Unless severely resource constrained, it makes sense to at least toss the application under something light like an nspawn container. If you're using systemd h

Unless severely resource constrained, it makes sense to at least toss the application under something light like an nspawn container. If you're using systemd hosts it's already there. Even if you don't use user or network namespaces it at least confers a desirable separation of application and its dependencies vs. underlying host at the filesystem level. It simplifies administration and allows your app and its dependencies to move at a pace decoupled from the host kernel and its minimal dependencies required for providing ssh access and systemd.