On Thu, Mar 3, 2022 at 8:24 AM Lennart Poettering <mzerqung@0pointer.de> wrote:

badly. One good example for that is crond: you never know what cron
jobs intend to do, hence you cannot sandbox crond as a whole
reasonably. Moreover, runtime matters: short-lived stuff is much less


I've also run into another complication with sandboxed units: using the 'normal' override processes to, for example, add one or two ExecStartPre commands to a service means that those commands will *also* be run in the sandboxed environment. The solution of course is to put those into their own service unit and setup proper dependencies so that they will be run at the proper time, but it can definitely surprise the user (it certainly surprised me).