2️⃣5️⃣ Here's the 25th and last post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
systemd-networkd has a small internal DHCP server, so that it's easy to hand out IP leases to local networks, for example for use in virtual networks (veth tunnel pairs, for example), or for small LANs. With systemd v259 the server gained a new feature, you can now configure with EmitDomain=/Domain= whether and which DNS domain to announce for client use.
2️⃣4️⃣ Here's the 24th post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
systemd-resolved's configuration is a bit more complex (and dynamic!) than the venerable /etc/resolv.conf file. It by default has an understanding of per-interface query servers and domain routing and a lot more. So far this data could be queried via "resolvectl status", but accessing it via IPC has been quite involved: as the information shown is distributed on multiple…
1️⃣2️⃣ Here's the 12th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
systemd-vmspawn is a small wrapper around qemu that provides various VM integration points with systemd infrastructure, such as ready notification, credential passing, machined integration and so on.
With v259 it gained one additional little feature for integrating VMs better in the host:
1️⃣1️⃣ Here's the 11th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
In episode 7 of this series we already talked briefly about systemd-repart. There's another addition to systemd-repart in v259: there's now a pretty useful Varlink IPC available to systemd-repart.
It's generally useful, but I put it together with one use-case in mind in particular: to make systemd-repart useful for use in graphical installers. After all one of the things, …
1️⃣0️⃣ Here's the 10th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
This one is quick, and basically just a continuation of the previous episode: in order to show the current state of the NvPCRs, you may now use "systemd-analyze nvpcrs". This closely mirrors the existing "systemd-analyze pcrs" that shows you the current state of all regular PCRs.
3️⃣ Here's the 3rd post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
This one is quick and closely related to what I discussed in the previous installment:
There's now a new verb "dlopen-metadata" in systemd-analyze that extracts the dlopen() metadata from an ELF file and displays it in tabular form.
It's that time again! The systemd v259 release is coming closer. Let's restart the "what's new" series of posts for this iteration! Hence:
1️⃣ Here's the 1st post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
For many usecases it's quite useful if local services can register additional hostnames for local resolution. For example, container and VMMs might want to register the IPs of locally running containers or VMs via a hostname, so that you can…
RE: https://mastodon.social/@daandemeyer/115565105032166177
4️⃣ Here's the 4th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
For this one I am simply going to top-post @daandemeyer's story about run0's new --empower switch, which gives your process capability + polkit privileges, without changing your user ID. Very powerful stuff.
2️⃣ Here's the 2nd post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
If you have systemd v259 on your system, and you run "ldd /usr/lib/systemd/systemd" (i.e. query the shared library deps of the systemd service manager binary), then you get the following output:
📼 "systemd-ifying postmarketOS, our immutable future, and why Alpine is cooler than you thought"
Because people at @mediacccde are absolutely amazing, the talk is already up!
8️⃣ Here's the 8th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
systemd-modules-load.sevice is an early-boot service that loads a list of kernel modules into the kernel that is configured via /etc/modules-load.d/ (and similar dirs under /usr/ + /run/ as usual). It's half a legacy feature, because nowadays kernel modules are generally auto-loaded based on "modalias" information they expose, which binds them to certain hardware vendor/product …
6️⃣ Here's the 6th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
Here's a short one: systemd v259 will compile fine with musl libc, out of the box.
Sounds great? Well, it's not as great as it might sound to some. musl has quite some limitations compared to glibc: the primary one is that there's no Name Service Switch (NSS) support. That's the subsystem that allows systemd to make domain names, user names, groups names resolvable via…
7️⃣ Here's the 7th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
systemd-repart is systemd's dynamic, elastic image generation and repartitioning tool. It can either run "online" during early boot to create/encrypt root file systems or other partitions on the running system, or it can run "offline" to prepare images that can later be booted.
With systemd v259 it gained one new trick:
5️⃣ Here's the 5th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
One really fun feature of systemd-nspawn is the --bind-user= switch. If used it will make the specified user from the host (i.e. user record + $HOME) available inside the container. It's a really simple way to quickly get shared access to your home dir from host and container.
With v259 the same option is now available for systemd-vmspawn too. Or in other words, …
9️⃣ Here's the 9th post highlighting key new features of the upcoming v259 release of systemd. #systemd259 #systemd
Over the past months and years, systemd as acquired a number of features in the verified boot/TPM area. Verified boot means basically that in cooperation with a TPM a secure log is kept of what happens during runtime and in particular during boot, specifically that every component takes a hash value of the next component it starts (this is called "measuring").
1️⃣4️⃣ Here's the 14th post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
userdb is systemd's subsystem that tracks local user and group records, and is an extension of NSS if you so will, with a lot more fields, better security semantics, and accessible via IPC.
It's built on NSS semantics, and hence the primary operations have always been: search by UID/GID and search by name. It more recently learned fuzzy filtering of entries, and a…
1️⃣3️⃣ Here's the 13th post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
In episode 7 and 11 of this series we already talked about systemd-repart a bit. Here's another pair of features we added in 259: there are new switches --defer-partitions-empty= and --defer-partitions-factory-reset=. These take a boolean argument, and are closely related to the pre-existing --defer-partitions= switch.
To understand what the new switches do, let's…
1️⃣5️⃣ Here's the 15th post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
Here's a quick one: you might have noticed that whenever a systemd service deactivates we'll log a brief journal message saying the amount of CPU time consumed, and the peak memory used by this unit cycle. With v259 that message is slightly extended: it will now also indicate the wall clock time passed since activation of the unit. This is particularly nice when…
1️⃣6️⃣ Here's the 16th post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
systemd-firstboot is a small terminal tool that – if enabled – can run on first boot of a freshly installed system and interactively ask a number of very basic but essential configuration questions that are important to operate the system. It can be used in place of a fancier graphical tool, and maybe even act as blueprint for such a tool.
1️⃣9️⃣ Here's the 19th post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
Each systemd service has various ExecXYZ= stanzas that control what command to execute on which operation. Most importantly, there's of course ExecStart= which configures the command to run for actually starting the service. Then there's ExecStartPre=, ExecStartPost=, ExecReload=, ExecStop=, ExecStopPost=.
And with systemd v259 there's one more knob like this:
2️⃣1️⃣ Here's the 21st post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
In episode 16 we already talked about systemd-firstboot, systemd's little configuration console tool that can run on first boot and ask the user for a few simple basic questions regarding keymap or locale or such.
With v259 it received a small facelift of a kind. First of all, we'll now turn off concurrent log output from the kernel and from PID 1…
2️⃣0️⃣ Here's the 20th post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
systemd's unit ordering dependencies implement a directed graph, which is supposed to be acyclic, i.e. contain no cycles, so that it's always clear which units to activate before which other units.
But given that units are typically written by humans, the graph quite often actually does have cycles, and if that happens systemd has to break them somehow, …
2️⃣2️⃣ Here's the 22nd post highlighting key new features of the recently released v259 release of systemd. #systemd259 #systemd
In v258 systemd-nspawn gained support for running unpriviled containers from directories owned by the "foreign" UID range. To get container images owned by that you had to manually chown() the images (recursively), for example via systemd-dissect --shift. And while the systemd-nspawn invocation is not privileged, that re-chown()-ing definitely has requires privileges.
