Systemd Hardening for Background Workers on Small Servers
Worker services often run with broad permissions by default. Tightening unit settings reduces blast radius without major infrastructure changes.
Step 1: run as dedicated service user
[Service]
User=worker
Group=worker
Step 2: lock down filesystem and privilege escalation
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/worker
Step 3: define restart and health behavior
Restart=on-failure
RestartSec=5
StartLimitBurst=5
StartLimitIntervalSec=60
Pitfall
Using root-run services for convenience. One compromised worker can touch unrelated system paths.
Verification
- Worker writes only to explicitly allowed paths.
- Crash loops are bounded and visible in journal.
- Service startup remains stable after hardening flags.