I am happily running systemd inside a docker container, however, it requires CAP_SYS_ADMIN in order to dynamically create private tmp mounts.
I have attempted to disable the PrivateTmp, PrivateNetwork and PrivateDevices - but to no avail, when I startup the container I see:
Failed to mount tmpfs at /run: Operation not permitted
However, nowhere in /usr or /etc is there a service with PrivateTmp=yes (and others). Basing on: https://bugzilla.redhat.com/show_bug.cgi?id=1033604#c14 - I thought these would be all that causes systemd to dynamically create a mount - but there must be more. Any advice appreciated.