Snap Game Services ran several lobby instances from a systemd template. One change gave each instance a hosts file inside its own directory and mounted that file over /etc/hosts for the service.
The unit change was one line:
BindPaths=-/opt/snap-gs/%j/%i/hosts:/etc/hostsThe source path selected the lobby instance’s file. The destination was the conventional path the process already used. No application setting had to teach the game a different filename.
The leading minus made a missing source optional. Under systemd’s unit-specific bind-mount contract, the mount affected the unit’s filesystem view rather than replacing the host’s /etc/hosts globally. BindPaths made it writable; the patch did not use the read-only variant.
The installer assembled the file under a temporary name, added the host’s existing entries, then renamed the result into place before use.
This changed name resolution for software consulting that hosts file. It was not a complete network-denial policy: a program using literal addresses or another resolution path would not be governed simply by those entries.