Run a systemd service as an ephemeral unprivileged user with DynamicUser and StateDirectory

Documented steps

1. Use DynamicUser=yes to have systemd allocate a UID/GID from the 61184-65519 range at start and release it at stop — no useradd, no leftover account: [Service] DynamicUser=yes ExecStart=/usr/local/bin/myapp
2. Give the service persistent writable storage with StateDirectory=myapp — systemd creates /var/lib/myapp (actually a symlink to /var/lib/private/myapp under DynamicUser) owned by the ephemeral user, and sets $STATE_DIRECTORY in the environment.
3. Add CacheDirectory=myapp, LogsDirectory=myapp, RuntimeDirectory=myapp the same way for /var/cache, /var/log and /run paths; corresponding env vars are $CACHE_DIRECTORY, $LOGS_DIRECTORY, $RUNTIME_DIRECTORY.
4. Point the app at those env vars instead of hard-coded paths, e.g. ExecStart=/usr/local/bin/myapp --data-dir=${STATE_DIRECTORY}.
5. DynamicUser implies ProtectSystem=strict, ProtectHome=read-only, PrivateTmp=yes, RemoveIPC=yes and NoNewPrivileges=yes, so the filesystem is read-only except the granted directories.
6. Start and verify: `systemctl start myapp && ps -o user:16,cmd -C myapp` shows a user like `myapp` or a numeric dynamic UID; after stop the UID is gone from /etc/passwd lookups (it was never there — it is synthesized via NSS).