The published service disables the Chromium sandbox and does not perform system administration operations, so the broad capability is unnecessary. Drop all capabilities, prevent privilege escalation, and use the runtime default seccomp profile.
chengcheng
chengcheng