Version 262 of the systemd system and service manager is now available, incorporating significant improvements after three months of development. This release is notable for optimizing its architecture for lightweight virtualized environments, improving cryptographic protocols linked to Trusted Platform Modules (TPMs), and adding critical functionalities to native tools such as run0 and systemd-sysupdate.
With containers that require a minimal system footprint in mind, systemd now offers the ability to compile a single executable file with static linking. This compilation (enabled via Meson with parameters such as `-Dsystemd-multicall-binary=true` ) is designed to act as the startup process (PID 1) in very small containers, avoiding the use of `dlopen()` calls to load dynamic libraries and relying on a simplified user and group search instead of the standard NSS.
In addition, the executable now internally embeds a set of essential unit files ( such as basic.target, sysinit.target, multi-user.target, and reboot.target, among others). These embedded files are used as a fallback in case it's not possible to load the configurations from disk, allowing a container to boot without explicitly installing unit files.
Service management and fault recovery
To mitigate the risk of synchronized restarts when multiple services fail simultaneously, the `RestartRandomizedDelaySec` parameter has been introduced . This policy adds a random (uniformly distributed) delay before a service automatically restarts, which is added to the time configured in `RestartSec`. Additionally, slice units incorporate `ActivatingConcurrencyMax`, a limit that determines the maximum number of units that can be activated simultaneously within the hierarchy; any excess activations are queued until capacity slots become available.
In environments requiring continuous high availability (such as critical servers), the LUOSession parameter was implemented for service units. This parameter instructs systemd to create Live Update Orchestrator sessions, enabling hot updates of the system kernel without interrupting service operation and preserving the state of processes and devices.
TPM2, fscrypt, and storage security
Other new features in this version include the way sealed credentials in a TPM are now directly linked to their storage root key (SRK), preventing man-in-the-middle (MitM) attacks by intermediate components attempting to intercept decrypted data. TPM2 PIN credential registration via systemd-cryptenroll incorporates the Argon2id algorithm as the default, generating much more robust key material than the legacy implementation (direct/PBKDF2).
At the user storage level, systemd-homed has modified its behavior for directories encrypted using the fscrypt filesystem: new creations will default to the policies of version 2 (fscrypt v2), allowing the master key to reside in the filesystem's keyring and be visible across different mount namespaces. fscrypt v1 directories will remain functional, although they will not have an in-place upgrade path to v2.
In addition, native boot support was included for the dm-clone kernel module, which allows the generation of modifiable clones from read-only block devices, processed by the systemd-clonesetup-generator by reading from /etc/clonetab.
Atomic upgrades and environmental changes
The systemd-sysupdate suite, designed for system updates by atomicly replacing partitions and directories, now maintains a persistent database of installed files. The cleanup command has been added to purge redundant files , and the concept of "suggested components" has been adopted. These components can be dynamically evaluated based on the machine's architecture or MachineTags to automate driver installation.
Other significant changes in version 262 include:
- systemd-vmspawn: Adds support for running confidential virtual machines under the Intel TDX architecture (–coco=tdx), joining AMD SEV-SNP.
- OpenSSL and Registration: The record immutability system (Forward Secure Sealing, FSS) is being migrated from the libgcrypt library to OpenSSL's native cryptographic functions. Initial compilation support for OpenSSL 4 is also being added.
- Terminal and Usability: The run0 privilege escalation utility adds sudo-compatible options such as -k, -K, and -v to reset or validate Polkit's authorization timeout. vconsole allows setting the font size to 100% or 200% using FONT_SCALE, and password prompts for FIDO2 tokens will now display the remaining PIN attempts.
- systemd-sysctl: It now includes the –verify flag to check by rereading that the value written to the system was actually applied.
Finally, if you are interested in learning more, you can find the details at the following link.