[Unit]
Description=HoloLake Code Channel isolated JD candidate
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=guanghu
Group=guanghu
UMask=0077
StateDirectory=guanghu/personas/guanghu/hlcc-v16.0.1
ExecStart=/usr/bin/python3 __RELEASE_ROOT__/server-tools/hololake-code-channel/jd-candidate/hlcc-bootstrap.py
Restart=always
RestartSec=5
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictSUIDSGID=true
LockPersonality=true
ReadOnlyPaths=__RELEASE_ROOT__
ReadWritePaths=/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1

[Install]
WantedBy=multi-user.target