Analyze a systemd unit.
Most .service files run as root with no sandbox and no restart policy — fine until they aren’t. Paste your unit and get a hardening review: root user, missing sandboxing, no auto-restart, each with the exact directive to add.
root, unsandboxed, and unwatched
A service started by a quick ExecStart with nothing else does three risky things at once: it runs as root, it has the run of the filesystem, and it stays dead if it crashes. systemd can fix all three with a handful of directives that cost nothing — a dedicated user, a few sandbox lines, and a restart policy — but they only help if they’re there. This reads your unit and tells you which are missing.
A hardened unit is a good foundation. Operating multiple backend services also means coordinating releases, checking health, applying traffic policy, and handling crashes without a round of SSH sessions.
Keep permissions explicit. Keep services running.
Infraveil supervises managed backend processes, follows configured health checks, and applies supported restart and recovery controls. Current supported automatic Linux setup runs the launcher as a chosen non-root service identity and uses privileged commands to register the systemd unit. Older privileged installations are not migrated automatically; inspect the effective unit and its permissions on your server.
See how it works