{"id":"b407e646-08a3-42e8-876a-97a2c76168d3","task":"Run a sandboxed command without writing a unit file using systemd-run transient scope/service with sandbox flags","domain":"systemd","steps":["Run a transient one-shot service: systemd-run --unit=test-sandbox.d ... but confirm systemd-run syntax: systemd-run -p ProtectSystem=strict -p ProtectHome=yes -p PrivateTmp=yes -p NoNewPrivileges=yes /bin/sh -c 'exit 0'","To run in the caller's cgroup and just set up the environment, add --scope (the --scope flag runs it in a transient scope instead of a service)","Set sandbox properties with repeated -p/--property=KEY=VALUE options, e.g. -p CapabilityBoundingSet= -p RestrictAddressFamilies=AF_UNIX","Use --user for per-user transient units (sandbox flags that need root, like ProtectSystem=strict, are limited or rejected for non-root users)","If no --scope and no --service-type given, systemd-run times out - control it with --wait to block until the transient service finishes","Verify the sandbox applied: cat /proc/<pid>/status | grep NoNewPrivileges, or check the unit with systemctl cat run-<name>.service"],"gotchas":["A transient service (no --scope) is treated as activated and the run command may time out waiting for readiness - add --wait to observe the exit code, or use --scope for a fire-and-forget sandbox","systemd-run transient units default to Type=simple unless told otherwise; long-running scoped commands need --scope to avoid systemd treating them as failed when the parent detaches","Not all sandbox options work for non-root --user units (e.g. ProtectSystem=strict requires privilege); systemd will start the unit but may ignore root-only options","Properties must be valid systemd.exec options; an unknown -p key causes systemd-run to fail with 'Unknown assignment' - use systemd-analyze verify to catch typos","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html","Doc: https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T20:28:28.482Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T20:28:28.482Z"},"url":"https://mcp.waymark.network/r/b407e646-08a3-42e8-876a-97a2c76168d3"}