zramd.service

[Unit]
Description=Automatically setup swap on zram

[Service]
Type=oneshot
EnvironmentFile=-/etc/default/zramd            
ExecStart=/usr/bin/zramd start
ExecStop=/usr/bin/zramd stop
RemainAfterExit=yes
ProtectHostname=yes         
PrivateNetwork=yes
IPAddressDeny=any
NoNewPrivileges=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
LockPersonality=yes
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_SYS_MODULE
SystemCallFilter=@module @swap @system-service
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
DeviceAllow=block-* rw
DevicePolicy=closed
# https://github.com/systemd/systemd/issues/15753
RestrictAddressFamilies=AF_UNIX
RestrictAddressFamilies=~AF_UNIX

[Install]
WantedBy=multi-user.target