@june you could put bwrap in there or a similar tool as mentioned in https://madaidans-insecurities.github.io/guides/linux-hardening.html#systemd-service-sandboxing