王性驊
ea5f51aa7d
Verified live on prod (systemd-run with the same User=harbor, NoNewPrivileges=true, ProtectSystem=strict, ProtectHome=true, ReadWritePaths=/var/lib/harbor as harbor-worker@.service) that Chromium's unprivileged-userns sandbox launches and navigates fine without --no-sandbox; kernel.unprivileged_userns_clone=1 on this host makes it unnecessary. Keeping the browser's own renderer/GPU sandbox gives real defense-in-depth against a malicious/compromised public Threads page, instead of relying on systemd's process-level ProtectSystem alone. Needs a normal release (build-release.sh + activate-release.sh) to reach prod; not hot-patched on the live host. Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|---|---|---|
| .. | ||
| package-lock.json | ||
| package.json | ||
| scrape.mjs | ||