[noinsight]

You can already sandbox services very effectively when you run them under systemd.

It’s really nice to be able to harden things solely through systemd.