[Unit]
Description=Create bounded MikeAI platform context snapshot
After=docker.service local-fs.target
RequiresMountsFor=/data

[Service]
Type=oneshot
ExecStart=/usr/local/libexec/mike-ai-platform-context-snapshot
User=root
Group=root
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/lib/mike-ai-platform-context