Applied suggested improvements from https://gist.github.com/Wuestengecko/57daca658c9af5d8f9b834f524025a89 (missing dependency, systemd dynamic user and several more)

1 files changed, 20 insertions, 0 deletions

diff --git a/carbonapi.service b/carbonapi.service
index 311f56332533..625626f42488 100644
--- a/carbonapi.service
+++ b/carbonapi.service
@@ -8,5 +8,25 @@ Type=simple
 ExecStart=/usr/bin/carbonapi -config /etc/carbonapi.yaml
 Restart=on-failure
 
+DynamicUser=true
+
+CapabilityBoundingSet=
+AmbientCapabilities=
+NoNewPrivileges=true
+
+ProtectSystem=strict
+ProtectHome=true
+
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+
+LockPersonality=true
+MemoryDenyWriteExecute=true
+RestrictRealtime=true
+RemoveIPC=true
+
 [Install]
 WantedBy=multi-user.target