Constant JIT_CONFIG_PATH 

pub const JIT_CONFIG_PATH: &str = "/run/runnerd/jitconfig";

Where start puts the just-in-time config in the container: a root-only file, never the create request, which Docker stores and clients may log.