Comment by c45y

With some small systemd configs each native app is essentially a container these days. The overhead of unique kernels per app would really restrict what could fit on a small box like this

DynamicUser and ProtectSystem keep me sane.