Portable Services Are Ready To Use
summary
Systemd v239 implements portable services as ready-to-use units that run from either a directory or a loopback-mounted disk image (squashfs/EXT4), reuse existing unit files and /etc/os-release, and introduce no new metadata or OCI formats. Sandboxing is available via options like PrivateNetwork, PrivateDevices, per-service firewalling and accounting; dynamic users allocate UIDs at start, revoke them at stop, and bind state to per-service /var and /tmp with recursive chown. Images can be encrypted or dm-verity-verified; tooling is built into systemd and already shipping in recent distros.
AI-written summary · about
chapters (5)
- 0:00Start
- 21:39Use Case for Portable Services
- 30:57Private Devices
- 31:31Protect Kernel Logs
- 40:28User Database Mismatch
related talks
35mNew security features in systemd
31mSolving All the Problems with systemd
48mDemystifying Systemd for Embedded Systems
01h 05mImmutable and Stateless Systems with systemd
38msystemd @ Meta: From upstream to production
56mReinventing Home Directories
22mWhat's new in systemd in 2016?
57mNamespaces for Security