#!/bin/sh
exec 2>&1
_user=_sing_box
! [ -d /run/sing-box ] && install -m 700 -g $_user -o $_user -d /run/sing-box
_caps='-all,+net_admin,+net_raw,+net_bind_service,+sys_ptrace,+dac_read_search'

exec setpriv --reuid $_user --regid $_user --clear-groups \
	--ambient-caps $_caps \
	--inh-caps $_caps \
	--bounding-set $_caps \
	--no-new-privs -- sing-box -D /var/lib/sing-box -C /etc/sing-box run
