diff options
Diffstat (limited to 'docs/PORTABLE_SERVICES.md')
| -rw-r--r-- | docs/PORTABLE_SERVICES.md | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/docs/PORTABLE_SERVICES.md b/docs/PORTABLE_SERVICES.md index f639f6aa8b..b12e7754e7 100644 --- a/docs/PORTABLE_SERVICES.md +++ b/docs/PORTABLE_SERVICES.md @@ -303,7 +303,7 @@ Docker would do it, as these are regular system services they aren't run as PID If services shipped with this mechanism shall be able to access host resources (such as files or AF_UNIX sockets for IPC), use the normal `BindPaths=` and -`BindReadOnlyPaths=` settings in unit files to mount them in. In fact the +`BindReadOnlyPaths=` settings in unit files to mount them in. In fact, the `default` profile mentioned above makes use of this to ensure `/etc/resolv.conf`, the D-Bus system bus socket or write access to the logging subsystem are available to the service. @@ -329,7 +329,7 @@ units shipped with the OS itself as for attached portable services. ## Immutable images with local data It's a good idea to keep portable service images read-only during normal -operation. In fact all but the `trusted` profile will default to this kind of +operation. In fact, all but the `trusted` profile will default to this kind of behaviour, by setting the `ProtectSystem=strict` option. In this case writable service data may be placed on the host file system. Use `StateDirectory=` in the unit files to enable such behaviour and add a local data directory to the |