Lennart Poettering

> ### > > Why not nspawn: > > 1. nspawn is opinionated (for good reason) on container setup. Twine containers have a variety of settings that are needed for...

idea sounds good. We have been doing something similar for other PrivateXYZ= and ProectXYZ= knobs. I'd probably find a different name for `private-read-only` though. Maybe `strict` or so?

did some more reviews, but earlier issues still remain hence didn't finish it. please address the issues already pointed out first. also, please split this up into multiple commits. i.e....

So let me get this straight. If a client queries `A api.example1.com` it gets CNAME back, and if it queries `AAAA api.example1.com` then it gets an AAAA back? That is...

I am not sure I follow? timeouts and watchdog events are hardly "expected" failures? I am really irritated by your choice of words? Typically, those are the unexpected failures, while...

frankly, we use the reverse naming. Expected errors are cleanly reported via exit status. Unexpected errors are those which are "uncleanly" reported, i.e. crashes, timeouts and such.

> The problem is that legitimate service exits (e.g. program crashes) I find you terminology really strange. Crashes (i.e. segfaults, unclean errors) are the "illigimate" ways to fail, and clean...

anyway, can you reword your request without using the words "legitimate"/"illigitimate" or "expected"/"unexpected". Just say which specific service failure reasons you'd want to reported on which log levels, and on...

I really don't grok what the issue here is now, this is just too confusing. Are you aware of SuccessExitStatus=, RestartPreventExitStatus=, RestartForceExitStatus= though? I kinda sense this is what you...

the stacktrace only lists one thread. there must be another that hangs in some form of fsync()... so my educated guess is that you have some IO scheduling issue (i.e....