The value full-apivfs (the default) sets up private /dev, /proc, /sys, /tmp and /var/tmp file systems in a separate user name space.
If this is set to chroot-only, only the file system name space is set up along with the call to chroot(2).
In all cases, unless serviceConfig.PrivateTmp=true is set, both /tmp and /var/tmp paths are added to InaccessiblePaths=. This is to overcome options like DynamicUser=true implying PrivateTmp=true without letting it being turned off. Beware however that giving processes the CAP_SYS_ADMIN and @mount privileges can let them undo the effects of InaccessiblePaths=.
This doesn't cover network namespaces and is solely for file system level isolation.
Declarations
Type
one of "full-apivfs", "chroot-only"Default
"full-apivfs"