There is similar question: Cgroups, limit memory per user, but the solution doesn't work in "modern" systems, where cgroups hierarchy is managed by systemd.
Straightforward solution — templating user-UID.slice — won't work, because it is not supported, see https://github.com/systemd/systemd/issues/2556.
Is there any way to achieve the desired effect — manage CPU and/or memory resources on a per-user basis?
UPD: I'll keep my solution for the sake of history, but
systemctl set-property should be called at login time, using
pam_exec, see https://github.com/hashbang/shell-etc/pull/183. In this approach, there is no time window between the user's login and setting of limits.
My solution. Interface
/org/freedesktop/login1 object emits
UserNew(u uid, o object_path) signal. I've written a simple daemon which listens to the signal and every time it is emitted set
CPUAccounting=true for just-logged-in-user's slice.