caps-keep   CAP_NET_BIND_SERVICE
cap-bs-keep CAP_NET_BIND_SERVICE
no-new-privs
ro-home
ro-sys
ro-etc
run-dir
C /run/stubby
