Download this file
| 1 | # The protected view of the agent's per-role log sockets (isolated-exec |
| 2 | # design §3.2, §6.4): /run/carlos/.logs bound onto /run/carlos/logs with |
| 3 | # nosymfollow. This directory is bound into NO instance namespace; the |
| 4 | # mount option is for the transition release, in which unisolated flat |
| 5 | # tenants still share the agent's uid and could otherwise turn a log |
| 6 | # socket path into a symlink that PID 1 opens as root for some unit's |
| 7 | # stdout (codex R3-1). See data-instances.mount for the ordering. |
| 8 | [Unit] |
| 9 | Description=carlos instance log sockets (bind, nosymfollow) |
| 10 | DefaultDependencies=no |
| 11 | After=systemd-tmpfiles-setup.service |
| 12 | Before=carlos-edge.service carlos-instance-control.service |
| 13 | Conflicts=umount.target |
| 14 | Before=umount.target |
| 15 | |
| 16 | [Mount] |
| 17 | What=/run/carlos/.logs |
| 18 | Where=/run/carlos/logs |
| 19 | Type=none |
| 20 | Options=bind,nosymfollow,nosuid,nodev,noexec |
| 21 | |
| 22 | [Install] |
| 23 | WantedBy=multi-user.target |
| 24 | |
amadan