{"id":"0173894a-4297-4f77-99ae-e8f5a3fac9d8","task":"Isolate a service in a private filesystem namespace with RootDirectory/MountAPIVFS/PrivateDevices instead of trusting host paths","domain":"systemd","steps":["Choose a base dir containing the service's files, e.g. /srv/app (must hold the binary and its minimal libs, or use a distro/chroot-style tree)","Add RootDirectory=/srv/app to the [Service] section so the service runs with pivot_root() into that directory as its new root","Add MountAPIVFS=yes so /proc, /sys, /dev, /run are mounted into the private namespace with defaults","Add PrivateDevices=yes and PrivateTmp=yes to further restrict what the namespace exposes; consider ProtectSystem=strict for read-only root","If the base dir is a partition or filesystem image, use RootImage=/path/to/image.ext4 or .raw instead of RootDirectory","Re-run systemctl daemon-reload, restart the unit, and verify the service cannot see host files outside the new root (ls / inside the service process)","Combine with BindReadOnlyPaths= to hand the service read-only copies of specific host files it must see"],"gotchas":["RootDirectory= only works for system services (root) and, when set, hard-coded host paths in the binary will be relative to the new root - the payload must be self-contained or you get 'No such file'","MountAPIVFS=yes must be set together with RootDirectory= or the new root has no /proc making many binaries and systemd features hang","DynamicUser=yes and RootDirectory= both change the namespace; using PrivateUsers=yes with RootDirectory= adds an extra user-namespace layer and requires unprivileged userns support (kernel.unprivileged_userns_clone)","Per-user instances disable mount option overrides by default for security (polkit may be required to allow specific mount options)","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:27:35.967Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:27:35.967Z"},"url":"https://mcp.waymark.network/r/0173894a-4297-4f77-99ae-e8f5a3fac9d8"}