AgentServer/deploy/agent-server.service

# AgentServer systemd 服务（docs/design/06-security.md §5，ADR-0012）
# 以专用用户 agentsvc 运行：该用户不在 docker/lxd/sudo 组，Agent 失控时的影响上限是它自己的数据
[Unit]
Description=AgentServer
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=agentsvc
Group=agentsvc
WorkingDirectory=/srv/agent-server/app/server
Environment=NODE_ENV=production
Environment=HOME=/srv/agent-server/home
Environment=AGENT_SERVER_DATA_DIR=/srv/agent-server
Environment=AGENT_SERVER_ADMIN_DIST=/srv/agent-server/app/admin
ExecStart=/usr/local/bin/node dist/main.js
Restart=on-failure
RestartSec=3

# 文件系统：整盘只读，home 不可见，只有服务数据可写；程序与运行环境由 root 所有、只读
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/srv/agent-server/home /srv/agent-server/data /srv/agent-server/workspaces /srv/agent-server/logs /srv/agent-server/knowledge
PrivateTmp=yes
UMask=0077
# 纵深防御：即使权限配置出错，也看不到这些高权限 socket
InaccessiblePaths=-/var/run/docker.sock -/run/docker.sock -/var/snap/lxd/common/lxd/unix.socket

# 内核与提权
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
LockPersonality=yes
# 不能开启 RestrictNamespaces：bubblewrap 沙箱需要 user/mount/net namespace

# 资源上限
MemoryMax=8G
CPUQuota=600%
TasksMax=1024

[Install]
WantedBy=multi-user.target