#!/bin/sh
set -eu
test "$(id -u)" -eq 0
test "$(systemctl is-active user@1200.service || true)" = inactive
systemd-run --wait --pipe --collect --unit=le-app-codex-inert-test \
  --uid=1200 --gid=1200 \
  --setenv=DOCKER_HOST=unix:///run/user/1200/docker.sock \
  --property=NetworkNamespacePath=/run/netns/le-app-codex \
  --property=ProtectSystem=strict --property=PrivateTmp=yes \
  --property=ProtectHome=yes --property=ProtectProc=invisible \
  --property=TemporaryFileSystem=/srv:ro \
  --property=BindPaths=/srv/le-app-codex:/srv/le-app-codex \
  --property=TemporaryFileSystem=/var:ro \
  --property=TemporaryFileSystem=/mnt:ro \
  --property=TemporaryFileSystem=/media:ro \
  --property=TemporaryFileSystem=/opt:ro \
  --property=DevicePolicy=closed --property='DeviceAllow=/dev/fuse rw' \
  --property='DeviceAllow=/dev/net/tun rw' \
  /srv/le-app-codex/phase2b-tests/10-inert-containment.sh