[Unit]
Description=stubby DNS resolver
[Service]
WorkingDirectory=/run/stubby
ExecStart=/usr/bin/stubby
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
User=stubby
[Install]
WantedBy=multi-user.target