Systemd Deployment

PRISM can run as a native systemd service for bare-metal or VM deployments.

Package Installation

Debian / Ubuntu

sudo dpkg -i prism_1.0.0_amd64.deb

RHEL / Fedora / CentOS

sudo rpm -i prism-1.0.0-1.x86_64.rpm

Both packages install:

• Binary: /usr/local/bin/prism
• Config: /etc/prism/config.toml
• License: /etc/prism/license.lic
• Service: /etc/systemd/system/prism.service

Systemd Service File

[Unit]
Description=Trident PRISM Dynamic Rendering Proxy
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=60
StartLimitBurst=5

[Service]
Type=simple
User=prism
Group=prism
ExecStart=/usr/local/bin/prism --config /etc/prism/config.toml
Restart=on-failure
RestartSec=5

# Graceful shutdown: send SIGTERM, wait for drain
KillMode=mixed
TimeoutStopSec=45

# Environment
Environment=RUST_LOG=info

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
# Chrome sandbox requires user namespaces — do NOT restrict them.
# All other namespace types are blocked.
RestrictNamespaces=~cgroup ipc net mnt pid
RestrictSUIDSGID=true
LockPersonality=true

# Resource limits
MemoryMax=2G
TasksMax=512

# Allow Chrome to use /dev/shm
ReadWritePaths=/dev/shm

# Config and license are read-only
ReadOnlyPaths=/etc/prism

[Install]
WantedBy=multi-user.target

Setup

Create Service User

sudo useradd --system --no-create-home --shell /usr/sbin/nologin prism

Chrome Sandbox Requirements

PRISM runs Chrome with sandbox enabled for security. The sandbox uses Linux user namespaces, which requires:

# Check if user namespaces are enabled (should return 1)
sysctl kernel.unprivileged_userns_clone

If the value is 0, enable it:

# Enable temporarily
sudo sysctl -w kernel.unprivileged_userns_clone=1

# Enable permanently
echo "kernel.unprivileged_userns_clone=1" | sudo tee /etc/sysctl.d/99-chrome-sandbox.conf
sudo sysctl --system

Most modern distributions (Ubuntu 18.04+, Fedora 31+, Debian 12+, RHEL 9+) have this enabled by default. Some hardened hosting environments or older kernels may have it disabled — check with your hosting provider if Chrome fails to start with a sandbox error.

The systemd unit file must not restrict user namespaces (other namespace types are safely blocked):

# Correct — allows user namespaces for Chrome sandbox
RestrictNamespaces=~cgroup ipc net mnt pid

# WRONG — breaks Chrome sandbox
# RestrictNamespaces=true

Install Chrome

PRISM requires Chromium or Google Chrome. Install the system package:

# Debian/Ubuntu
sudo apt install chromium-browser

# RHEL/Fedora
sudo dnf install chromium

Configure

Edit /etc/prism/config.toml with your origin and settings. Place your license key at /etc/prism/license.lic.

Enable and Start

sudo systemctl daemon-reload
sudo systemctl enable prism
sudo systemctl start prism

Check Status

sudo systemctl status prism
sudo journalctl -u prism -f

Security Hardening Explained

Directive	Purpose
NoNewPrivileges=true	Prevents privilege escalation via setuid binaries
ProtectSystem=strict	Mounts the filesystem read-only except explicitly allowed paths
ProtectHome=true	Makes /home, /root, /run/user inaccessible
PrivateTmp=true	Isolates /tmp and /var/tmp
ProtectKernelTunables=true	Denies write access to /proc and /sys kernel tunables
ProtectKernelModules=true	Prevents loading kernel modules
RestrictAddressFamilies	Only allows IPv4, IPv6, and Unix sockets
RestrictNamespaces=~cgroup ipc net mnt pid	Blocks all namespace types except user (required by Chrome sandbox)
LockPersonality=true	Locks the execution domain
MemoryMax=2G	Hard memory limit -- OOM-killed if exceeded
TasksMax=512	Limits the number of threads/processes

Log Management

PRISM logs to stdout/stderr, which systemd captures in the journal. For JSON-structured logging:

[logging]
format = "json"
level = "info"

To forward logs to a file:

sudo journalctl -u prism -o cat >> /var/log/prism/prism.log

Or configure journald forwarding to syslog/rsyslog for centralized log management.