carlos / platform Public

Download this file

1	# The protected view of the instance data tree (isolated-exec design §3.2).
2	#
3	# /data/.instances is the RAW directory, opened by the layout pass only;
4	# this bind of it onto /data/instances is the view everything else uses.
5	# nosymfollow is the isolation's belt: path resolution under this mount
6	# returns ELOOP at any symlink, for every process on the box, in every
7	# namespace that sees the mount, with no check-then-use race. An instance
8	# runs as the agent's uid and can write its own directory, so any symlink
9	# it plants would otherwise be followed by the agent (reading a sibling's
10	# env file as this instance's), by the edge (dialling a sibling's socket
11	# as this host) and by PID 1. Here none of them follow it.
12	#
13	# It is a bind of a DIFFERENT directory, not of itself, because rename(2)
14	# refuses to cross a mount boundary (EXDEV) even on one filesystem, and
15	# the migration moves /data/<host>.db into this tree by rename (codex R4-2).
16	#
17	# DefaultDependencies=no, with the ordering written out: a mount unit's
18	# default place is before local-fs.target, and systemd-tmpfiles-setup,
19	# which creates the two directories, runs after it, so the defaults form a
20	# cycle systemd breaks by dropping this mount (codex R2-2). Shutdown
21	# ordering is written out for the same reason.
22	[Unit]
23	Description=carlos instance data (bind, nosymfollow)
24	DefaultDependencies=no
25	RequiresMountsFor=/data
26	After=local-fs.target systemd-tmpfiles-setup.service
27	Before=carlos-edge.service carlos-instance-control.service carlos-litestream.service
28	Conflicts=umount.target
29	Before=umount.target
30
31	[Mount]
32	What=/data/.instances
33	Where=/data/instances
34	Type=none
35	Options=bind,nosymfollow,nosuid,nodev,noexec
36
37	[Install]
38	WantedBy=multi-user.target
39