#systemd — Public Fediverse posts

So I discovered that #systemd has credentials control. It uses #TPM2 where with local machine based encryption for contained credentials! 😄 It's like every other week I find out something else systemd can do. 😅

https://systemd.io/CREDENTIALS/

So I discovered that #systemd has credentials control. It uses #TPM2 where with local machine based encryption for contained credentials! 😄 It's like every other week I find out something else systemd can do. 😅

https://systemd.io/CREDENTIALS/

Installing #FreeBSD on my new laptop to escape the massive #AI and bloat madness of #Linux. Opened the terminal and it is a real Unix, all my favorite tools and utilities are there from decades ago. Nothing has been "depreciated" or "Unix is dead" that #Redhat and their #systemD were constantly gaslighting about.

It's all there, even CDE/Motif, xv, oclock, xeyes, finger, ...

Since this is a new laptop with new GPU and all that, I am having to do some scraping from a Linux distribution to get Xorg working. Even GhostBSD didn't have all the new drivers yet. But this is Unix and the included documentation and build tools are amazing. Shame that the Linux Foundation is heavily invested by the AI goons. But this is a win for me😸

Installing #FreeBSD on my new laptop to escape the massive #AI and bloat madness of #Linux. Opened the terminal and it is a real Unix, all my favorite tools and utilities are there from decades ago. Nothing has been "depreciated" or "Unix is dead" that #Redhat and their #systemD were constantly gaslighting about.

It's all there, even CDE/Motif, xv, oclock, xeyes, finger, ...

Since this is a new laptop with new GPU and all that, I am having to do some scraping from a Linux distribution to get Xorg working. Even GhostBSD didn't have all the new drivers yet. But this is Unix and the included documentation and build tools are amazing. Shame that the Linux Foundation is heavily invested by the AI goons. But this is a win for me😸

Linux security tip:

systemd-analyze security <service-name>

A built-in tool for checking how well a systemd service is sandboxed and spotting unnecessary permissions.

Great for enforcing least privilege, especially on network-facing services.

Don’t chase a perfect score. Some services like sshd need elevated access. Test changes before production.

#Linux #systemd #Cybersecurity #SysAdmin #Technology #CyberSec #Security #Tech #InfoSec #DevSecOps #Secure

Linux security tip:

systemd-analyze security <service-name>

A built-in tool for checking how well a systemd service is sandboxed and spotting unnecessary permissions.

Great for enforcing least privilege, especially on network-facing services.

Don’t chase a perfect score. Some services like sshd need elevated access. Test changes before production.

#Linux #systemd #Cybersecurity #SysAdmin #Technology #CyberSec #Security #Tech #InfoSec #DevSecOps #Secure

#TIL (Today I Learned) that (regarding Arch Linux) the tool mkinitcpio apparently changed its default approach from the busybox approach to the systemd approach sometime in 2025.

So if you installed Arch in 2026 and follow some older guides/videos, you could maybe mess up your mkinitcpio configuration and thus initramfs image, maybe rendering your computer unbootable.

#Linux #Arch #ArchLinux #systemd

#TIL (Today I Learned) that (regarding Arch Linux) the tool mkinitcpio apparently changed its default approach from the busybox approach to the systemd approach sometime in 2025.

So if you installed Arch in 2026 and follow some older guides/videos, you could maybe mess up your mkinitcpio configuration and thus initramfs image, maybe rendering your computer unbootable.

#Linux #Arch #ArchLinux #systemd

I've released version 0.9.0 of AI Playground - A command-line tool to run AI coding agents like OpenCode or Claude Code in a secure systemd-nspawn container.

Learn more at https://gitlab.com/cryptomilk/ai-playground

#opencode #claudecode #sandbox #systemd #container

I've released version 0.9.0 of AI Playground - A command-line tool to run AI coding agents like OpenCode or Claude Code in a secure systemd-nspawn container.

Learn more at https://gitlab.com/cryptomilk/ai-playground

#opencode #claudecode #sandbox #systemd #container

Single log line is 49KB+ (ext4) / 110KB+ (btrfs) of systemd-journald disk writes

https://github.com/systemd/systemd/issues/40262

Comments: https://news.ycombinator.com/item?id=49290215

#HackerNews #systemd #journald #disk #writes #ext4 #btrfs #log #line #issue #performance

Single log line is 49KB+ (ext4) / 110KB+ (btrfs) of systemd-journald disk writes

https://github.com/systemd/systemd/issues/40262

Comments: https://news.ycombinator.com/item?id=49290215

#HackerNews #systemd #journald #disk #writes #ext4 #btrfs #log #line #issue #performance

Приложение течёт, а утечки нет: как оптимизатор картинок Next.js съел 4-гигабайтный VPS

История про то, как я три дня искал утечку памяти в Node-приложении, не нашёл — и был прав, что не нашёл. А ещё про то, что у каждого починенного пункта тут оказывался свой счёт: фикс памяти через месяц вернулся жалобой на скорость, а разбор скорости вскрыл третью проблему, о которой я не думал вовсе.

https://habr.com/ru/articles/1070312/

#nextjs #nodejs #sharp #libvips #утечка_памяти #malloc_arena_max #systemd #nginx #оптимизация_изображений #avif

Shorter: Milo Minderbinder was here and has swapped what we wanted for a chit and an empty promise.

Infantile aimless ambition.

#systemd

Shorter: Milo Minderbinder was here and has swapped what we wanted for a chit and an empty promise.

Infantile aimless ambition.

#systemd

Как ядро Linux решает, какой процесс «убить» при нехватке памяти

В сентябре 2004 года разработчик Томас Хабетс вернулся к рабочей станции и обнаружил, что его экран разблокирован. Память закончилась, OOM Killer выбрал жертву и завершил xlock... Для того, чтобы больше такого не произошло Хабетс предложил список процессов, которые Linux запрещено убивать даже в такой ситуации. Его патч в ядро не вошёл, но позже разработчики добавили настройку приоритетов, поддержку cgroups и отдельный поток для быстрого освобождения памяти. Несмотря на это, OOM Killer всё равно может снести важный процесс, ведь ядро видит только объём памяти и заданные администратором правила. Если правил нет, то Linux сам решает, кого «убить». Почему и что делать, чтобы этого не произошло — в статье. Читать

https://habr.com/ru/companies/ruvds/articles/1068682/

#Linux #OOM_Killer #память #ядро_Linux #системное_администрирование #systemd #systemdoomd #cgroups_v2 #PSI #ruvds_статьи

Desde hace algunos días mi PC se apagaba sola de vez en cuando de manera aleatoria 😓

1️⃣ En primer momento pensé que era la fuente (es un poco chica para lo que consume), pero de ser así fallaría siempre igual.

2️⃣ Otra opción: que esté fallando el botón de encendido y envíe la señal de apagado sin que lo haya presionado.

👉️ Cargué esta opción en el /etc/systemd/logind.conf:

HandlePowerKey=ignore

Y hasta ahora parece funcionar 🤞

Digo, por si le sirve a alguien!

#archlinux #systemd #logind

Desde hace algunos días mi PC se apagaba sola de vez en cuando de manera aleatoria 😓

1️⃣ En primer momento pensé que era la fuente (es un poco chica para lo que consume), pero de ser así fallaría siempre igual.

2️⃣ Otra opción: que esté fallando el botón de encendido y envíe la señal de apagado sin que lo haya presionado.

👉️ Cargué esta opción en el /etc/systemd/logind.conf:

HandlePowerKey=ignore

Y hasta ahora parece funcionar 🤞

Digo, por si le sirve a alguien!

#archlinux #systemd #logind

#systemd SAYNUL, mais systemd-resolved, c'est quand même la manière la plus simple de mettre en place un dns-cache local.
Selon la workload ça change tout, rien qu'en activant systemd-resolved, j'ai une machine qui est passée de 3000 requêtes DNS/minute à une trentaine. Divisé par 100 !

Пишем логи в journald с помощью Logback и FFM API

Разворачивать бэкенды для личного использования с помощью systemd удобно, но stdout плохо интегрируется с journald, а устанавливать софт только для просмотра логов не хочется. В статье - простой пример, как можно писать логи из Java-приложения в journald так, чтобы их потом удобно просматривать

https://habr.com/ru/articles/1068800/

#journald #Logback #systemd #Foreign_Functions_and_Memory_API

systemd is now 16 years old - and still I dislike it and everything around it. Heavily.

Recent events forced me to dig waaay deeper into it than I wanted to.

To make this story short:

`systemd-analyze security [name].service` is a neat tool which has shown me quite a bit of effort there is in systemd (and yes, I still dislike all of it!)

And one shouldn't set `ProtectHome=true` and try to start a service in ~/[service].

Of course, if the error had been something different than `203/EXEC` I probably wouldn't have had this "wonderful" journey...

(perhaps this helps somebody someone. Most presumably via some AI.....)

#linux #systemd #hardening

systemd is now 16 years old - and still I dislike it and everything around it. Heavily.

Recent events forced me to dig waaay deeper into it than I wanted to.

To make this story short:

`systemd-analyze security [name].service` is a neat tool which has shown me quite a bit of effort there is in systemd (and yes, I still dislike all of it!)

And one shouldn't set `ProtectHome=true` and try to start a service in ~/[service].

Of course, if the error had been something different than `203/EXEC` I probably wouldn't have had this "wonderful" journey...

(perhaps this helps somebody someone. Most presumably via some AI.....)

#linux #systemd #hardening

This week in #fedora #linux it was less about Fedora and more about #systemd as I've had a bit of a weird week.

• FESco meeting.
• ELN meeting.
• Got access to a staging compose host so we can try to test my big Pungi PR.
• systemd PR to allow entry_name to be chosen for UKIs and BLS entries: https://github.com/systemd/systemd/pull/43290
• systemd PR to skip /proc/cmdline for 60-ukify when building in a container: https://github.com/systemd/systemd/pull/43268
• systemd PR to allow scoping conf- and sysexts to IMAGE_ID/IMAGE_VERSION: https://github.com/systemd/systemd/pull/43339

This week in #fedora #linux it was less about Fedora and more about #systemd as I've had a bit of a weird week.

• FESco meeting.
• ELN meeting.
• Got access to a staging compose host so we can try to test my big Pungi PR.
• systemd PR to allow entry_name to be chosen for UKIs and BLS entries: https://github.com/systemd/systemd/pull/43290
• systemd PR to skip /proc/cmdline for 60-ukify when building in a container: https://github.com/systemd/systemd/pull/43268
• systemd PR to allow scoping conf- and sysexts to IMAGE_ID/IMAGE_VERSION: https://github.com/systemd/systemd/pull/43339

nginx -s reload может не применить конфиг

Пока идёт бинарный апгрейд nginx, systemctl reload nginx не применяет конфиг так, как вы думаете: в лучшем случае к половине процессов сервера, в худшем — вообще никуда. Код возврата ноль в обоих случаях, в error.log пусто. Что именно у вас — решает одна строчка в юните: -s reload бьёт по pid-файлу, а он после USR2 принадлежит новому мастеру; kill -s HUP $MAINPID бьёт по старому, а тот конфиг вообще не перечитывает, и это описано в документации nginx — в разделе про обновление исполняемого файла, куда по другому поводу не заходят. Это первая из пяти проверок. Я взял пять ходовых утверждений про reload в nginx, померил каждое на стенде — и получил результаты по обе стороны: три подтвердились, два развалились. Развалившиеся оказались интереснее. Не работают ровно те страшилки, что про слушающий сокет: listen ... reuseport бесшовность не ломает (inode’ы сокетов до и после reload одни и те же — их держит мастер, а не воркер), паузы в accept при reload не существует вовсе (msleep(100) стоит ПЕРЕД QUIT), а значит и арифметика про переполнение backlog на reload — про нагрузку, а не про reload. Зато подтвердилось то, о чём почти не пишут. keepalive_min_timeout оставляет уходящего воркера в живых, и тот обслуживает запросы, которых в момент reload ещё не существовало — по старому конфигу. А ngx_close_idle_connections не различает направление соединения, поэтому каждый reload сбрасывает пул keepalive к бэкендам — и с 1.29.7 это касается всех, у кого есть блок upstream : пул там включён по умолчанию, 32 соединения на воркер. Правило из первой части — «соединение, открытое до reload, нового конфига не увидит» — приходится переформулировать: держится старого конфига не соединение, а процесс. В конце — Traefik, у которого reload’а нет вовсе, и который умеет не применить конфиг своим способом: кольцевой буфер на одно сообщение и двухсекундный дроссель. nginx release-1.31.3, traefik v3.7.10, все опыты в репозитории, запуск одной командой.

https://habr.com/ru/articles/1068364/

#nginx #reload #nginx_s_reload #systemd #бинарный_апгрейд #keepalive #upstream #reuseport #backlog #traefik

Sooo.

I went and installed Artix Linux (the OpenRC flavour), and in some ways it is awesome. It is a bit lighter, but Incus gave me a headache. I had to write an OpenRC service script to initialise it and get it working.

After that, it has been awesome. Most of my configuration from Arch Linux works alright on Artix. I say “most” because I may find an issue later. All in all, I moved to Artix, and it is cool.

#artixlinux #archlinux #openrc #systemd #linux #scripting

Sooo.

I went and installed Artix Linux (the OpenRC flavour), and in some ways it is awesome. It is a bit lighter, but Incus gave me a headache. I had to write an OpenRC service script to initialise it and get it working.

After that, it has been awesome. Most of my configuration from Arch Linux works alright on Artix. I say “most” because I may find an issue later. All in all, I moved to Artix, and it is cool.

#artixlinux #archlinux #openrc #systemd #linux #scripting

Success!

My vision is to have a local network "cloud fileshare", where the 3 computers on my network sync the file shares.

Today, I was able to (1) Setup #SyncThing as a root #systemd service, (2) Share two user folders /home/jro/JRO-Sync and /home/public/Public-SYNC, (3) repliacate / copy files between all the computers.

The process is documented here:
https://jonathan.rogivue.net/projects/local-sync/

Computers: 2 x Dell Optiplex and Latitude laptop
Operating System: #Linux Mint #Debian (#LMDE)

Success!

My vision is to have a local network "cloud fileshare", where the 3 computers on my network sync the file shares.

Today, I was able to (1) Setup #SyncThing as a root #systemd service, (2) Share two user folders /home/jro/JRO-Sync and /home/public/Public-SYNC, (3) repliacate / copy files between all the computers.

The process is documented here:
https://jonathan.rogivue.net/projects/local-sync/

Computers: 2 x Dell Optiplex and Latitude laptop
Operating System: #Linux Mint #Debian (#LMDE)

Systemd Dynamic Users (2020) via @bd103 https://lobste.rs/s/kjuxof #systemd
https://ethulhu.co.uk/systemd-dynamicuser

Systemd Dynamic Users (2020) via @bd103 https://lobste.rs/s/kjuxof #systemd
https://ethulhu.co.uk/systemd-dynamicuser

Systemd Dynamic Users (2020)

https://fed.brid.gy/r/https://ethulhu.co.uk/systemd-dynamicuser

Is there someone out there who is running #Ghost via #Podman quadlets?

I have been trying and trying and trying but I am unable even to start the systemd service. I would very much appreciate some guidance!

Next step is to migrate Ghost from another installation but Saint @EvanHahn from Chicago already offered me his invaluable help. I was hoping I could at least get the system running, but 😭

#systemd #quadlets #Linux #sysAd #sysadmin #systemAdministration #techSupport #help

Is there someone out there who is running #Ghost via #Podman quadlets?

I have been trying and trying and trying but I am unable even to start the systemd service. I would very much appreciate some guidance!

Next step is to migrate Ghost from another installation but Saint @EvanHahn from Chicago already offered me his invaluable help. I was hoping I could at least get the system running, but 😭

#systemd #quadlets #Linux #sysAd #sysadmin #systemAdministration #techSupport #help

@ashwin @MelissaBearTrix

You are right.
California uber Alles added a law for mandatory birth dates and some statist bootlicker developers ( eg: #systemd ) started adding it preemptively.

Forward acquiescence to authoritarians brought US to where it is now.

When I decided to switch from Windows 11 to Linux last year, I was advised to start with Arch Linux because it’s a great way to learn Linux without jumping straight into more complex systems like LFS or Gentoo.

I’ve been experimenting with Artix Linux (OpenRC) in a VM, and it’s been one of the best learning experiences I’ve had.

You install a package with pacman, and if it’s a service, you install the corresponding *-openrc package alongside it -- or, if you really want to understand how things work, you can write the OpenRC service script yourself.

This is fun. I might eventually install Artix on bare metal, but for everyday use I still prefer Arch Linux (systemd).

#archlinux #openrc #artixlinux #sysadmin #systemd #tech #linux #unix

I noticed that signing in to Mastodon using 2FA didn't reliably work. Turns out my system clock was ~30 seconds behind that of the actual time (currently GMT +1 for me).

On Linux distributions that have systemd, systemd apparently synchronises your system time with a time server automatically. However, I use Devuan (i.e. Debian but without systemd) so I had to do it manually.

I used `htpdate` to set the time to a UK time server on pool.ntp.org like this:

```
sudo htpdate uk.pool.ntp.org
```
No need to reboot.
It's now accurate to GMT+1 to within about half a second. :)

Hashtags:
#Devuan #time #system #Linux #2FA #systemd #Debian

Liebes #Fediverse und vor allem liebe #mastoadmin Gruppe. Wie ist euer aktueller Stand zu #SideKiq und deren Worker und Queues. Früher hatte man die ja auf ggf. mehrere laufende #SystemD Units aufgeteilt, ich meine aber das dies nicht mehr aktuell ist und keinen Vorteil bringen sollte. Aktuell sieht es bei uns halt wie folgt aus und ich frage, mich warum ich ihn nicht dazu bekomme mehr zu machen.

DB_POOL:140
worker: 128

queues:
default, 20
push, 9
ingress, 30
mailers, 3

#anoxinon

Tipps?

An almost hidden system inside systemd can run your containers.

#container #systemd #architecture #nspawn

https://silentarchitect.org/2026/08/your-hidden-container-engine.html

SystemD has improved the Linux software ecosystem.

#linux #systemd

Installed FedoraIOT baremetal, just to kick the tyres an with immutable/atomic before I try it on something like my daily driver.

Man, #fedoraatomic doesn't suffer this fool. Not sure if it's #podman , #systemd or #selinux but what usually takes a few minutes with docker has me stuck on a hamsterwheel trying to figure out what I fucked up.

Also, vi is the default editor? I feel like I'm in an alternate reality where #Fedora kinda sucks. I must've installed nano so long ago I don't remember

An OpenRC evangelist has been trying to get me to ditch systemd for some time now. I decided to test it out today, only to realise that it is simply an init system.

Moving to OpenRC would mean losing the array of unit types I am now fluent in writing, not to mention Podman Quadlets, which I enjoy. As someone who embraced the Unix philosophy last year, it is with great trepidation that I say this: I will not be moving to OpenRC.

I have been bewitched by the convenience of systemd and will happily abide its bloat ... for now.

#linux #unix #systemd #openrc #archlinux #tech