[Unit] Description=Apply the lve-ipc-isolation feature flag to kernel.lve_ipc_isolation # The sysctl exists once kmod-lve is loaded, and it applies to LVEs created # after it changes - so it has to be in place before every unit that creates # them at boot: the same set lve.service orders itself before, starting with # lve_namespaces.service (lvectl start). lve.service also re-applies the # persisted value right after modprobe; this run covers a flag that changed # while the server was down. After=lve.service Before=lve_namespaces.service lvectl.service cagefs.service proxyexecd.service lvestats.service db_governor.service httpd.service sshd.service crond.service mysql.service mysqld.service mariadb.service [Service] Type=oneshot ExecStart=/usr/share/cloudlinux/lve-ipc-isolation SyslogIdentifier=lve-ipc-isolation # Several flag changes in a row must not trip systemd's start rate limit: a # path unit whose service hits it stops watching for good. Spelled the way # systemd 219 (CL7) understands it; newer versions accept it as the alias of # StartLimitIntervalSec= in [Unit]. StartLimitInterval=0 [Install] WantedBy=multi-user.target