On June 19 we released systemd v261 into the wild . In the weeks leading up to that release (and since then) I have posted a series of serieses of posts to Mastodon about key new features in this release, under the #systemd261 hash tag. In case you aren't using Mastodon, but would like to read up, here's a list of all 27 posts: Post #1: El-Torito/ISO9660 Support in systemd-repart Post #2:…
On March 17 we released systemd v260 into the wild . In the weeks leading up to that release (and since then) I have posted a series of serieses of posts to Mastodon about key new features in this release, under the #systemd260 hash tag. In case you aren't using Mastodon, but would like to read up, here's a list of all 21 posts: Post #1: NvPCR Measurements for Activated DDIs Post #2: Varlink…
Today, we announce Amutable, our ✨ new ✨ company. We – @blixtra@hachyderm.io , @brauner@mastodon.social , @davidstrauss@mastodon.social , @rodrigo_rata@mastodon.social , @michaelvogt@mastodon.social , @pothos@fosstodon.org , @zbyszek@fosstodon.org , @daandemeyer@mastodon.social @cyphar@mastodon.social , @jrocha@floss.social and yours truly – are building the 🚀 next generation of Linux systems,…
On Dec 17 we released systemd v259 into the wild . In the weeks leading up to that release (and since then) I have posted a series of serieses of posts to Mastodon about key new features in this release, under the #systemd259 hash tag. In case you aren't using Mastodon, but would like to read up, here's a list of all 25 posts: Post #1: systemd-resolved Hooks Post #2: dlopen() everything Post #3:…
Already on Sep 17 we released systemd v258 into the wild . In the weeks leading up to that release I have posted a series of serieses of posts to Mastodon about key new features in this release, under the #systemd258 hash tag. It was my intention to post a link list here on this blog right after completing that series, but I simply forgot! Hence, in case you aren't using Mastodon, but would like…
The All Systems Go! 2025 Call for Participation Closes Tomorrow! The Call for Participation (CFP) for All Systems Go! 2025 will close tomorrow , on 13th of June! We’d like to invite you to submit your proposals for consideration to the CFP submission site quickly!
Last week we released systemd v257 into the wild . In the weeks leading up to this release (and the week after) I have posted a series of serieses of posts to Mastodon about key new features in this release, under the #systemd257 hash tag. In case you aren't using Mastodon, but would like to read up, here's a list of all 37 posts: Post #1: Fully Locked Accounts with systemd-sysusers Post #2:…
Yesterday evening we released systemd v256 into the wild. While other projects, such as Firefox are just about to leave the 7bit world and enter 8bit territory, we already entered 9bit version territory! For details about the release, see our announcement mail . In the weeks leading up to this release I have posted a series of serieses of posts to Mastodon about key new features in this release.…
This is a guest post written by Daan De Meyer, systemd and mkosi maintainer Almost 7 years ago, Lennart first wrote about mkosi on this blog. Some years ago, I took over development and there's been a huge amount of changes and improvements since then. So I figure this is a good time to re-introduce mkosi . mkosi stands for Make Operating System Image . It generates OS images that can be used for…
The All Systems Go! 2023 Call for Participation Closes in Three Days! The Call for Participation (CFP) for All Systems Go! 2023 will close in three days , on 7th of July! We’d like to invite you to submit your proposals for consideration to the CFP submission site quickly! All topics relevant to foundational open-source Linux technologies are welcome. In particular, however, we are looking for…
💽 Linux Boot Partitions and How to Set Them Up 🚀 Let’s have a look how traditional Linux distributions set up /boot/ and the ESP, and how this could be improved. How Linux distributions traditionally have been setting up their “boot” file systems has been varying to some degree, but the most common choice has been to have a separate partition mounted to /boot/ . Usually the partition is…
🔐 Brave New Trusted Boot World 🚀 This document looks at the boot process of general purpose Linux distributions. It covers the status quo and how we envision Linux boot to work in the future with a focus on robustness and simplicity. This document will assume that the reader has comprehensive familiarity with TPM 2.0 security chips and their capabilities (e.g., PCRs, measurements, SRK), boot…
TLDR: Hermetic /usr/ is awesome; let's popularize image-based OSes with modernized security properties built around immutability, SecureBoot, TPM2, adaptability, auto-updating, factory reset, uniformity – built from traditional distribution packages, but deployed via images. Over the past years, systemd gained a number of components for building Linux-based operating systems. While these…
I recently blogged about how to run a volatile systemd-nspawn container from your host's /usr/ tree, for quickly testing stuff in your host environment, sharing your home drectory, but all that without making a single modification to your host, and on an isolated node. The one-liner discussed in that blog story is great for testing during system software development. Let's have a look at another…
Apparently, in some parts of this world , the /usr/ -merge transition is still ongoing. Let's take the opportunity to have a look at one specific way to take benefit of the /usr/ -merge (and associated work) IRL. I develop system-level software as you might know. Oftentimes I want to run my development code on my PC but be reasonably sure it cannot destroy or otherwise negatively affect my host…
The Strange State of Authenticated Boot and Disk Encryption on Generic Linux Distributions TL;DR: Linux has been supporting Full Disk Encryption (FDE) and technologies such as UEFI SecureBoot and TPMs for a long time. However, the way they are set up by most distributions is not as secure as they should be, and in some ways quite frankly weird. In fact, right now, your data is probably more secure…
TL;DR: Tag your GPT partitions with the right, descriptive partition types, and the world will become a better place. A number of years ago we started the Discoverable Partitions Specification which defines GPT partition type UUIDs and partition flags for the various partitions Linux systems typically deal with. Before the specification all Linux partitions usually just used the same type,…
TL;DR: don't use select() + bump the RLIMIT_NOFILE soft limit to the hard limit in your modern programs. The primary way to reference, allocate and pin runtime OS resources on Linux today are file descriptors ("fds"). Originally they were used to reference open files and directories and maybe a bit more, but today they may be used to reference almost any kind of runtime resource in Linux…
TL;DR: It's now easy to unlock your LUKS2 volume with a FIDO2 security token (e.g. YubiKey, Nitrokey FIDO2, AuthenTrend ATKey.Pro). And TPM2 unlocking is easy now too. Blogging is a lot of work, and a lot less fun than hacking. I mostly focus on the latter because of that, but from time to time I guess stuff is just too interesting to not be blogged about. Hence here, finally, another blog story…
The All Systems Go! 2019 Call for Participation Re-Opened for ONE DAY! Due to popular request we have re-opened the Call for Participation (CFP) for All Systems Go! 2019 for one day. It will close again TODAY , on 15 of July 2019, midnight Central European Summit Time! If you missed the deadline so far, we’d like to invite you to submit your proposals for consideration to the CFP submission site…
Portable Services Walkthrough (Go Edition) A few months ago I posted a blog story with a walkthrough of systemd Portable Services . The example service given was written in C, and the image was built with mkosi . In this blog story I'd like to revisit the exercise, but this time focus on a different aspect: modern programming languages like Go and Rust push users a lot more towards static linking…
All Systems Go! 2018 Tickets Selling Out Quickly! Buy your tickets for All Systems Go! 2018 soon, they are quickly selling out! The conference takes place on September 28-30 , in Berlin , Germany, in a bit over two weeks. Why should you attend? If you are interested in low-level Linux userspace, then All Systems Go! is the right conference for you. It covers all topics relevant to foundational…
The All Systems Go! 2018 Call for Participation Closes TODAY! The Call for Participation (CFP) for All Systems Go! 2018 will close TODAY , on 30th of July! We’d like to invite you to submit your proposals for consideration to the CFP submission site quickly! All Systems Go! is everybody's favourite low-level Userspace Linux conference, taking place in Berlin, Germany in September 28-30, 2018. For…
The All Systems Go! 2018 Call for Participation Closes in One Week! The Call for Participation (CFP) for All Systems Go! 2018 will close in one week , on 30th of July! We’d like to invite you to submit your proposals for consideration to the CFP submission site quickly! Notification of acceptance and non-acceptance will go out within 7 days of the closing of the CFP. All topics relevant to…
Portable Services with systemd v239 systemd v239 contains a great number of new features. One of them is first class support for Portable Services . In this blog story I'd like to shed some light on what they are and why they might be interesting for your application. What are "Portable Services"? The "Portable Service" concept takes inspiration from classic chroot() environments as well as…
The All Systems Go! 2018 Call for Participation is Now Open! The Call for Participation (CFP) for All Systems Go! 2018 is now open. We’d like to invite you to submit your proposals for consideration to the CFP submission site . The CFP will close on July 30th. Notification of acceptance and non-acceptance will go out within 7 days of the closing of the CFP. All topics relevant to foundational…
For those living under a rock, the videos from everybody's favourite Userspace Linux Conference All Systems Go! 2017 are now available online. All videos The videos for my own two talks are available here: Synchronizing Images with casync ( Slides ) Containers without a Container Manager, with systemd ( Slides ) Of course, this is the stellar work of the CCC VOC folks, who are hard to beat when it…
The GNOME.Asia Summit 2017 organizers invited to me to speak at their conference in Chongqing/China, and it was an excellent event! Here's my brief report: Because we arrived one day early in Chongqing, my GNOME friends Sri, Matthias, Jonathan, David and I started our journey with an excursion to the Dazu Rock Carvings , a short bus trip from Chongqing, and an excellent (and sometimes quite…
TL;DR: systemd now can do per-service IP traffic accounting, as well as access control for IP address ranges. Last Friday we released systemd 235 . I already blogged about its Dynamic User feature in detail , but there's one more piece of new functionality that I think deserves special attention: IP accounting and access control. Before v235 systemd already provided per-unit resource management…
TL;DR: you may now configure systemd to dynamically allocate a UNIX user ID for service processes when it starts them and release it when it stops them. It's pretty secure, mixes well with transient services, socket activated services and service templating. Today we released systemd 235 . Among other improvements this greatly extends the dynamic user logic of systemd. Dynamic users are a powerful…
The All Systems Go! 2017 schedule has been published! I am happy to announce that we have published the All Systems Go! 2017 schedule! We are very happy with the large number and the quality of the submissions we got, and the resulting schedule is exceptionally strong. Without further ado: Here's the schedule for the first day (Saturday, 21st of October). And here's the schedule for the second day…
The All Systems Go! 2017 Call for Participation is Closing on September 3rd! Please make sure to get your presentation proprosals for All Systems Go! 2017 in now! The CfP closes on sunday! In case you haven't heard about All Systems Go! yet, here's a quick reminder what kind of conference it is, and why you should attend and speak there: All Systems Go! is an Open Source community conference…
The All Systems Go! 2017 Headline Speakers Announced! Don't forget to send in your submissions to the All Systems Go! 2017 CfP! Proposals are accepted until September 3rd ! A couple of headline speakers have been announced now: Alban Crequy (Kinvolk) Brian "Redbeard" Harrington (CoreOS) Gianluca Borello (Sysdig) Jon Boulle (NStack/CoreOS) Martin Pitt (Debian) Thomas Graf (covalent.io/Cilium)…
Video of my casync Presentation @ kinvolk The great folks at kinvolk have uploaded a video of my casync presentation at their offices last week . The slides are available as well. Enjoy!
Introducing mkosi After blogging about casync I realized I never blogged about the mkosi tool that combines nicely with it. mkosi has been around for a while already, and its time to make it a bit better known. mkosi stands for Make Operating System Image , and is a tool for precisely that: generating an OS tree or image that can be booted. Yes, there are many tools like mkosi , and a number of…
The All Systems Go! 2017 Call for Participation is Now Open! We’d like to invite presentation proposals for All Systems Go! 2017 ! All Systems Go! is an Open Source community conference focused on the projects and technologies at the foundation of modern Linux systems — specifically low-level user-space technologies. Its goal is to provide a friendly and collaborative gathering place for…
Introducing casync In the past months I have been working on a new project: casync . casync takes inspiration from the popular rsync file synchronization tool as well as the probably even more popular git revision control system. It combines the idea of the rsync algorithm with the idea of git -style content-addressable file systems, and creates a new system for efficiently storing and delivering…
Avoiding CVE-2016-8655 with systemd Just a quick note: on recent versions of systemd it is relatively easy to block the vulnerability described in CVE-2016-8655 for individual services. Since systemd release v211 there's an option RestrictAddressFamilies= for service unit files which takes away the right to create sockets of specific address families for processes of the service. In your unit…
systemd.conf 2016 is Over Now! A few days ago systemd.conf 2016 ended, our second conference of this kind. I personally enjoyed this conference a lot: the talks, the atmosphere, the audience, the organization, the location, they all were excellent! I'd like to take the opportunity to thanks everybody involved. In particular I'd like to thank Chris , Daniel , Sandra and Henrike for organizing the…
Tickets for systemd 2016 Workshop day still available! We still have a number of ticket for the workshop day of systemd.conf 2016 available. If you are a newcomer to systemd, and would like to learn about various systemd facilities, or if you already know your way around, but would like to know more: this is the best chance to do so. The workshop day is the 28th of September, one day before the…
A Preliminary systemd.conf 2016 Schedule is Now Available! We have just published a first, preliminary version of the systemd.conf 2016 schedule . There is a small number of white slots in the schedule still, because we're missing confirmation from a small number of presenters. The missing talks will be added in as soon as they are confirmed. The schedule consists of 5 workshops by high-profile…
Please note that the systemd.conf 2016 Call for Participation ends on Monday, on Aug. 1st ! Please send in your talk proposal by then! We’ve already got a good number of excellent submissions, but we are very interested in yours, too! We are looking for talks on all facets of systemd: deployment, maintenance, administration, development. Regardless of whether you use it in the cloud, on embedded,…
Please note that the systemd.conf 2016 Call for Participation ends in less than two weeks, on Aug. 1st ! Please send in your talk proposal by then! We’ve already got a good number of excellent submissions, but we are interested in yours even more! We are looking for talks on all facets of systemd: deployment, maintenance, administration, development. Regardless of whether you use it in the cloud,…
The systemd.conf 2016 Call for Participation is Now Open! We’d like to invite presentation and workshop proposals for systemd.conf 2016 ! The conference will consist of three parts: One day of workshops , consisting of in-depth (2-3hr) training and learning-by-doing sessions (Sept. 28th) Two days of regular talks (Sept. 29th-30th) One day of hackfest (Oct. 1st) We are now accepting submissions for…
Announcing systemd.conf 2016 We are happy to announce the 2016 installment of systemd.conf, the conference of the systemd project! After our successful first conference 2015 we’d like to repeat the event in 2016 for the second time. The conference will take place on September 28th until October 1st , 2016 at betahaus in Berlin, Germany . The event is a few days before LinuxCon Europe, which also…
The Event Loop API of libsystemd When we began working on systemd we built it around a hand-written ad-hoc event loop, wrapping Linux epoll . The more our project grew the more we realized the limitations of using raw epoll: As we used timerfd for our timer events, each event source cost one file descriptor and we had many of them! File descriptors are a scarce resource on UNIX, as RLIMIT_NOFILE…
systemd.conf 2015 is Over Now! Last week our first systemd.conf conference took place at betahaus, in Berlin, Germany. With almost 100 attendees, a dense schedule of 23 high-quality talks stuffed into a single track on just two days, a productive hackfest and numerous consumed Club-Mates I believe it was quite a success! If you couldn't attend the conference, you may watch all talks on our YouTube…
Second Round of systemd.conf 2015 Sponsors We are happy to announce the second round of systemd.conf 2015 sponsors! In addition to those from the first announcement , we have: Our second Gold sponsor is Red Hat! What began as a better way to build software—openness, transparency, collaboration—soon shifted the balance of power in an entire industry. The revolution of choice continues. Today Red…
Only 14 tickets still available! systemd.conf 2015 is close to being sold out, there are only 14 tickets left now. If you haven't bought your ticket yet, now is the time to do it, because otherwise it will be too late and all tickets will be gone! Why attend? At this conference you'll get to meet everybody who is involved with the systemd project and learn what they are working on, and where the…
A Preliminary systemd.conf 2015 Schedule is Now Online! We are happy to announce that an initial, preliminary version of the systemd.conf 2015 schedule is now online! (Please ignore that some rows in the schedule link the same session twice on that page. That's a bug in the web site CMS we are working on to fix.) We got an overwhelming number of high-quality submissions during the CfP! Because…