qm.container

[Install]
WantedBy=default.target

[Service]
# It's recommended to use systemd drop-in to override the
# systemd settings. See QM manpage for an example.
CPUWeight=50
Delegate=true
IOWeight=50
ManagedOOMSwap=kill
MemorySwapMax=0
# Containers within the qm contain default set OOMScoreAdj to 750
OOMScoreAdjust=500
Restart=always
Slice=QM.slice
Environment=ROOTFS=/usr/lib/qm/rootfs
Environment=RWETCFS=/etc/qm
Environment=RWVARFS=/var/qm
LimitNOFILE=65536
TasksMax=50%

[Container]
AddCapability=all

# Comment DropCapability this will allow FFI Tools to surpass their defaults.
DropCapability=sys_resource

AddDevice=-/dev/kvm
AddDevice=-/dev/fuse
ContainerName=qm
Exec=/sbin/init
Network=private
PodmanArgs=--pids-limit=-1 --security-opt seccomp=/usr/share/qm/seccomp.json --security-opt label=nested --security-opt unmask=all
ReadOnly=true
Rootfs=${ROOTFS}

SecurityLabelNested=true
SecurityLabelFileType=qm_file_t
SecurityLabelLevel=s0
SecurityLabelType=qm_t
Timezone=local
Volume=${RWETCFS}:/etc
Volume=${RWVARFS}:/var