systemd

Send systemd service stdout/stderr to a log file with StandardOutput=append and log rotation caveats

Understand systemctl disable vs mask vs stop, and fix 'Unit is masked' errors

Diagnose systemd boot delays and unit ordering with systemd-analyze (blame, critical-chain, verify)

Schedule one-off or periodic jobs without unit files using systemd-run transient timers

Make a systemd service shut down gracefully (ExecStop, TimeoutStopSec, KillMode, KillSignal)

Query and manage systemd journal logs with journalctl (filters, JSON output, disk cleanup)

Run one-time setup tasks with systemd Type=oneshot, RemainAfterExit and ExecStartPre

Trigger a systemd service when a file or directory changes using a .path unit

Set environment variables for a systemd service correctly (Environment, EnvironmentFile, quoting gotchas)

Run multiple parameterized instances of one systemd template unit (name@.service, %i vs %I)

Spawn one systemd service instance per connection with Accept=yes and a template unit (inetd style)

Make a systemd service start on demand via socket activation (Accept=no, sd_listen_fds)

Cap CPU, memory and task count of a systemd service with cgroup v2 resource controls

Start a systemd service only after the network is actually up (network-online.target)

Signal service readiness and enable the watchdog with Type=notify and WatchdogSec

Fix a systemd service stuck in start-limit-hit ('Start request repeated too quickly')

Run a systemd service as an ephemeral unprivileged user with DynamicUser and StateDirectory

Override a vendor systemd unit safely with a drop-in instead of editing the packaged file

Debug why a systemd service fails to start using systemctl status and journalctl

Run an untrusted command with systemd's per-call sandbox (systemd-run --scope) with no persistence and immediate teardown

Provide a service writable ephemeral dirs while keeping the rest of the filesystem read-only (ProtectSystem=strict + ReadWritePaths/StateDirectory)

Run a systemd service with MemoryDenyWriteExecute and RestrictRealtime to harden against JIT/exploit primitives

Audit and harden a service's systemd sandbox with systemd-analyze security and close the top exposures

Make systemd hide other users' processes and kernel internals with ProtectProc=invisible and ProtectKernelTunables

Restrict a systemd service's network surface with RestrictAddressFamilies and IPAddressDeny

Apply seccomp syscall filtering to a systemd service with SystemCallFilter and SystemCallArchitectures to reduce kernel attack surface

Strip privileged capabilities from a systemd service using CapabilityBoundingSet and AmbientCapabilities

Isolate a service in a private filesystem namespace with RootDirectory/MountAPIVFS/PrivateDevices instead of trusting host paths

Run a sandboxed command without writing a unit file using systemd-run transient scope/service with sandbox flags

Apply the full systemd sandboxing profile to a long-running service (ProtectSystem, ProtectHome, NoNewPrivileges, PrivateTmp) so it cannot modify host files or require root

Strip privileged capabilities from a systemd service using CapabilityBoundingSet and AmbientCapabilities

Isolate a service in a private filesystem namespace with RootDirectory/MountAPIVFS/PrivateDevices instead of trusting host paths

Run a sandboxed command without writing a unit file using systemd-run transient scope/service with sandbox flags

Apply the full systemd sandboxing profile to a long-running service (ProtectSystem, ProtectHome, NoNewPrivileges, PrivateTmp) so it cannot modify host files or require root