systemg 0.66.6

An agent-friendly general-purpose program orchestrator for busy people.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

---
title: Kernel-Enforced Sandboxing
---

# Kernel-Enforced Sandboxing

sysg configures kernel enforcement mechanisms per service: rlimits,
capabilities, namespaces, cgroups, seccomp, `no_new_privs`, and Landlock.
All of them are Linux, root, and enforced by the kernel — sysg only
configures them.

## Limits, capabilities, and namespaces

```yaml
services:
  worker:
    command: "./worker"
    user: "worker"
    limits:
      nofile: 4096
      cgroup:
        memory_max: "512M"
    capabilities: ["CAP_NET_BIND_SERVICE"]
    isolation:
      network: true
```

## Syscall and filesystem confinement (schema v3)

Under `version: "3"`:

- **`isolation.landlock: { ro_paths, rw_paths }`** — a Landlock filesystem
  sandbox (Linux 5.13+). Paths not listed become inaccessible.
- **`isolation.seccomp: "baseline-v1"`** — a frozen, deny-by-default syscall
  allowlist; unlisted syscalls return `EPERM`. `no_new_privs` is set alongside.

```yaml
version: "3"
services:
  worker:
    command: "./worker"
    isolation:
      seccomp: "baseline-v1"
      landlock:
        ro_paths: ["/usr", "/lib", "/etc/worker"]
        rw_paths: ["/var/lib/worker"]
```

An unsupported kernel or a malformed policy **refuses the service**
([SG0722](/reference/dialog/codes#sg0722)/[SG0724](/reference/dialog/codes#sg0724))
rather than running it unprotected. `baseline-v1` is frozen; a different or
stricter policy will ship as `baseline-v2`, never as a silent edit.

## Keys that do not enforce

`isolation.apparmor_profile`, `isolation.selinux_context`,
`isolation.private_devices`, and `isolation.private_tmp` are accepted by the
schema but **run the service unenforced**. Treat them as documentation, not
protection.

<Warning>
**Deprecation window.** Each of these keys emits
[SG0721](/reference/dialog/codes#sg0721) at service start. A future release
refuses them instead of running unprotected, behind a manifest schema bump.
Remove the keys or plan for the refusal.
</Warning>

## Diagnostics

- [SG0721](/reference/dialog/codes#sg0721) — a security key was accepted
  but cannot be enforced; the service runs unprotected
- [SG0722](/reference/dialog/codes#sg0722) — seccomp filter could not be
  built, compiled, or applied; service refused
- [SG0723](/reference/dialog/codes#sg0723) — `no_new_privs` could not be
  set; service refused
- [SG0724](/reference/dialog/codes#sg0724) — Landlock requested but the
  kernel ABI is unavailable or insufficient; service refused
- [SG0725](/reference/dialog/codes#sg0725) — unknown seccomp profile; the
  only built-in is `baseline-v1`
- [SG0726](/reference/dialog/codes#sg0726) — seccomp is unsupported on this
  CPU architecture