Apply systemd sandboxing by default to some services

Yeah. The original systemd unit file has certainly room for improvement.

Maybe it could/should even run under a limited user account kloak.

If you want to do that too…

Btw please consider Port to sysusers.d mechanism?

1 Like