# Installed by setup.sh --encrypt-docker into
# /etc/systemd/system/docker.service.d/whp-luks-mount-required.conf
#
# Forces docker.service to wait for /docker to be a real mount before
# starting. Without this, if the LUKS volume isn't unlocked at boot,
# Docker would happily start with its data-root on the host root fs
# and silently scribble customer data into the wrong place.
#
# Pairs with `noauto` in /etc/crypttab + /etc/fstab — docker.service
# stays inactive until the unlock helper mounts /docker explicitly.

[Unit]
RequiresMountsFor=/docker
