Four profiles, each tested to a systemd-analyze security score below 2.5.
| Profile | Score | Notes |
|---|---|---|
web-app.conf |
1.8 | Network egress restricted; JIT-compatible |
worker.conf |
1.4 | No inbound sockets |
network-daemon.conf |
2.3 | Retains CAP_NET_BIND_SERVICE |
batch-isolated.conf |
0.9 | PrivateNetwork, no egress at all |
Copy into /etc/systemd/system/<unit>.service.d/, then run systemctl daemon-reload && systemctl restart <unit>.