Sample service unit file for systemd

template.service

[Unit]
Description=My service

[Service]
ExecStart=/usr/local/bin/my-service \
  -argument value \
  -otherargument othervalue

# Setuid/Setgid
User=nobody
Group=nogroup

# Create a private tmp and device dir for this process
PrivateTmp=true
PrivateDevices=true

# Mount system and home directories read-only
ProtectSystem=full
ProtectHome=read-only

# if privileged ports are needed
# CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# Any need environment variables
# Environment='KEY=value'

[Install]
WantedBy=multi-user.target