Restart=on-failure and SuccessAction=reboot-force causing reboots on every exit of Main PID

[Michał Rudowicz <michal.rudowicz@xxxxxx>]

Hi,

I am trying to write a .service file for an application which is supposed to
run indefinitely. The approach I have is:

 - if the application crashes (exits with a non-zero exit code), I want
   it to be restarted. This can be achieved easily using the Restart
   directive, like Restart=on-failure in the [Service] section.
 - if the application exits cleanly (with a zero exit code), I want the
   whole device to reboot (eg. because a software update was done). I've
   found the SuccessAction directive, which - after being set to reboot or
   reboot-force in the [Unit] section - seems to do what I want.

The issue I have is: when I use both SuccessAction=reboot-force and
Restart=on-failure in one .service file, the system reboots when I kill
the Main PID of the service (causing non-clean exit for testing).

If I comment out the Restart=on-failure line from the .service file, then
after kill -9 of the Main PID of the service it stays failed as expected.
No reboot is happening.
But if I uncomment that line, then the same kill -9 causes a reboot.

Is this the expected behavior?

If yes, then how should I approach this issue? What would be the preferred
way of setting up the .service file to achieve what I have described?

I am using systemd-stable 247.3 from Buildroot. I've looked through the
changelogs on github for systemd, but didn't find anything that seemed
related - did I miss something?

Thanks in advance,
Michał