influxdb3-core fails to start on Rocky Linux 9/10 - systemd InaccessiblePaths causes NAMESPACE error Labels: bug, systemd, rhel

Description
The influxdb3-core service fails to start on Rocky Linux 9 and 10 (and likely AlmaLinux/RHEL) due to a systemd mount namespace permission error. The service crashes immediately with exit code 226/NAMESPACE.
Environment
Affected Systems:
Rocky Linux 9.x (systemd 252)
Rocky Linux 10.x (systemd 257)
Likely affects: AlmaLinux, RHEL 9/10
Unaffected Systems:
Debian 12, Debian 13
Ubuntu 24.04
Package:
influxdb3-core (latest from InfluxData repository)
Symptoms
Service fails to start with repeated crash-loop attempts:
● influxdb3-core.service - InfluxDB 3 Core
Active: failed (Result: exit-code)

influxdb3-core.service: Failed at step NAMESPACE spawning /usr/lib/influxdb3/python/bin/python3: Permission denied
influxdb3-core.service: Main process exited, code=exited, status=226/NAMESPACE
Full journal output:
Apr 02 20:52:37 uut-vm (python3)[61188]: Failed to mount /run/systemd/inaccessible/sock to /run/systemd/mount-rootfs/run/dbus/system_bus_socket: Permission denied
Apr 02 20:52:37 uut-vm (python3)[61188]: influxdb3-core.service: Failed to set up mount namespacing: /run/dbus/system_bus_socket: Permission denied
Apr 02 20:52:37 uut-vm (python3)[61188]: influxdb3-core.service: Failed at step NAMESPACE spawning /usr/lib/influxdb3/python/bin/python3: Permission denied
Root Cause
The systemd unit file includes security hardening via InaccessiblePaths:
InaccessiblePaths=-/run/avahi-daemon -/run/cups -/run/snapd.socket -/run/dbus/system_bus_socket
InaccessiblePaths=-/tmp/.X11-unix -/tmp/.XIM-unix -/tmp/.ICE-unix -/tmp/.font-unix -/run/user
The /run/dbus/system_bus_socket directive causes systemd on RHEL-based distributions to fail when attempting mount namespace isolation. This appears to be a systemd behavior difference between Debian/Ubuntu and RHEL-based distributions.
Rocky 9 (systemd 252): Fails with any InaccessiblePaths entries
Rocky 10 (systemd 257): Fails even when only removing the dbus socket
SELinux is not the cause (confirmed via ausearch - no AVC denials)
Workaround
Create a systemd override to remove InaccessiblePaths:
sudo mkdir -p /etc/systemd/system/influxdb3-core.service.d
sudo tee /etc/systemd/system/influxdb3-core.service.d/rocky-fix.conf <<'EOF'
[Service]
# Completely override InaccessiblePaths to fix Rocky 9/10 mount namespace issue
# Rocky 9 (systemd 252) and Rocky 10 (systemd 257) both fail with dbus socket
# Removing ALL InaccessiblePaths to prevent "Permission denied" errors
InaccessiblePaths=
EOF

sudo systemctl daemon-reload
sudo systemctl restart influxdb3-core
Security note: This removes filesystem socket isolation but preserves all other hardening (NoNewPrivileges, PrivateDevices, ProtectHome, ProtectSystem=strict, RestrictNamespaces, SystemCallFilter, etc.).
Proposed Fix
The influxdb3-core RPM package should ship with a RHEL-specific override that pre-emptively clears InaccessiblePaths on RHEL-based systems. Option 1: Include /usr/lib/systemd/system/influxdb3-core.service.d/rhel.conf in the RPM:
[Service]
# Clear InaccessiblePaths for RHEL/Rocky/AlmaLinux systemd compatibility
InaccessiblePaths=
Option 2: Use conditional directives in the main unit file:
[Service]
# Only set InaccessiblePaths on Debian/Ubuntu
# Comment out for RHEL variants or use ConditionPathExists
Reproduction Steps
Install Rocky Linux 9 or 10
Add InfluxData repository and install influxdb3-core:
sudo dnf install influxdb3-core
Attempt to start the service:
sudo systemctl start influxdb3-core
Observe failure:
sudo systemctl status influxdb3-core
sudo journalctl -u influxdb3-core -n 20
Additional Context
This issue completely blocks InfluxDB3 Core deployment on RHEL-based systems, which are common in enterprise environments. The workaround is straightforward but requires manual intervention on every installation. Full technical writeup available: [influxdb3-rocky-namespace-issue.md](https://github.com/jackaltx/solti-monitoring/blob/main/docs/influxdb3-rocky-namespace-issue.md)