File: //etc/systemd/system/multi-user.target.wants/earlyoom.service
[Unit]
Description=Early OOM Daemon
Documentation=man:earlyoom(1) https://github.com/rfjakob/earlyoom
[Service]
EnvironmentFile=-/etc/default/earlyoom
ExecStart=/usr/bin/earlyoom $EARLYOOM_ARGS
# Run as an unprivileged user with random user id
DynamicUser=true
# Allow killing processes and calling mlockall()
AmbientCapabilities=CAP_KILL CAP_IPC_LOCK
# We don't need write access anywhere
ProtectSystem=strict
# We don't need /home at all, make it inaccessible
ProtectHome=true
# earlyoom never exits on it's own, so have systemd
# restart it should it get killed for some reason.
Restart=always
# set memory limits and max tasks number
TasksMax=10
MemoryMax=50M
[Install]
WantedBy=multi-user.target