Ideally upstreams, rather than distributions, should sandbox their own projects.

However, Debian is shipping a number of hardened systemd unit files.

To see some examples on how the sandboxing is being set up you can grep for SystemCallFilter, CapabilityBoundingSet, ProtectSystem, ProtectHome in /lib/systemd/system/*.service