systemd
RE: https://mastodon.social/@daandemeyer/116144059697098766
1️⃣9️⃣ Here's the 19th post highlighting key new features of the recently published v260 release of systemd. #systemd260 #systemd
For this one, I am just gonna quote @daandemeyer about the delegation of multiuple UID ranges.
2️⃣0️⃣ Here's the 20th post highlighting key new features of the recently published v260 release of systemd. #systemd260 #systemd
One ongoing project inside of systemd is to rework systemd-nspawn to not do its own namespacing/sandboxing but make it mostly just a frontend to systemd's own namespacing/sandboxing that is implemented for system services. The goal is to make it play a role similar to systemd-run: i.e. a command line tool that just allocates a transient service, and thus simplify…
2️⃣1️⃣ Here's the 21st and last post highlighting key new features of the recently published v260 release of systemd. #systemd260 #systemd
If you have been following this series of posts I am sure you recognized some repeating themes. One of them is the progressing Varlinkification of systemd's functionality. The last item on my list of features to post about for v260 is another one in this theme:
"bootctl install" is what gets systemd-boot installed in your ESP. With v260 there's now a Varlink…
1️⃣4️⃣ Here's the 14th post highlighting key new features of the upcoming v261 release of systemd. #systemd261 #systemd
When running a data center one typically has two conflicting goals: on one hand payloads should have maximum uptime, and not be interrupted in service if at all possible, on the other hand software should be updated quickly whenever security vulnerabilities become public. Security updates mean service interruptions, but those you do not want.
Updating an OS comprehensively…
1️⃣6️⃣ Here's the 16th post highlighting key new features of the upcoming v261 release of systemd. #systemd261 #systemd
/etc/hosts is a really powerful concept: it allows assigning a hostname to addresses in a local fashion, without having to ask anyone. But it's also a very old and basic concept: these days we are accustomed to drop-in configuration files (i.e. in an /etc/hosts.d/* sense), and DNS RRs exist, hence a bit more expressiveness than just the equivalent of A/AAAA/PTR would be great.
1️⃣5️⃣ Here's the 15th post highlighting key new features of the upcoming v261 release of systemd. #systemd261 #systemd
In a previous episode of this series we already talked a lot about installing operating systems, and the new features systemd v261 brings for that. There's one more item in this area I'd like to talk about:
You know systemd-repart is that dynamic partitioner that can also be used for building disk images and as an installer for image-based operating systems. In the latter…
1️⃣3️⃣ Here's the 13th post highlighting key new features of the upcoming v261 release of systemd. #systemd261 #systemd
In the first episode of this series for v261 we discussed the new El-Torito/CD-ROM support in systemd-repart. As a reminder, the main problem with having a unified image that boots from both regular disks and CD-ROMs is the different sector sizes: regular disks typically use 512 byte sectors, CD-ROMs use 2048 byte sectors. The sector size dictates where…
2️⃣7️⃣ Here's the 27th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
Back in v258 we added ConcurrencyMax= to slice units, which allows pacing activation of units assigned to the slice. The knob puts a limit on how many units may be in "active" state at the same time. It turns systemd into a powerful run queue system: just queue services into a slice that uses the setting, and they'll be processed as the concurrency limit allows.
2️⃣6️⃣ Here's the 26th post highlighting key new features of the recently released v261 release of systemd. #systemd261 #systemd
When dealing with VMs, you have to think about dealing with storage, too: how do you connect your block devices and file systems to your VMs.
For a while now systemd has been shipping systemd-vmspawn, a small wrapper around qemu, which integrates it in various ways into the system, for example registers it with systemd-machined and a variety of other things.
2️⃣7️⃣ Here's the 27th post highlighting key new features of the recently released v261 release of systemd. #systemd261 #systemd
systemd-oomd is systemd's subsystem for optimizing system behaviour under memory pressure (i.e. shut down services to remedy memory pressure and similar). So far it has been applying very similar policies for dealing with pressure on all workload services on the system.
With v261 we are extending the concepts around this considerably. systemd-oomd can now read a number…
2️⃣5️⃣ Here's the 25th post highlighting key new features of the recently released v261 release of systemd. #systemd261 #systemd
The systemd-socket-proxy tool has been part of the systemd toolset for a long long time, but is probably not known by many. It was originally created to add "fake" socket activation support to daemons that do not support it natively: the tool implements the socket activation, can be wrapped in appropriate socket activation unit files, and when activated…
It's that time again! The systemd v262 release is coming closer. Let's restart the "what's new" series of posts for this iteration! Hence:
1️⃣ Here's the 1st post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd
Back in systemd v258 we added support for a special "?" character in /etc/hostname.
5️⃣ Here's the 5th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd
systemd-sysupdate is a tool for updating files and partitions from a source typically on the Internet, to implement OS updates or updates of container, VM, extension or service images. It's mostly built around the concept of a "transfer" file, that does primarily one thing: it declares where to find new resources on the internet and where to place them locally. The tool then…
6️⃣ Here's the 6th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd
In systemd v260 we added the "systemd-report" subsystem that provides a unified way to gather metrics from running services, that would like to offer them. Many of systemd's own subsystems implement providers for this now, and the systemd-report tool can compile them into a single report JSON document.
With v262 this functionality is upgraded in one fundamental way:
4️⃣ Here's the 4th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd
In systemd v261 we introduced the concept of "machine tags", i.e. a set of free-form, user chosen strings you can attach to a host. They are stored in /etc/machine-info along with some other metadata fields about the host.
In v262 the concept is further extended. First of all, the strings may now also have the form "key=value" in addition to simple strings without "=", as…
1️⃣2️⃣ Here's the 12th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd
For a while now systemd has provided the "systemd-confext" subsystem. It enables a form of atomic, reversible, secure configuration management: you wrap up configuration files in a UAPI.3 DDI, drop it on a node, run systemd-confext --refresh and it will merge the files from the DDI into your /etc/ through overlayfs. Later, drop in a different version, delete the old one, …
1️⃣4️⃣ Here's the 14th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd
systemd is large collection of modular tools and services, that work nicely together. Currently if you install them all you get something like ~175 binaries. Downstream distributions tend to split these into a number of software package, which you can install separately, but I guess compared to certain other init systems, yes, we cover a lot with a lot of separate binaries.
1️⃣3️⃣ Here's the 13th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd
The Linux kernel's console doesn't particularly receive much development these days, and neither in the previous decade or so. Because of that it hasn't really caught up with modern technical developments, such as HiDPI screens. In many scenarios it makes the console barely usable: output in a teeny-tiny font somewhere in the top-left of your screen, requiring a microscope to…
2️⃣0️⃣ Here's the 20th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
In systemd v261 we added the new "bootctl link" command, which allows managing boot menu in a commit/rollback style fashion by combining, UKIs, credentials, sysext, confext into an UAPI.1 type #1 boot loader entry, and managing space on the ESP at the same time.
"bootctl link" requires specifying the resources to combine in the boot loader entry on the command line.
2️⃣2️⃣ Here's the 22nd post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
Initially, there was /etc/crypttab. And then there was /etc/veritytab, and soon followed /etc/integritytab. With v262 there's also /etc/clonetab.
All of these manage a type of device mapper target that is important when building an OS: dm-crypt (encryption, i.e. LUKS), dm-verity (immutable integrity), dm-integrity (writable integrity) and dm-clone (live…
2️⃣6️⃣ Here's the 26th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
When a new system is automatically deployed, a key part of it is to adapt the installation to the system it is deployed on. That can mean many things, but let's focus on one: there's a good chance some hardware-specific software needs to be installed, for example in form of a sysext, e.g. an extension image with additional drivers, or subsystems.
2️⃣8️⃣ Here's the 28th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
The purpose of confext images is to carry configuration files to apply to the system. Typically, these configuration files belong to some system service, and it hence would be useful to restart or reload that service when the confext is applied.
With v262 there's now support for that. The extension-release file that is included in the confext and describes it, …
2️⃣9️⃣ Here's the 29th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
In v261 systemd-vmspawn gained support for invoking AMD style confidential computing (CoCo) VMs via --coco=sev-snp. What it didn't support then was passing systemd system credentials into them. As on AMD-sytel CoCo there's only one initial measurement done, and that measurement only covers kernel and initrd, the usual way we pass credentials into VMs (SMBIOS#11) simply…
3️⃣0️⃣ Here's the 30th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd
Whenever a TPM chip is manufactured by the vendor it's supposed to be provisioned with a signed certificate ("EKcert") that is supposed to prove it's an authentic TPM.
Interestingly the key pair that this certificate is about is typically *not* persisted on the TPM chip. How can that be?