From b1c77f9bf29e42949988daaf58ac2114579e7a83 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 5 Dec 2022 15:45:33 +0200 Subject: [PATCH] Add comment to matrix-backup-borg.service Related to 8005557061c0e795be334 --- .../templates/systemd/matrix-backup-borg.service.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2 b/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2 index 760fd5749..900369b9d 100644 --- a/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2 +++ b/roles/custom/matrix-backup-borg/templates/systemd/matrix-backup-borg.service.j2 @@ -36,6 +36,9 @@ ExecStartPre=-{{ devture_systemd_docker_base_host_command_docker }} run --rm --n # The `CAP_DAC_OVERRIDE` capability is required, so that `root` in the container # can read the `/etc/borgmatic.d/config.yaml` (`{{ matrix_backup_borg_config_path }}/config.yaml`) file, # owned by `matrix:matrix` on the filesystem. +# +# `/root` is mountes as temporary filesystem, because we're using `--read-only` and because +# Borgmatic tries to write to at least a few paths under `/root` (`.config`, `.ssh`, `.borgmatic`). ExecStart={{ devture_systemd_docker_base_host_command_docker }} run --rm --name matrix-backup-borg \ --log-driver=none \ --cap-drop=ALL \