4 ms·

I don't know the case for tailscale but systemd system services can definitely be run under a specific user/group and have sandboxing applied.