Immutable and Stateless Systems with systemd
summary
Describes a practical stack for fully auditable read-only OS images: UEFI-signed kernels, boot metadata tying kernels to specific images, and block-level verification so any offline tamper is detected at access time. Uses dm-verity on-access verification, a simple A/B atomic update pattern to avoid half-upgrades, and a developer tool that builds images with keys and partition tables so the trust chain is reproducible. Components (systemd, Verity, mkosi image+trust-chain generator, systemd volatile boot modes) are implemented today; some update/rollout tooling remains work-in-progress.
AI-written summary · about
chapters (4)
related talks
32mWhat's new in systemd
52mSurviving in the Wilderness: Integrity Protection and System Update
35mHardening OS Distribution: Verifiable and sealed OS with bootc and composefs
46mVerifiable End To End Secure OCI Native Machines
43mTowards Secure Unified Kernel Images for Generic Linux Distributions and Every...
01h 18mSystemd & TPMs
34mAuthenticated and Encrypted Storage on Embedded Linux
45mFull Disk Encryption for Confidential Computing Guests