fix(indeehub): run maintenance controller in retained user scope

2026-10-07 19:53:07 -04:00
parent c47d9d7c14
commit 01a55d2de7
2 changed files with 37 additions and 1 deletions
@@ -82,8 +82,13 @@ impl LegacyIndeeMaintenance {
        // lock. This task and the child retain the same flock open description.
        tokio::spawn(async move {
            let fd = lock.as_raw_fd();
-            let mut command = tokio::process::Command::new("/usr/bin/python3");
+            // The manager's ProtectSystem=strict mount namespace prevents rootless
+            // Podman exec from entering retained user-unit cgroups. A user scope
+            // executes the controller in that unit context while preserving pipes
+            // and the inherited flock open description (unlike a detached service).
+            let mut command = tokio::process::Command::new("/usr/bin/systemd-run");
            command
+                .args(["--user", "--scope", "--quiet", "--collect", "--", "/usr/bin/python3"])
                .arg(path)
                .arg(action)
                .env("ARCHY_UPDATE_LOCK_FD", fd.to_string())