● Server & Claude Code
status=226/NAMESPACE means a mount path is missing
On systemd 255.4, status=226/NAMESPACE was a mount path. ProtectSystem=strict, PrivateTmp=yes, and ProtectHome=yes are not this code. I ran ExecStart=/bin/true on 2026-10-20. /bin/true on this machine is /usr/bin/true. systemd-analyze verify exited 0 for the missing paths below. On a Type=simple unit, systemctl start also exited 0. The journal still said status=226/NAMESPACE, and it can say Started before that. ExecMainStatus=226. Result=exit-code. That status is the mount setup, not an exit code from /bin/true. The units lived under /run and were removed. The remote-control unit that was already running stayed active. I did not start it.
226 is a missing path, or a root that is not a directory
| What the unit had | verify | systemctl start | Result |
|---|---|---|---|
BindPaths= set to an absolute path that was not on the machine. Type=simple. | Exit 0. No output. | Exit 0. No output. | Started, then Failed to set up mount namespacing and that path, No such file or directory, then status=226/NAMESPACE. |
BindReadOnlyPaths= set to a missing absolute path. | Exit 0. | Exit 0. | Same status. The journal named that path. |
ReadWritePaths= set to a missing absolute path. No ProtectSystem=. | Exit 0. | Exit 0. | Same status. ProtectSystem=strict was not required. |
ProtectSystem=strict and the same missing ReadWritePaths=. | Exit 0. | Exit 0. | Same status. |
BindPaths= set to /tmp and a second absolute path that was not there. | Exit 0. | Exit 0. | status=226/NAMESPACE. The journal named the missing path, not /tmp. |
RootDirectory= set to an absolute path that was not there. | Exit 0. | Exit 0. | Failed to set up mount namespacing: No such file or directory, then status=226/NAMESPACE. |
RootDirectory=/bin/true. | Exit 0. | Exit 0. | Failed to open root file system: Not a directory, then Failed to set up mount namespacing: /dev: Not a directory, then status=226/NAMESPACE. |
RootImage= set to an absolute path that was not there. | Exit 0. | Exit 0. | Failed to set up mount namespacing: No such file or directory, then status=226/NAMESPACE. |
Type=oneshot and a missing BindPaths=. | Exit 0. | Exit 1. The shell said the control process exited with an error code. | status=226/NAMESPACE. |
ExtensionDirectories=/tmp. Also ExtensionDirectories=/usr. Also a leading - and a path that was not there. | Exit 0. | Exit 0. | Failed to set up mount namespacing: /run/systemd/unit-extensions/0: No such file or directory, then status=226/NAMESPACE. The journal did not name the path in the unit. /tmp and /usr both exist. |
BindPaths=/tmp, BindPaths=/bin/true, and BindReadOnlyPaths=/bin/true started. ReadWritePaths=/tmp and ReadWritePaths=/bin/true, each with ProtectSystem=strict, started. A file that exists is not a 226. User=nobody and BindPaths=/root also started. verify printed Special user nobody configured, this is not safe! The warning is not the failure.
A leading hyphen is not one rule
| What the unit had | verify | Start |
|---|---|---|
BindPaths=- plus a missing absolute path. The same prefix on BindReadOnlyPaths=. The same prefix on ReadWritePaths= with ProtectSystem=strict. | Exit 0. | Deactivated successfully. |
BindPaths= set to a relative path. | Exit 0. BindPaths= path is not absolute, ignoring. | The unit started. The relative path was not a fatal error, and it was not mounted. |
RootDirectory=- plus a missing absolute path. | Exit 1. RootDirectory= path is not absolute. Unit configuration has fatal error, unit will not be started. | systemctl start exited 1. Result=success, ExecMainStatus=0. Not 226. |
RootImage=- plus a missing absolute path. | Exit 1. RootImage= path is not absolute. The same fatal-error sentence. | The start command exited 1. Not 226. |
TemporaryFileSystem= set to a missing path. Also TemporaryFileSystem=/var:ro. | Exit 0. | The unit started. A missing path here is not 226. |
JoinsNamespaceOf= set to a unit that was not loaded also started. verify exited 0. That line was not 226.
209, 222, 243, and 203 are not a mount
| What the unit had | verify | Start |
|---|---|---|
StandardOutput=append, file, or truncate, and the parent directory was not there. Type=simple. | Exit 0. | Failed to set up standard output: No such file or directory, then status=209/STDOUT. systemctl start exited 0. The journal also said Started. |
Type=oneshot and the same missing stdout directory. | Exit 0. | systemctl start exited 1. status=209/STDOUT. |
StandardOutput=append to a new file in a directory that exists. | Exit 0. | The unit started. A missing file is not 209 when the parent directory is there. |
StandardOutput=append:- plus a missing path. | Exit 0. StandardOutput= path is not absolute. | The unit started. |
StandardError=append and the parent directory was not there. | Exit 0. | Failed to set up standard error output: No such file or directory, then status=222/STDERR. systemctl start exited 0. This is not 209. |
LoadCredential= set to an absolute file that was not there. Type=simple. | Exit 0. | Failed to set up credentials: Protocol error, then status=243/CREDENTIALS. The journal did not say No such file. systemctl start exited 0. |
Type=oneshot and the same missing credential file. | Exit 0. | systemctl start exited 1. status=243/CREDENTIALS. The same Protocol error sentence. |
LoadCredential= pointed at a regular file that exists. | Exit 0. | Deactivated successfully. |
LoadCredential= with a leading - on the path. | Exit 0. Credential source was not valid, ignoring. | The unit started. |
InaccessiblePaths=/usr and ExecStart=/bin/true. Also with a leading - on /usr. | Exit 0. | Started, then status=203/EXEC. The journal did not say permission denied. Not 226. /usr exists, so the hyphen did not drop the line. |
InaccessiblePaths=/usr/bin and ExecStart=/usr/bin/true. | Exit 0. | status=203/EXEC. |
status=1/FAILURE means the program did run. That distinction is on the start-limit note. A missing binary, a missing user, a missing group, and a missing working directory are status=203/EXEC and status=216/GROUP.
What still started
These were ExecStart=/bin/true and Deactivated successfully: ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes, NoNewPrivileges=yes, PrivateDevices=yes, ProtectKernelTunables=yes, ProtectControlGroups=yes, RestrictNamespaces=yes, PrivateNetwork=yes, PrivateUsers=yes, ProtectClock=yes, ProtectHostname=yes, MemoryDenyWriteExecute=yes, DevicePolicy=closed, Delegate=yes, and ReadOnlyPaths=/. DynamicUser=yes with ProtectSystem=strict, PrivateTmp=yes, and ProtectHome=yes started. User=nobody with that sandbox, and with PrivateDevices=yes or PrivateNetwork=yes, started. StateDirectory= and RuntimeDirectory= started. Deleting ProtectSystem=strict does not fix a 226.
What the local check flags
The browser paste flags a RootDirectory= or RootImage= that is not absolute, including a leading -. It cannot see this machine. The local script can. Run it on the host that will start the unit.
It flags a missing absolute BindPaths=, BindReadOnlyPaths=, ReadWritePaths=, RootDirectory=, or RootImage= (systemd-namespace-missing). It flags a RootDirectory= that exists and is not a directory (systemd-rootdir-not-dir). It flags a RootDirectory= or RootImage= that is not absolute (systemd-root-not-absolute). It flags StandardOutput=append, file, or truncate when the parent directory is missing (systemd-stdout-missing), and the same shape on StandardError= (systemd-stderr-missing). It flags a missing absolute LoadCredential= file (systemd-credential-missing). It flags InaccessiblePaths= when that path exists and the resolved ExecStart is inside it (systemd-exec-inaccessible). That last one was 203, not 226.
It does not flag a leading - on BindPaths=, BindReadOnlyPaths=, or ReadWritePaths=. It does not flag a relative BindPaths=. It does not flag TemporaryFileSystem=. It does not flag ExtensionDirectories=, because the journal named /run/systemd/unit-extensions/0 and not the path in the unit. It does not flag a credential path with a leading -. It does not flag a log file whose parent directory exists. It does not print the path.
Once the path exists, the remote-control unit is the Agent Ops Kit ($19). The file does not create a missing mount. The same unit is on the kit page. The remote-control note is where that unit is written out.
Need a VPS to try this on? Everything here was tested on a DigitalOcean Ubuntu 24.04 droplet: get one on DigitalOcean. The DigitalOcean link pays the site owner account credit, not cash. Any other affiliate link may pay a commission. Your price is the same. Disclosure.