SandboxService: Turn off RunAtLoad for the default plugin by dcantah · Pull Request #649 · apple/container
For the default Linux runtime plugin we shouldn't have RunAtLoad on as it causes the process to be spawned the second we register it with launchd. This means that for a `container create` we'll have the runtime plugin process running afterwards. We already register a mach service for the plugin so on the first rpc it will spawn the process anyways which is plenty.