All of our systems have systemd, and I would love to have sandboxing as part of the unit definition. Using RootDirectory which performs a chroot, then binding

All of our systems have systemd, and I would love to have sandboxing as part of the unit definition. Using RootDirectory which performs a chroot, then binding some read only paths or sockets into the jail, along with some cgroups and other limits. I've yet to finish a good template, but was thinking this would be a good open source project for collaboration on as it applies to a lot of things that are non-Java.