SystemD supports this through
RootDirectory= Takes a directory path relative to the host's root directory (i.e. the root of the system running the service manager). Sets the root directory for executed processes, with the
chroot(2) system call. If this is used, it must be ensured that the process binary and all its auxiliary files are available in the
chroot() jail. Note that setting this parameter might result in additional dependencies to be added to the unit (see above).
PrivateUsers= settings are particularly useful in conjunction with
APIVFS, is probably the most useful,
Takes a boolean argument. If on, a private mount namespace for the unit's processes is created and the API file systems
/dev are mounted inside of it, unless they are already mounted