qm.container

[Install]
WantedBy=default.target

[Service]
# It's recommended to use systemd drop-in to override the
# systemd settings. See QM manpage for an example.
# CPUWeight: This setting controls the CPU controller for qm.
# Delegate: Turns on delegation of further resource control
#           partitioning to processes of the unit.
# IOWeight: Set the overall block I/O weight for qm.
# ManagedOOMSwap=auto|kill: Specifies how systemd-oomd.service will act on qm.
# QM cgroup, pass directly to systemd and handled by it,
# please refer to `man systemd.resource-control` for details.
CPUWeight=50
Delegate=true
IOWeight=50
ManagedOOMSwap=kill

# MemoryMax
# -----------
# Default is infinity - sets no upper bound on memory usage, allowing the
# service to consume as much memory as the system allows, just like
# MemoryMax=0 or omitting it.
MemoryMax=infinity

# MemoryHigh
# -----------
# Default is infinity - Disables the soft memory limit, meaning no throttling
# will occur due to high memory usage, similar to MemoryHigh=0 or
# omitting it.
MemoryHigh=infinity
MemorySwapMax=0

# Containers within the qm contain default set OOMScoreAdj to 750
OOMScoreAdjust=500
Restart=always
Slice=QM.slice
Environment=ROOTFS=/usr/lib/qm/rootfs
Environment=RWETCFS=/etc/qm
Environment=RWVARFS=/var/qm
LimitNOFILE=65536
TasksMax=50%

[Container]
# AddCapability
# -------------
# Add these capabilities, in addition to the default Podman capability set, to the container.
# If set to all, grants all capabilities to the container, increasing flexibility but significantly
# reducing security.
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#addcapability
AddCapability=all

# Unmask
# -------
# Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*):
# If set to ALL, Podman will unmask all the paths that are masked or made read-only by default.
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#unmask
Unmask=ALL
SecurityLabelNested=true
SeccompProfile=/usr/share/qm/seccomp-no-rt.json

# PidsLimit
# ---------
# Disables the PID limit for the container by setting it to -1.
# Without a limit, the container can spawn unlimited processes, potentially exhausting system resources.
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#pidslimit
PidsLimit=-1

# Comment DropCapability this will allow FFI Tools to surpass their defaults.
DropCapability=sys_resource

AddDevice=-/dev/kvm
AddDevice=-/dev/fuse
ContainerName=qm
Exec=/sbin/init
Network=private

# ReadOnly
# --------
# Makes the container's filesystem read-only, enhancing security by preventing modifications.
ReadOnly=true

# TmpFS flags
ReadOnlyTmpfs=false
Mount=type=tmpfs,tmpfs-size=512M,destination=/tmp
Mount=type=tmpfs,tmpfs-size=512M,destination=/run
Mount=type=tmpfs,destination=/dev/shm

# Rootfs
# ------
# Defines the root filesystem location for QM partition.
# By default the '${ROOTFS}' variable points to /usr/lib/qm/rootfs.
# For details see: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html#rootfs
#
Rootfs=${ROOTFS}

SecurityLabelNested=true
SecurityLabelFileType=qm_file_t
SecurityLabelLevel=s0
SecurityLabelType=qm_t
Timezone=local
Volume=${RWETCFS}:/etc
Volume=${RWVARFS}:/var