Hands-on guide series
systemd Deep Dive: A Hands-On Guide
A seven-part, hands-on guide to systemd on a single VPS: the unit model and how boot resolves, writing services that recover from a crash, journald and journalctl, timers versus cron, sandboxing and security scoring, cgroups v2 resource control, and socket activation with user services. Every command tested on a live Ubuntu 24.04 server.
What you will build
Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.
- 1
Unit Files and the systemd ModelTurn a bare script into a systemd service that survives a crash, then read the systemd unit files behind it: sections, systemctl cat and drop-ins.8 min - 2
Writing systemd Services WellWrite a systemd service that behaves: pick the right Type, set Restart=on-failure, order it after its dependencies, and watch systemd recover a crash.7 min - 3
journald and journalctl in DepthDrive journalctl to query systemd logs by unit, priority and time, read the structured JSON fields, make the journal persistent, and trim it safely.6 min - 4
systemd Timers vs cronReplace cron with systemd timers: schedule with OnCalendar, catch up a missed run with Persistent, add a randomized delay, and list what is armed.6 min - 5
Sandboxing and Hardening a UnitApply systemd sandboxing to a service: ProtectSystem, NoNewPrivileges and a syscall filter, then watch the exposure score fall on a live server.6 min - 6
Resource Control with cgroups v2Use systemd resource control to cap a service: set MemoryMax and CPUQuota, watch a cgroup OOM-kill a memory hog, and throttle a busy loop to a fifth of a core.6 min - 7
Socket Activation and User ServicesStart a service on demand with systemd socket activation, prove the lazy start on first connection, then run user services that survive logout with linger.6 min