pub fn systemd_unit(plan: &InstallPlan) -> StringExpand description
Renders the systemd unit for this plan.
§Why the sandbox is this tight, and what it costs
05-infrastructure.md item 2 ends “and write its configured cache and
runtime directories — and no more”. ProtectSystem=strict plus an explicit
ReadWritePaths is what “and no more” means on Linux: everything outside the
four recorded directories is read-only to this unit.
The runner inherits it. The agent spawns the GitHub Actions runner as a
child, so a workflow running on this host also runs inside this sandbox: it
cannot write outside the four directories and its private /tmp, and
NoNewPrivileges=yes means it cannot sudo. 07-security.md assumes a
hostile workflow may run here, so that is the intended direction — but it is
a real behavioural limit and docs/service-account.md states it where an
operator will find it.