[Service]
CapabilityBoundingSet=~CAP_NET_RAW CAP_NET_ADMIN