Download this file
| 1 | # The root instance-control channel's socket (isolated-exec design §5.2). |
| 2 | # In /run/carlos-control, a root-owned directory beside /run/carlos, never |
| 3 | # under it: an instance's namespace replaces /run/carlos with an empty |
| 4 | # tmpfs, and nothing an instance can reach must resolve to this path. Owned |
| 5 | # by carlos so the agent can connect; the service authenticates the peer |
| 6 | # process itself (§5.4). |
| 7 | [Unit] |
| 8 | Description=carlos instance control socket (agent to root) |
| 9 | |
| 10 | [Socket] |
| 11 | ListenStream=/run/carlos-control/control.sock |
| 12 | SocketUser=carlos |
| 13 | SocketGroup=carlos |
| 14 | SocketMode=0600 |
| 15 | Accept=no |
| 16 | |
| 17 | [Install] |
| 18 | WantedBy=sockets.target |
| 19 | |
amadan