systemd

Systemd has security features that tend to go underutilised. Especially, the service files have sandboxing features that can be used to isolate the service.