systemd hardening generator
Tick the hardening you want and get a paste-ready systemd unit file — with the cost of every directive written next to it. Runs entirely in your browser.
Presets:
Hardening to apply
The generated unit file
This is not “stricter is better”. Every item has a cost, and the cost is written under it. Harden, then run a real workload and see whether it got blocked.
Why the cost matters more than the directive
Copying a list of hardening directives is easy; knowing which one will break your service at 03:00 is not. Every item above says what it restricts and what it takes away — a private /dev means no GPU,MemoryDenyWriteExecute means no JIT, RestrictNamespaces means anything that runs containers stops working.
The workflow that actually works: enable, then run a real workload, then read the journal. A blocked syscall with SystemCallErrorNumber=EPERM shows up as a permission error rather than a crash, which is exactly what you want when you are bisecting.
Related reading: systemd hardening,the systemd unit cookbook,Linux capabilities, andseccomp in containers.
The output above is checked with systemd's own tool. systemd-analyze verify on the default and on the all-options-on preset reports exactly one thing — Command /usr/local/bin/<name> is not executable — because it is a template and that path is yours to fill in. No unknown or malformed directives.