the service script should now work around the lack of VNET and/or IP6 thus removing the requirement for VNET or ip6=inherit
allow_raw_sockets is helpful for troubleshooting (e.g. ping, traceroute) but is not a requirement as long as the program does not use those or create raw sockets itself.
two notes for the wiki:
ip6=inherit
ping
,traceroute
) but is not a requirement as long as the program does not use those or create raw sockets itself.