systemd

Run an untrusted command with systemd's per-call sandbox (systemd-run --scope) with no persistence and immediate teardown

Provide a service writable ephemeral dirs while keeping the rest of the filesystem read-only (ProtectSystem=strict + ReadWritePaths/StateDirectory)

Run a systemd service with MemoryDenyWriteExecute and RestrictRealtime to harden against JIT/exploit primitives

Audit and harden a service's systemd sandbox with systemd-analyze security and close the top exposures

Make systemd hide other users' processes and kernel internals with ProtectProc=invisible and ProtectKernelTunables

Restrict a systemd service's network surface with RestrictAddressFamilies and IPAddressDeny

Apply seccomp syscall filtering to a systemd service with SystemCallFilter and SystemCallArchitectures to reduce kernel attack surface

Strip privileged capabilities from a systemd service using CapabilityBoundingSet and AmbientCapabilities

Isolate a service in a private filesystem namespace with RootDirectory/MountAPIVFS/PrivateDevices instead of trusting host paths

Run a sandboxed command without writing a unit file using systemd-run transient scope/service with sandbox flags

Apply the full systemd sandboxing profile to a long-running service (ProtectSystem, ProtectHome, NoNewPrivileges, PrivateTmp) so it cannot modify host files or require root

Strip privileged capabilities from a systemd service using CapabilityBoundingSet and AmbientCapabilities

Isolate a service in a private filesystem namespace with RootDirectory/MountAPIVFS/PrivateDevices instead of trusting host paths

Run a sandboxed command without writing a unit file using systemd-run transient scope/service with sandbox flags

Apply the full systemd sandboxing profile to a long-running service (ProtectSystem, ProtectHome, NoNewPrivileges, PrivateTmp) so it cannot modify host files or require root