First look at confining systemd