install-service: grant venv base interpreter (pyvenv.cfg home) outside COMFY_DIR

2026-09-21 22:19:08 +02:00
parent 2d5be72436
commit b55d548c5f
4 changed files with 97 additions and 2 deletions
@@ -64,11 +64,16 @@ func Run(run func(ctx context.Context) error) error {
 // directives apply. The proxy needs nothing but outbound TCP/UDP and the
 // notify socket, so it loses nothing. A managed ComfyUI (comfyDir) gets a
 // BindPaths hole through ProtectHome/ProtectSystem: it reads its venv and
-// writes output/temp/user data under COMFY_DIR.
+// writes output/temp/user data under COMFY_DIR. A venv whose base
+// interpreter (pyvenv.cfg home) lives outside COMFY_DIR gets an additional
+// read-only bind.
 func renderUnit(exePath, configPath, comfyDir string) string {
 	bind := ""
 	if comfyDir != "" {
 		bind = "BindPaths=" + comfyDir + "\n"
+		if home := comfyVenvHome(comfyDir); home != "" {
+			bind += "BindReadOnlyPaths=" + home + "\n"
+		}
 	}
 	return fmt.Sprintf(`[Unit]
 Description=gpu-turnstile GPU arbitration proxy for Ollama and ComfyUI