Download this file
| 1 | # The protected view of the instance socket tree (isolated-exec design |
| 2 | # §3.2): /run/carlos/.instances bound onto /run/carlos/instances with |
| 3 | # nosymfollow. See data-instances.mount for why a bind, why of a different |
| 4 | # directory, and why DefaultDependencies=no. Nothing is ever renamed into |
| 5 | # this tree, so the raw directory has no caller at all. /run is tmpfs, so |
| 6 | # the two directories come from the tmpfiles line every boot, which is why |
| 7 | # this is ordered after systemd-tmpfiles-setup.service. |
| 8 | [Unit] |
| 9 | Description=carlos instance sockets (bind, nosymfollow) |
| 10 | DefaultDependencies=no |
| 11 | After=systemd-tmpfiles-setup.service |
| 12 | Before=carlos-edge.service carlos-instance-control.service |
| 13 | Conflicts=umount.target |
| 14 | Before=umount.target |
| 15 | |
| 16 | [Mount] |
| 17 | What=/run/carlos/.instances |
| 18 | Where=/run/carlos/instances |
| 19 | Type=none |
| 20 | Options=bind,nosymfollow,nosuid,nodev,noexec |
| 21 | |
| 22 | [Install] |
| 23 | WantedBy=multi-user.target |
| 24 | |
amadan