Supervising and scheduling work the modern way: units, timers, resource limits, and journald.
12 posts
systemd-creds encrypts a secret to the host (or TPM) so only systemd can decrypt it at service start. LoadCredentialEncrypted= hands it to the service via a tmpfs $CREDENTIALS_DIRECTORY — no plaintext on disk, no env var in /proc. Real output, honest limits.
A hands-on comparison of systemd-networkd and NetworkManager with real output: .network files vs nmcli connection profiles, the same static IP configured both ways, how each feeds systemd-resolved, and why running both is a bad idea.
Restart=on-failure only catches processes that exit. This shows how WatchdogSec plus sd_notify heartbeats catch the ones that hang instead, with real systemd journal output, StartLimitBurst crash-loop protection, and Type=notify readiness.
systemd-resolved is the local caching stub resolver on 127.0.0.53 that most systems already run — and quietly bypass. A hands-on tour of resolvectl, the cache, split DNS, DNS over TLS and mDNS, with real output from an Arch box.
A hands-on tour of journalctl and the systemd journal on a real Arch host: filter by unit, priority and time, follow logs live, read journal fields like _SYSTEMD_UNIT and _PID, add custom fields, script with -o json, and manage journald retention with --disk-usage and vacuum.
systemd socket activation, made concrete: systemd owns the listening socket (ListenStream), starts your service on the first connection, and passes the fd via sd_listen_fds. Real systemctl --user output, the .socket/.service pair, systemd-socket-activate, and the honest tradeoffs.
A ground-up walkthrough of the Linux boot process on a real Arch Linux laptop: UEFI firmware and the ESP, GRUB, kernel and initramfs, systemd as PID 1, the sysinit → basic → multi-user → graphical target chain, systemd-analyze timing, and a debugging playbook for slow or failed boots.
The systemd unit file directives I actually use: ExecStart, EnvironmentFile, User, After vs WantedBy, Restart=on-failure and start limits, Type=simple vs exec vs oneshot, journal logging, timers, systemctl edit drop-ins, and a real systemd-analyze verify failure I fix.
How to sandbox systemd services without breaking them: the directives that matter (NoNewPrivileges, ProtectSystem=strict, PrivateTmp, SystemCallFilter, CapabilityBoundingSet, dynamic user), an incremental workflow measured with systemd-analyze security, and how to test and roll a unit back.
A look at systemd timers vs cron: same job as a crontab line vs a .service + .timer pair, journalctl logging, Persistent=true catch-up, OnCalendar syntax, RandomizedDelaySec, resource limits, environment handling, and the systemd-analyze calendar trick — plus when cron is still the right call.
A copy-paste checklist to secure a Linux server: SSH hardening, a default-deny firewall, fail2ban, unattended security updates, sysctl basics, nginx headers, log rotation and tested backups. Plus what not to do.
Docker is not the only way to run services. How I host sites and scheduled jobs on one VPS with nginx, systemd units and timers, flock for single-flight work, and atomic symlink deploys — plus the cases where containers really are the right call.