Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Hardened Minecraft systemd service
[Unit]
Description=Minecraft
Requires=local-fs.target network-online.target
After=local-fs.target network-online.target
[Service]
Type=simple
ExecStart=/usr/bin/java -Xmx768M -Xms500M -jar minecraft_server.jar nogui
WorkingDirectory=/home/minecraft
User=minecraft
Group=minecraft
NoNewPrivileges=yes
CPUSchedulingPolicy=batch
ProtectSystem=strict
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LockPersonality=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectHostname=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
PrivateUsers=yes
[Install]
WantedBy=multi-user.target
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment