From c49ee64b0b3220964713d5729cd77deeb6275a84 Mon Sep 17 00:00:00 2001 From: admin Date: Sun, 2 Aug 2026 09:29:07 +0000 Subject: [PATCH] revert: symlink is the reliable approach for /opt/wallarm Bind mounts and unshare namespace approaches are fragile across systemd versions. Symlink + --config-file for wcli provides adequate isolation for multi-instance. --- internal/native/native.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/internal/native/native.go b/internal/native/native.go index 4ac5617..bc67f78 100644 --- a/internal/native/native.go +++ b/internal/native/native.go @@ -163,11 +163,13 @@ After=network.target Type=simple WorkingDirectory=%s/%%i/wallarm EnvironmentFile=-%s/%%i/wallarm/env.list +# Bind mount instance directory as /opt/wallarm (isolated per instance) ExecStartPre=/bin/ln -sf %s/%%i/wallarm /opt/wallarm ExecStartPre=%s/%%i/wallarm/nginx/sbin/nginx -c %s/%%i/wallarm/nginx/conf/nginx.conf ExecStartPre=/bin/sleep 1 ExecStart=%s/%%i/wallarm/usr/bin/python3.10 %s/%%i/wallarm/usr/bin/supervisord -c %s/%%i/wallarm/etc/supervisord.conf ExecStop=%s/%%i/wallarm/usr/bin/python3.10 %s/%%i/wallarm/usr/bin/supervisord -c %s/%%i/wallarm/etc/supervisord.conf shutdown +ExecStopPost= Restart=on-failure RestartSec=5 User=root