···3434 // Build systemd-run command with security properties
3535 // Using service unit (not scope) to get access to network/filesystem isolation
3636 systemdArgs := []string{
3737+ "--wait", // Wait for service to complete
3738 "--unit=" + name, // Give it a descriptive name
3839 "--quiet", // Suppress systemd output
3940 "--collect", // Automatically clean up after exit