IntermediateCI/CD & Automation
Production systemd Unit File: Sandboxing & Auto-Restart
Learn how to wrap custom binaries in systemd services that restrict filesystem access, drop root privileges, and ensure high availability.
systemdLinux
Prerequisites
- Linux OS with systemd init
Configuration Files
myapp.service/etc/systemd/system/myapp.service
[Unit]\nDescription=My Secure App\nAfter=network.target\n\n[Service]\nExecStart=/usr/bin/myapp\nRestart=always\nRestartSec=3\nUser=appuser\nProtectSystem=strict\nProtectHome=yes\nPrivateTmp=yes\nNoNewPrivileges=yes\n\n[Install]\nWantedBy=multi-user.targetExplanation:Runs the app as a non-root user, prevents writing to the system, and automatically restarts on failure.
Verification Steps
1
Reloads systemd daemon and checks service status.
$systemctl daemon-reload && systemctl status myapp
Expected OutputActive: active (running)
Production Gotchas
- ProtectSystem=strict makes the entire filesystem read-only. Use ReadWritePaths= to whitelist specific directories needed by the app.
Frequently Asked Questions
What does NoNewPrivileges do?
It prevents the process and its children from gaining new privileges via setuid/setgid binaries.