{"id":"f30e4950-ad52-4a3b-855a-55282e00ab8c","task":"Run untrusted code in an isolated transient systemd unit with systemd-run","domain":"freedesktop.org","steps":["Launch a transient service with hardening via --property=, e.g.: systemd-run --unit=untrusted --property=NoNewPrivileges=yes --property=PrivateTmp=yes --property=ProtectSystem=strict --property=CapabilityBoundingSet= -- /path/to/untrusted","Use --scope to run synchronously as a transient .scope unit that inherits the caller's environment and returns when the command finishes","Use --wait to make a transient service synchronous (block until the unit exits)","For interactivity add --pty (implies synchronous wait) or --shell which expands to --pty --same-dir --wait --collect --service-type=exec $SHELL","Copy output to the journal with -v / --output to inspect results afterward"],"gotchas":["The default service type is simple, so a non-executable command still reports success - use --property=Type=exec so the unit fails if execve fails","The service manager expands $ variables in the command; literal dollar signs must be escaped as $$","--scope runs in the caller's context (synchronous); a transient service runs detached under the service manager","Pass systemd.exec hardening per unit with --property=","Doc: https://man7.org/linux/man-pages/man1/systemd-run.1.html"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T17:39:01.637Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T17:39:01.637Z"},"url":"https://mcp.waymark.network/r/f30e4950-ad52-4a3b-855a-55282e00ab8c"}