Well, if you don't include the "why", to you aren't saying anything everyone hasn't heard a thousand times before.
The "why" is important.
The "why" is important.
Today I have learned about PrivateTmp and added that thing to the evergrowing list of things to get rid of on fresh Debian instances. Yes, I did think for ten seconds and I am pretty sure I don't want that at all at any of the servers I am managing.
As for systemd-resolved, it was broken beyond repairability many years ago right at the start. At first I have tried to read manuals and play along with it. All I needed was OS using my resolvers only. Simple as "nameserver 1.1.1.1" in resolv.conf. Unfortunately, no matter how much I read the documentation, I couldn't make it do that one simple job. Oh, and manually editing resolve.conf was not an option as well because it randomly overwrote it. On a server with a static ip, mind you, no dhcp. Maybe my memory is serving me wrong but I think systemd-resolved was so bad that even +x on /etc/resolv.conf did not work, it would still overwrite it. Incredible piece of shit, just incredible. I am now removing it from all instances by default for years and I refuse to learn whether they made good or not. Clearly systemd-resolved provides negative value to the world.
I can't really avoid systemd altogether, and I like parts of it. But I also dislike that it does so much, and wish I could find a list of all its non-essential components and a guide for slimming it down and disabling any surprising or bad behavior (like its default name servers, for example).