iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Use a systemd drop-in to run each daemon with the least privilege, filesystem access, device visibility, kernel access, network families and system calls it actually needs. Start with a dedicated service identity and explicit writable directories, then add read-only filesystem and namespace controls. Apply restrictions incrementally, test the service after every change, and keep a rollback path because a setting that is safe for one daemon can break another.
What systemd sandboxing protects
systemd sandboxing is a per-unit security configuration, not a single switch and not a complete replacement for a virtual machine. A service manager starts the process with selected namespaces, mounts, capabilities, address families and system-call permissions. If the daemon is compromised, those limits can prevent it from writing most of the host filesystem, reading users’ private files, loading kernel modules, changing kernel tunables, accessing arbitrary devices or opening unneeded types of sockets.
Free tools Windows power users keep installed
One-click scans. No signup required.
The boundary is matched to one unit. Two services on the same VPS can have very different policies. A network API might need IPv4, IPv6, a Unix socket and a state directory; a local queue worker might need only a Unix socket and one writable cache. Sandboxing is effective only when the policy reflects those runtime requirements.
The systemd project recommends enabling relevant protections for long-running services, especially network-facing ones, so they cannot access private user data. That is guidance, not a guarantee: some controls depend on kernel namespace support and may have no effect on a particular VPS.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Before you change a unit
Confirm the service and its execution context
- Identify the unit name, for example
example.service, and whether it is a system service or a user service. - Check the systemd version with
systemd --versionand the host kernel withuname -r. - Determine whether the VPS is a full virtual machine or an unprivileged container. A containerized VPS may not provide the namespace or mount features that systemd sandboxing expects.
- Record the service’s current user, group, listening ports, Unix sockets, helper programs, device nodes and writable paths.
Observe normal behavior
Run the application under ordinary load before tightening it. Note startup dependencies, files created during startup, files written during operation, outbound destinations, and any external program invoked by the daemon. Use systemctl status example.service, journalctl -u example.service, the application’s health endpoint and its own logs. A policy designed from an idle start often omits a path used only during rotation, upgrades or error handling.
Create a reversible drop-in
Do not edit the vendor unit in /usr/lib/systemd/system or /lib/systemd/system; package upgrades can overwrite those files. Create an administrator-owned drop-in instead:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Run
sudo systemctl edit example.service. - Place the hardening settings in the editor’s
[Service]section. - Save and exit. systemd stores the override below
/etc/systemd/system/example.service.d/. - Keep a copy of the original behavior and change one logical group of controls at a time.
After saving, reload unit files with sudo systemctl daemon-reload. Restart only during a maintenance window: sudo systemctl restart example.service. A restart is required for most execution settings to affect the process.
A practical baseline policy
The following pattern is a starting point, not a universal paste-in. Replace the account and directories with the application’s real requirements.
[Service]
User=app
Group=app
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=read-only
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
CapabilityBoundingSet=
ReadWritePaths=/var/lib/app /var/log/appApply the identity and privilege settings first, then filesystem and device restrictions. Add address-family and system-call restrictions only after compatibility testing. If the daemon needs another directory, add the narrowest exception rather than weakening the whole policy.
Identity and privilege controls
User= and Group=
Run the process as a dedicated non-root account. Set ownership on its state and log directories to that account, and avoid sharing the account with unrelated services. If the daemon does not need privileged startup, this removes an entire class of root-level compromise.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
DynamicUser=yes
Dynamic users let systemd allocate a transient identity and imply stronger filesystem protections. They work well when the service’s files are private to the unit and do not need a stable numeric owner. They are a poor fit when administrators, backup jobs or other services must access files by a persistent UID, or when ownership must survive outside the unit’s lifecycle.
NoNewPrivileges=yes
This prevents the service and its children from gaining additional privileges through execve, including through set-user-ID or set-group-ID programs. It does not make a root process harmless, and it does not replace dropping the root identity, but it closes common privilege-escalation paths and is generally a safe early control.
CapabilityBoundingSet=
An empty value drops all Linux capabilities from the unit. If the daemon genuinely needs one, retain only named capabilities, such as a narrowly justified networking capability, and document why. A capability is not the same as full root, but each retained capability expands the impact of a compromise.
Filesystem and temporary-file isolation
ProtectSystem=strict
ProtectSystem=strict makes the filesystem hierarchy read-only for the service, apart from API filesystems. It is one of the highest-value settings for a daemon that should write only its own state. Grant exceptions with ReadWritePaths=, StateDirectory=, LogsDirectory= or a similarly specific directive.
Do not respond to a write failure by changing the setting to a broad writable mode. First identify the exact path. For example, ReadWritePaths=/var/lib/app /var/log/app is safer than making all of /var writable.
StateDirectory= and LogsDirectory=
These directives tell systemd to create and track service-owned directories, set suitable ownership and treat them as documented writable exceptions to ProtectSystem. A unit using StateDirectory=app receives a managed state directory under /var/lib; LogsDirectory=app does the equivalent under /var/log. Prefer them to hand-maintained, broad path exceptions when the systemd version and application layout support them.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
ProtectHome=
ProtectHome=yes hides /home, /root and /run/user. Use it when the service has no reason to inspect user data. ProtectHome=read-only allows reads but blocks writes, which is appropriate only when the application genuinely needs to read those locations. ProtectHome=tmpfs presents an empty temporary view. Non-standard home-directory locations are not covered, so protect those separately with filesystem path controls.
PrivateTmp=yes
The service receives private /tmp and /var/tmp directories. This prevents accidental file collisions and limits access to temporary files created by other units. It does not isolate every form of inter-process communication: Unix sockets elsewhere on the host, shared network endpoints and other kernel interfaces may remain reachable.
Path exceptions
Use ReadWritePaths= for precise writable locations and BindReadOnlyPaths= when the service needs to see a host path without modifying it. Check generated paths, symlinks and mount points; a writable parent directory can undermine an otherwise narrow exception.
Devices, kernel interfaces and control groups
PrivateDevices=yes
This gives the unit a reduced device view and blocks routine access to host devices. It is suitable for most application servers and workers. Hardware access, audio/video processing, smart-card software, database files on special devices or container-management helpers may require explicit device access; add only the required nodes and test them.
Kernel and cgroup protections
ProtectKernelTunables=yesblocks changes to kernel tuning interfaces such as those exposed through/proc/sys.ProtectKernelModules=yesprevents loading and manipulating kernel modules.ProtectControlGroups=yesprevents modification of cgroup hierarchies.
These settings stop a routine service from turning a local compromise into host-wide kernel or resource-management changes. Monitoring, virtualization and low-level infrastructure software may need an exception; ordinary web, API and worker processes generally should not.
Restrict network and system-call exposure
RestrictAddressFamilies=
This directive allow-lists socket address families. A typical network daemon needs AF_UNIX AF_INET AF_INET6. A local worker may need only AF_UNIX; a service that should open no sockets can use none. Test name resolution, database drivers, metrics exporters and service-manager notification paths because libraries can open sockets indirectly.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
SystemCallFilter=
System-call filters can sharply reduce kernel attack surface, but they are the easiest control to over-tighten. Interpreters, language virtual machines, JITs, plugins, cryptographic libraries and helper binaries may use calls that are absent from a simple allow-list. Add this directive only after observing the daemon’s actual calls, then document every exception and retest upgrades. A startup failure or an obscure runtime error is often evidence of a missing system call rather than a bad application configuration.
Safe rollout procedure
- Capture a baseline. Record status, logs, health checks, ports, devices, writable paths and helper binaries while the unmodified service is healthy.
- Install the drop-in. Use
systemctl edit; leave the packaged unit untouched. - Set identity and privilege limits. Add
User=,Group=,NoNewPrivileges=yesand the smallest capability set. - Protect files and devices. Add
ProtectSystem=strict, an appropriateProtectHome=,PrivateTmp=yes,PrivateDevices=yesand explicit state/log paths. - Protect kernel surfaces. Enable the kernel-tunable, module and cgroup controls unless the workload has a documented need for them.
- Constrain networking. Allow only the address families required by the service.
- Test system calls last. Add
SystemCallFilter=after compatibility testing, not as the first hardening step. - Reload and restart. Run
sudo systemctl daemon-reload, then restart during the planned window. - Verify behavior. Check
systemctl status,journalctl -u, application logs, health endpoints, inbound and outbound connections, scheduled jobs and log rotation. - Record the policy. Explain each exception so a future administrator does not remove a control merely to fix an unexplained failure.
Diagnosing a failed or partially working service
The unit will not start
Read the first failure in journalctl -u example.service -b, then compare it with the newest restriction. A permission error usually identifies a missing writable path; add a narrow ReadWritePaths= or a managed state directory. An executable or helper error may indicate a missing read-only bind path, device or capability.
The service starts but cannot serve requests
Check that the required address family is allowed and that the daemon can reach its Unix socket, database or upstream endpoint. If IPv4 works but IPv6 fails, or local socket access fails while TCP works, revisit RestrictAddressFamilies= and the socket path. Do not assume PrivateTmp=yes controls sockets outside the private temporary directories.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesOnly a feature or plugin fails
Identify the helper process, plugin directory, device or system call used by that feature. Grant the smallest required exception and test the feature independently. For dynamic runtimes, an overly narrow system-call filter is a common cause.
Changes appear ineffective
Confirm that the drop-in is loaded with systemctl cat example.service, run systemctl daemon-reload, and restart the unit. If a namespace-based setting still has no effect, check the kernel, VPS virtualization layer and whether the unit is a user service. The required mechanism may be unavailable.
Rollback
Remove or rename the newest drop-in fragment, run systemctl daemon-reload, restart the service and restore the last known-good policy. Keep the original package unit intact so rollback does not require reinstalling software.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
What systemd sandboxing cannot guarantee
- Namespace-based settings can be unavailable to user services or ineffective when the kernel or a container manager does not provide the required mechanism.
- A VPS that is itself an unprivileged container may expose fewer controls than a full virtual machine.
ProtectSystemand related read-only options do not block communication with Unix sockets located in protected directories, so they are not a complete IPC boundary.ProtectHomedoes not automatically cover non-standard home-directory locations.- Sandboxing does not patch application vulnerabilities, stop an already-authorized database account from misusing its privileges, or replace host updates, credential rotation, firewalling and backups.
systemd sandboxing versus a container or virtual machine
Choose the lightest boundary that meets the threat model. systemd stays inside the host service manager and can express precise per-path, per-device and per-address-family rules. A container or VM can provide a broader separation when several processes, a distinct user space or stronger tenant isolation is required.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Option | Isolation strength | Application compatibility | Operational complexity | Control granularity | Typical overhead |
|---|---|---|---|---|---|
| systemd sandbox | Per-service boundary; depends on kernel and host support | Usually high when restrictions are tailored | Low; uses the existing unit manager | Fine-grained filesystem, device, capability, network-family and syscall controls | Usually light; no separate guest OS |
| Container | Broader process and filesystem boundary, still sharing the host kernel | Good when the application fits the image and runtime model | Medium; image, runtime, networking and updates to manage | Strong namespace and resource controls, with different device and kernel trade-offs | Generally low, but higher than a unit-only change |
| Virtual machine | Strongest separation of the three for many multi-tenant cases | Broad, because the guest supplies its own kernel and user space | Highest; guest OS, patching, storage and network operations | Boundary is the whole guest rather than individual host paths | Highest CPU, memory and storage overhead |
For a single daemon on a VPS, begin with a systemd policy. Move to a container or VM when the process needs broad host privileges, conflicting dependencies, a separate kernel, or a boundary that must survive compromise of multiple cooperating services.
A repeatable hardening checklist
- Dedicated non-root
User=andGroup=, or a deliberate decision to useDynamicUser=. NoNewPrivileges=yesenabled.- Empty or minimal
CapabilityBoundingSet=. ProtectSystem=strictwith explicit state and log directories.- An appropriate
ProtectHome=value and separate protection for non-standard home paths. PrivateTmp=yesandPrivateDevices=yeswhere compatible.- Kernel tunable, module and cgroup protections enabled unless a documented exception exists.
- Only required address families allowed.
- System-call filtering added only after runtime observation and compatibility testing.
- Health checks, logs, upgrades and rollback tested after each policy change.
Frequently Asked Questions
Can I sandbox a service without changing its application configuration?
Often yes. A drop-in can add most controls without modifying the packaged unit or application files, but you must still declare the directories, devices, sockets and helper programs the application genuinely uses.
Should every service use ProtectSystem=strict?
It is a strong default for long-running daemons, not an unconditional rule. Services that write outside their state and log directories need narrowly scoped exceptions, and some infrastructure workloads may require a different policy.
Why does a setting work on one VPS but not another?
Kernel support, systemd version, VPS virtualization and whether the unit is a system or user service determine which namespace and mount controls can operate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is PrivateTmp=yes a complete process-isolation feature?
No. It isolates the service’s temporary directories, but Unix sockets elsewhere, network endpoints and other kernel interfaces may still provide communication paths.
When should I add SystemCallFilter=?
Add it after identity, filesystem, device and network-family controls have been tested. Observe the daemon’s real system-call needs and document exceptions for runtimes, plugins and helpers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
