$ sudo sysg --sys start --daemonize

services:
  web:
    command: "./server"
    user: "www-data"
    group: "www-data"
    supplementary_groups: ["www-logs"]
    limits:
      nofile: 65536
      nproc: 4096
      memlock: "512M"
      nice: -5
      cpu_affinity: [0, 1]
      cgroup:
        memory_max: "512M"
        cpu_max: "200000 100000"
    capabilities:
      - CAP_NET_BIND_SERVICE
      - CAP_SYS_NICE
    isolation:
      network: true
      pid: true

services:
  nginx:
    command: "nginx -g 'daemon off;'"
    user: "www-data"
    group: "www-data"

capabilities:
  - CAP_NET_BIND_SERVICE  # Bind to privileged ports
  - CAP_SYS_NICE          # Adjust process priority

limits:
  cgroup:
    memory_max: "512M"
    cpu_max: "200000 100000"  # 2 CPUs

isolation:
  network: true  # Private network namespace
  pid: true      # Private PID namespace
  mount: true    # Private mount namespace

services:
  web:
    command: "./myapp"
    user: "appuser"
    capabilities:
      - CAP_NET_BIND_SERVICE

services:
  postgres:
    command: "postgres"
    user: "postgres"
    limits:
      nofile: 100000
      cgroup:
        memory_max: "4G"