run tasks as separate cgroup via systemd

this allows us to adjust the nice value and memory settings per task

part of #691

src/scripts/starttask.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+set -eu -o pipefail
+
+if [[ ${EUID} -ne 0 ]]; then
+    echo "This script should be run as root." > /dev/stderr
+    exit 1
+fi
+
+if [[ $# -eq 0 ]]; then
+    echo "No arguments supplied"
+    exit 1
+fi
+
+if [[ "$1" == "--check" ]]; then
+    echo "OK"
+    exit 0
+fi
+
+readonly task_id="$1"
+readonly logfile="$2"
+readonly nice="$3"
+
+readonly id=$(id -u yellowtent)
+readonly service_name="cloudron-task-${task_id}"
+
+systemctl reset-failed "${service_name}" || true
+
+# keep the env vars in sync with box.service
+systemd-run --unit "${service_name}" \
+    -p BindsTo=box.service \
+    --pipe \
+    --wait \
+    --property=OOMScoreAdjust=-1000 \
+    --nice "${nice}" \
+    --uid=${id} \
+    --gid=${id} \
+    -E HOME=/home/yellowtent \
+    -E USER=yellowtent \
+    -E DEBUG=box:* \
+    -E BOX_ENV=cloudron \
+    -E NODE_ENV=production \
+    /home/yellowtent/box/src/taskworker.js "${task_id}" "${logfile}"
+