Lesson 3 of 9 · 25m

Sandboxing a service with systemd directives

DynamicUser, ProtectSystem, CapabilityBoundingSet — shrink a daemon's blast radius with a few lines of INI.