qm.container

[Install]
WantedBy=default.target

[Service]
AllowedCPUs=1
CPUWeight=50
Delegate=true
IOWeight=50
ManagedOOMSwap=kill
MemorySwapMax=0
# Containers within the qm y default set OOMScoreAdj to 750
OOMScoreAdjust=500
Restart=always
Slice=QM.slice
Environment=ROOTFS=/usr/lib/qm/rootfs
Environment=RWETCFS=/etc/qm
Environment=RWVARFS=/var/qm
LimitNOFILE=65536
TasksMax=50%

[Container]
AddCapability=all

# Comment DropCapability this will allow FFI Tools to surpass their defaults.
DropCapability=sys_resource

AddDevice=-/dev/kvm
AddDevice=-/dev/fuse
ContainerName=qm
Exec=/sbin/init
Network=host
PodmanArgs=--pids-limit=-1 --security-opt label=nested --security-opt unmask=all
ReadOnly=true
Rootfs=${ROOTFS}

# FIXME: QM is failing to start if SecurityLabelNested is enabled.
# Add back as soon podman 4.7 is released.
# SecurityLabelNested=true

SecurityLabelFileType=qm_file_t
SecurityLabelLevel=s0
SecurityLabelType=qm_t
Timezone=local
Volume=${RWETCFS}:/etc
Volume=${RWVARFS}:/var