Docker Security Cheat Sheet
All of these isolation techniques (and much more) can be used inside systemd units. Write your .service as usual, then run this command on it:<p><pre><code>  $ systemd-analyze security service-name
</code></pre>
It prints out a long list of hardening flags that can be applied inside of your service, like so:<p><pre><code>    NAME                                                        DESCRIPTION                                                             EXPOSURE
   PrivateNetwork=                                             Service has access to the host&#x27;s network                                     0.5
   User=&#x2F;DynamicUser=                                          Service runs as root user                                                    0.4
   CapabilityBoundingSet=~CAP_SET(UID|GID|PCAP)                Service may change UID&#x2F;GID identities&#x2F;capabilities                           0.3
   CapabilityBoundingSet=~CAP_SYS_ADMIN                        Service has administrator privileges                                         0.3
  ...
</code></pre>
Here&#x27;s what I typically use for a .NET 5 application:<p><pre><code>  WorkingDirectory        = &#x2F;opt&#x2F;appname&#x2F;app
  ReadWritePaths          = &#x2F;opt&#x2F;appname&#x2F;data
  UMask                   = 0077
  LockPersonality         = yes
  NoNewPrivileges         = yes
  PrivateDevices          = yes
  PrivateMounts           = yes
  PrivateTmp              = yes
  PrivateUsers            = yes
  ProtectClock            = yes
  ProtectControlGroups    = yes
  ProtectHome             = yes
  ProtectHostname         = yes
  ProtectKernelLogs       = yes
  ProtectKernelModules    = yes
  ProtectKernelTunables   = yes
  ProtectSystem           = strict
  RemoveIPC               = yes
  RestrictAddressFamilies = AF_UNIX AF_INET AF_INET6
  RestrictNamespaces      = yes
  RestrictRealtime        = yes
  RestrictSUIDSGID        = yes
  SystemCallArchitectures = native
  ProtectProc             = invisible
  CapabilityBoundingSet   =
  SystemCallFilter        = ~@clock @module @mount @raw-io @reboot @swap @privileged @cpu-emulation @obsolete
</code></pre>
ReadWritePaths should be replaced with a combination of DynamicUser + writing local persistent data to $STATE_DIRECTORY, but I&#x27;m too lazy to do that yet.<p>See systemd.exec(5) for more.