# Allow Docker socket access only (default /run/docker.sock).
|
|
# trivy itself talks to dockerd via that socket.
|
|
ReadWritePaths=
|
|
|
|
# trivy downloads CVE DB updates on first run + then daily; it
|
|
# needs outbound HTTPS. Cannot use PrivateNetwork=true.
|
|
|
|
EnvironmentFile=-/etc/morphit/trivy-monitor.env
|
|
ExecStart=/opt/morphit/ops/scripts/morphit-trivy-monitor.sh
|
|
|
|
# ─── Hardening ─────────────────────────────────────────────────
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
NoNewPrivileges=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
ProtectClock=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
LockPersonality=true
|
|
MemoryDenyWriteExecute=true
|
|
LimitCORE=0
|
|
|
|
# trivy needs outbound HTTPS to its CVE DB hosts. Allowlist for
|
|
# the outbound firewall is documented in OPERATIONS.md §16.
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
|
|
# trivy + tar + curl-equivalent for DB downloads. Don't strip
|
|
# too tight or trivy fails opaquely.
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources
|
|
|
|
# Trivy can need to write a CVE DB cache (~500MB).
|
|
ReadWritePaths=/root/.cache/trivy /var/cache/trivy
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|