A lot of times you cat offload stuff to systemd. For example, a server might need privileged operations to open low port and set up logging. But with systemd, y

A lot of times you cat offload stuff to systemd. For example, a server might need privileged operations to open low port and set up logging. But with systemd, you use socket activation, so low port is opened for you, and logging is centralized, you just write to stdout. If this is not enough, you can have "ExecStartPre" command in unconfined mode. Great if you need to fix up permissions for example. And if that does not work either, you can do privilege dropping twice. For example, systemd isolates filesystem, sets capabilities and NoNewPrivileges bit, but still runs daemon with root access. Daemon does whatever init it needs to do, and then drop the remaining privileges.