Tag: systemd

Run a job the moment a file lands. A systemd .path unit plus a oneshot service, tested triggers, the retrigger loop that kills it, and when inotifywait wins.

systemd DynamicUser=yes plus StateDirectory= gives a daemon a throwaway UID and a private data folder. No useradd, no dead accounts. Here are the four traps.

Let a group restart one systemd service with a polkit JavaScript rule instead of a sudoers NOPASSWD line. Tested rule, a sudo comparison, and debugging gotchas.

Stop putting passwords in Environment=. systemd credentials hand secrets to services as locked-down files, encrypted at rest. Setup plus a demo you can run.

systemd-run starts transient services, scopes, and timers with resource limits and sandboxing, no unit file needed. Replace nohup, at, and ulimit habits.

Your service dies and restarts forever. Read the core dump instead of the restart log: coredumpctl, gdb, debuginfod, storage limits, and Docker containers.

Service dies after reboot because /run/myapp vanished? Learn tmpfiles.d line types, Age cleanup, overrides, and when RuntimeDirectory= is the better pick.

journald already stores structured key/value log fields. Learn to write custom fields, query them, and ship logs to one box before reaching for Loki or ELK.

systemd-homed turns your home dir into a portable LUKS-encrypted blob. Move it between machines, unlock with FIDO2, and own your own data.

cgroups v2 unified hierarchy explained: read /sys/fs/cgroup/, limit CPU/IO/memory, use systemd slices and PSI pressure files.

systemd-resolved does way more than mangle /etc/resolv.conf. Here's how its stub resolver, split DNS, DoT, DNSSEC, and resolvectl actually work.

systemd-nspawn ships on every modern Linux box and most sysadmins have never touched it. Here's when this no-daemon, no-Docker-socket container runtime is actually the right tool.