systemd
Generate a systemd unit file, including the sandboxing that is off by default and costs nothing to turn on.
A unit file is short, which makes it look simple, and the defaults are the trap. `ExecStart` does not use your `$PATH`, so a relative command silently fails. `After=network.target` does not wait for an address, which is why a service starts fine by hand and fails on boot — `network-online.target` is the one that waits.
It also writes the hardening block: read-only filesystem, private `/tmp`, no new privileges. Those close real holes and almost nobody adds them, largely because `ProtectSystem=strict` breaks anything that writes to disk until you declare where — so the generator names your working directory in `ReadWritePaths` and tells you why. There is a timer mode too, which is the modern replacement for a cron entry and, unlike cron, can run a job it missed while the machine was off.
What people open it for
- Turning a long-running command into a service that survives a reboot
- Adding sandboxing to a service without breaking its writes
- Replacing a cron entry with a timer that catches up after downtime
- Getting a service to actually wait for the network on boot