chore(pegboard): update oci config for stricter security

[NathanFlurry]

Changes

[NathanFlurry]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• chore(pegboard): update oci config for stricter security #2500 👈 (View in Graphite)
• chore: add standalone toolchain build scripts #2400 : 1 other dependent PR (#2501 )
• refactor: replace unsafe File::from_raw_fd with safe File::from #2479
• main

---

How to use the Graphite Merge Queue

Add the label merge-queue to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying rivet with    Cloudflare Pages

Latest commit:	d4c8eac
Status:	✅  Deploy successful!
Preview URL:	https://befd5211.rivet.pages.dev
Branch Preview URL:	https://graphite-base-2501.rivet.pages.dev

View logs

[greptile-apps]

PR Summary

Enhanced container security through stricter OCI configuration and seccomp policies, while adding a basic health check endpoint.

• Added /ping endpoint in packages/edge/infra/guard/server/src/routing/api.rs for basic health monitoring
• Implemented stricter resource limits in oci_config.rs including CPU (10,000 shares max), memory, pids (256), and block I/O (10MB/s)
• Reduced Linux capabilities to minimum required set (CAP_SETGID, CAP_SETUID, CAP_NET_BIND_SERVICE, CAP_KILL)
• Removed high-risk syscalls like ptrace, chroot, and capset in seccomp configuration
• Added comprehensive namespace isolation including user, network, and cgroup namespaces

_{3 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings | Greptile}

[cloudflare-workers-and-pages]

Deploying rivet-studio with    Cloudflare Pages

Latest commit:	d4c8eac
Status:	✅  Deploy successful!
Preview URL:	https://c7bb98f7.rivet-studio.pages.dev
Branch Preview URL:	https://graphite-base-2501.rivet-studio.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying rivet-hub with    Cloudflare Pages

Latest commit:	d4c8eac
Status:	✅  Deploy successful!
Preview URL:	https://8773682a.rivet-hub-7jb.pages.dev
Branch Preview URL:	https://graphite-base-2501.rivet-hub-7jb.pages.dev

View logs