[Unit]
Description=Root-owned IPv4-only namespace for le_app_codex
Before=user@1200.service
ConditionPathExists=/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/libexec/le-app-codex-netns up
ExecStop=/usr/local/libexec/le-app-codex-netns down