Dustin C. Hatch
96ac5be3b5
As pods move around between nodes, applications are updated, etc., nodes tend to accumulate images in their container stores that are no longer used. These take up space unnecessarily, eventually triggering disk usage alarms. From now, the _kubelet_ role installs a systemd timer and service unit to periodically clean up these unused images.
39 lines
804 B
Desktop File
39 lines
804 B
Desktop File
[Unit]
|
|
Description=Prune unused container images
|
|
After=crio.service
|
|
Requires=crio.service
|
|
StartLimitBurst=10
|
|
StartLimitIntervalSec=10s
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/crictl rmi --prune
|
|
Restart=on-failure
|
|
RestartSec=2s
|
|
CapabilityBoundingSet=
|
|
DeviceAllow=
|
|
DevicePolicy=closed
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateUsers=yes
|
|
PrivateTmp=yes
|
|
ProcSubset=pid
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
RestrictAddressFamilies=AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged
|