An example secure systemd unit file

hardened.service

[Unit]
Description=Some internet-facing service
After=network.target

[Service]
Type=simple
WorkingDirectory=...
EnvironmentFile=...
ExecStart=...

DynamicUser=true
PrivateDevices=true
ProtectHostname=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
SystemCallArchitectures=native
LockPersonality=true
MemoryDenyWriteExecute=true
InaccessiblePaths=/dev /boot
RestrictRealtime=true
PrivateMounts=true
MountFlags=private
PrivateUsers=true
UMask=0777
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
CapabilityBoundingSet=
AmbientCapabilities=
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources
ProtectKernelLogs=true