Linux fu: getting started with systemd
hackaday.com
hackaday.com
I like a writer with perspective :)
I created a small language server for systemd unit files which may help those having to integrate services with it.
the windows service manager like UI of systemctl exploratory mode is one thing to tackle.
the lack of visibility on dependencies that are not obviously direct. or even relevant (like ssh depending on key generation at first boot, which depends on time, which depends on time sync, which depends on network target... which causes ssh to not get started, without any logs, if you don't have network... despite it not being the first boot... :mindblown)
i won't bother with whole list because 1. there's no alternative 2. "I'm just another systemd denier" like i wouldn't have to be using it from early on to accumulate so much grievances
That it's a mixture of before and requires (probably also wants, don't rememeber) does not make it easier.
Edit: Newer version have options to separate ordering from requirements. I don't think that existed on the system where I last used it.
hardly Far from a 99% use case.
loopback address space is not enough for the network target
In comparison systemd is well documented and you don't really need to ask people for help. You can easily use the shell, you don't have to battle with wrong nginx configurations that were autogenerated, because you wrote them and you know what you're doing.
Fleet was cool, but Redhat bought CoreOS and killed fleet, can't have a simple effective system, it has to be complex and enterprise so you can sell services and tutelage. Fucking IT people.
Many, if not most, companies don't need the things Kubernetes is designed for, though. It's interesting tech and I can see why people are drawn to it, but I feel like some people pick it more because they want to use Kubernetes rather than it solving a real problem a company or organisation is facing.
What K8s is good at - Running collections of stateless application servers. If you have a dozen copies of the same process that are all identical, K8s is right for you. There's a lot more it can do, but that's the one that is most common.
If you're hosting things like emergency services support, the extra spend and complexity can be worth it. It can even be worth it as a band-aid if your application isn't particularly stable and you want to increase uptime while you fight for developer capacity to fix the underlying design problems. If all of your IT team already understands Kubernetes, it may even be worth it to run it in scenarios where you want to set up and tear down quick development/test environments, assuming your company doesn't mind spending extra on Kubernetes specialists once the current IT team leaves.
It kind of was designed to be able to do anything and everything if you plug enough components into each other. That's probably why it's complex to the point of unusability; a framework that's designed to support an IRC server network ad much as it's designed to support MRI machines is very demanding for the people configuring it.
I think the problematic part is that many people portray it as "just fancy Docker that does most of the work for you". Once the cluster is set up, that's practically what it does, but the first time setup of Kubernetes is YAML spaghetti hell, and learning about tools upon tools upon YAML.
What's wrong with the official reference? https://kubernetes.io/docs/reference/kubernetes-api/ It has served me well.
Which is why I love the extreme compatibility and openness of Linux. systemd is free to stay and I'm free to just never use it. This fact only seems to bother one of the groups.
Because people think other people who they're not paying should not be allowed to rely on systemd for things and support other service managers.
How was the logging functionality of systemd abused by the xz backdoor?
As I understand it, just the mere fact liblzma runs on a schedule wouldn't cause it to do anything nefarious.
read on https://www.openwall.com/lists/oss-security/2024/03/29/4
look for the part: "These functions get resolved during startup"
nothing needs to call any code on libzma, just linking against it is enough to run the exploit.
"important part you missed again" comes off as rude to me. Check yourself.
Debian maintainers changed sshd to notify systemd when it is ready. This notification is only a few lines of code, but it's even _fewer_ lines if you call the sd_notify() convenience function in libsystemd.so
So now you're linking to libsystemd.so. What's also in libsystemd.so? Logging functionality, for programs that need to read systemd logs. That could be in a separate library, but this is systemd, so of course it's not. Everything's in one library. To read compressed systemd logs, libsystemd.so requires a bunch of compression libraries, including liblzma.so.
Anyone linking to libsystemd.so, e.g. to notify at startup, ends up loading liblzma.so, the backdoored version of which abuses glibc ifunc functionality to replace functions in libssl.so in order to take over sshd.
There are some very compelling arguments made there if you care to read them
https://sources.debian.org/patches/openssh/1:9.7p1-4/systemd...
If Lennart thinks through that position... sd_notify() shouldn't be in libsystemd.so at all, it's an attractive nuisance.
At best it should be in a static library only.
>You can probably puzzle most of that out.
That's hilarious. No, you can not. Why is there a "WantedBy" for multi-user.target when it is started "After" network.target and auditd.service? If you understand systemd the answer is obvious, but if you don't this should confuse you.
>It can replace inetd, syslog, and many other traditional services.
On Ubuntu it replaced the fstab.
>This is a benefit or a drawback, depending on your point of view.
I don't know from which perspective it is good to have one program extend itself into random unrelated areas and absorb their functionality into itself. Certainly no university course or anyone I ever worked with had that perspective. Usually people talked about defining and limiting scope and having a clear vision of what your software should do.
I think the "Unix Philosophy" debate is largely silly, mostly because it misses the point. Regardless of what some people in the 80s thought about UNIX system programming, it is bad software engineering to not have a defined scope for your software and let it sprawl endlessly.
Whether software should do one thing only is neither here nor there, but it certainly shouldn't do a couple dozen unrelated things while replacing perfectly functional existing system software.
nobody write code to get a mcse. there's a reason they were called mouse clicking solutions expert. redhat wants that too. faster and cheaper certification.
and yes it's a stupid plan. but everything noteworthy on Linux was contributed by companies. either when nobody was looking what a programmer was doing, or when some old code get donated, or thanks to stupid plans like this.
so we took it. it's not worse than before, and hopefully mr systemd will get bored counting money at Microsoft now and let the project evolve to something sane.
What an awful way to gate keep computing.
As a private individual you can obviously do whatever you want with your system, but if your job is technical support you need to be able to understand and write code at a basic level.
Nowadays everybody who has a technical job has to learn how to write code. It doesn't matter what that technical role is, but only will be more and more of a prerequisite to do anything.
If you can't read and write shell scripts you should not be allowed to perform system administration or support roles.
> The reason systemd has succeeded in becoming an SysV init replacement is simple: it did the work. Not only did it put together a lot of good ideas regardless of their novelty or lack thereof but its developers put in the time and effort to convince people that it was a good idea, the right answer, a good solution to problems and so on. Then they dealt with lots and lots of practical concerns, backwards compatibility, corner cases, endless arguments, and so on and so forth. I want to specifically mention here that one of the things the systemd people did was write extensive documentation on systemd's design, how to configure and operate it, and what sorts of neat things you can do with it. While this documentation is not perfect, most init systems are an order of magnitude less well documented.
[snip]
> You can call this marketing if you want, although I don't think that that's a useful label for what is really happening. I call this 'trying' versus 'not trying'. If you don't try hard and work hard to become a replacement init system, it should be no surprise when you don't.
[snip]
> Since that may not be clear, let me be plain: systemd is a better init system than the alternatives. It does more to solve real problems and it does it better. That alone is a good reason for it to win in the practical world, the one where people care about getting stuff done. That systemd is not necessarily novel or the first to come up with the ideas that it embodies is irrelevant to this. Implementation matters more than ideas.
I am not against new software, but if using a new piece of software, requires replacing dozens of other system components, then something is going very wrong.
The thought process behind people at Redhat who think "We need a new system logger, you know the init system is the perfect place to develop that" is just inexplicable to me.
for relatively obvious reasons
I like having my system boot faster because systemd takes care of lazily mounting my hard drives in the background.
Also, any init system can do lazy mounting without having the fstab file becoming a farce.