@Tutanota@mastodon.social @firefox@lemmy.world @torproject@mastodon.social @yubico@infosec.exchange @duckduckgo@botsin.space @signalapp@mastodon.world @bitwarden@fosstodon.org @ecosia@mastodon.social @nextcloud@mastodon.xyz @StartpageSearch@mastodon.social @ublockorigin@lemmy.ml In the past year I've actually discovered systemd is quite useful as a quazi-containerization tool. It has tons of options for applying restrictions to the services it manages. And even if a service you host comes with its own service file, you don't have to modify that and risk losing your changes with an update, you can make separate drop-in files that get applied as well.