ADR 0001: systemd Transient Units for Production Workloads

Decision

MicroFly uses a Runner abstraction. Production Linux deployments select a systemd transient-service backend; a direct subprocess backend exists only for non-root development and explicit integration testing.

Rationale

Supported Debian hosts already provide systemd. Transient units enforce identities, cgroups, capabilities, filesystem visibility, syscall/address-family filters, timeouts, and process-group lifecycle without embedding an OCI runtime. Release commands, web processes, and cron jobs all receive the same immutable ProcessSpec.

Consequences

Production requires a running systemd manager and systemd-run. A root daemon refuses direct execution unless allow_insecure_runner=true. OCI portability and complete network-namespace isolation are deferred; the shared-network residual risk is documented in THREAT_MODEL.md.