Bind isolated test checkout read-only inside private tmp namespace

2026-10-08 14:35:53 -04:00
parent 7fe6335583
commit 1b0b119a09
1 changed files with 1 additions and 0 deletions
@@ -42,6 +42,7 @@ PY
 unit="archy-isolated-tests-$(date +%s)-$$"
 sudo -n systemd-run --unit="$unit" --wait --pipe --collect \
  --property="WorkingDirectory=$REPO/core" \
+  --property="BindReadOnlyPaths=$REPO" \
  --property=PrivateNetwork=yes --property=PrivateTmp=yes --property=PrivateDevices=yes \
  --property=ProtectSystem=strict --property=ProtectHome=read-only \
  --property=NoNewPrivileges=yes \