hoster 0.1.1
The first install of 0.1.0 on a real host, Ubuntu 26.04, failed before hoster ever ran. This release fixes that.
The unit starts on Ubuntu
Ubuntu 23.10 and later restrict unprivileged user namespaces
(kernel.apparmor_restrict_unprivileged_userns=1), which leaves the systemd user manager with no
capabilities. Every unit directive that drops capabilities then fails, and the unit stopped with
218/CAPABILITIES.
hoster.service no longer sets CapabilityBoundingSet=, PrivateDevices=,
ProtectKernelModules=, ProtectKernelLogs= or ProtectClock=. hoster runs with no capabilities
anyway, and NoNewPrivileges= and the @privileged system call filter still cover what those
directives added. A new advisory hoster doctor check, unit_sandbox, says when such a host skips
the file-system sandbox. Hardening lists which protections apply where.
CI now starts the unit for real with a stub binary, so a directive that fails to start is caught before release.
Updating
If 0.1.0 failed to start on your host, run the install command again; it installs the new unit too:
|