mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-11-08 06:08:05 +00:00
Kevin Veen-Birkenbach
6a8e0f38d8
- Added security_opt (seccomp=unconfined, apparmor=unconfined) and cap_add (MKNOD, SYS_CHROOT, SETUID, SETGID, FOWNER) to allow Collabora's sandbox (coolmount/systemplate) to mount and chroot properly - Increased resource limits (2 CPUs, 2 GB RAM, 2048 PIDs) to prevent document timeout and OOM issues - Resolves 'coolmount: Operation not permitted' and systemplate performance warnings Refs: https://chatgpt.com/share/68ed03cd-1afc-800f-904e-d1c1cb133914
22 lines
704 B
Django/Jinja
22 lines
704 B
Django/Jinja
{% include 'roles/docker-compose/templates/base.yml.j2' %}
|
|
|
|
collabora:
|
|
{% include 'roles/docker-container/templates/base.yml.j2' %}
|
|
image: "{{ COLLABORA_IMAGE }}:{{ COLLABORA_VERSION }}"
|
|
container_name: {{ COLLABORA_CONTAINER }}
|
|
security_opt:
|
|
- seccomp=unconfined
|
|
- apparmor=unconfined
|
|
cap_add:
|
|
- MKNOD
|
|
- SYS_CHROOT
|
|
- SETUID
|
|
- SETGID
|
|
- FOWNER
|
|
ports:
|
|
- "127.0.0.1:{{ ports.localhost.http[application_id] }}:{{ container_port }}"
|
|
{% include 'roles/docker-container/templates/healthcheck/curl.yml.j2' %}
|
|
{% include 'roles/docker-container/templates/networks.yml.j2' %}
|
|
|
|
{% include 'roles/docker-compose/templates/networks.yml.j2' %}
|