this post was submitted on 09 Jul 2025
135 points (85.0% liked)

Linux

13563 readers
429 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
135
systemd has been a complete, utter, unmitigated success (blog.tjll.net)
submitted 10 months ago by cm0002@programming.dev to c/linux@programming.dev
49 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] Quik@infosec.pub 75 points 10 months ago* (last edited 10 months ago) (7 children)

One thing the author probably hasn't done yet or just doesn't mention is that you can configure .container services with systemd-podman units (often called quadlets), e.g. a simple MariaDB container would look like this:

[Unit]
Description=MariaDB container

[Container]
Image=docker.io/mariadb:latest
Environment=MYSQL_ROOT_PASSWORD=rootpassword
Environment=MYSQL_USER=testuser
Environment=MYSQL_PASSWORD=testpassword
Environment=MYSQL_DATABASE=testdb

[Install]
WantedBy=multi-user.target

Short intro Full reference

This is superb, because it means your containers finally feel well-integrated with the rest of the OS and you can use systemctl, journalctl, etc. just like you would with other services.

Personally, I use this as an alternative to Podman/Docker compose and have been very happy with it running rootless containers from Nextcloud, Pufferpanel, Forgejo, Authentik, etc. (ask me for .container files if you need any help, I'm currently working on a small repo with a collection)

[–] Fedegenerate@lemmynsfw.com 16 points 10 months ago (2 children)

Excuse me, peasant crontab enjoyer here, but what?! I could write a (mostly) declarative system without having to learn Nix?! I should probably be learning systemd anyway, it's looking more and more like the present, let alone the future.

I run a bunch of remote reverse proxies that are functionally identical, but for having a different Cloudflare key and calling for a different static IP

Could I write the entire config to a self hosted Git > pull that repo > change those two variables and have a running machine?

Remote updates have been kicking my ass, I either can't wrap my head around Screen or it isn't fit for my need. Being able to pull the new config from Git over Tailscale and then run it would be game changing for me.

[–] Botzo@lemmy.world 13 points 10 months ago (1 children)

If you need a half step on your journey, convert your crontab to systemd timers first.

[–] Fedegenerate@lemmynsfw.com 9 points 10 months ago

In fact, I do need a half step. Legend, thank you.

[–] rutrum@programming.dev 4 points 10 months ago

Most compiled output of NixOS configuration (besides packages, perhaps) is just systemd units anyway. I found out quickly when learning nix that my lack of systemd prowess was going to cap how well I could understand NixOS.

[–] sip@programming.dev 12 points 10 months ago

awesome!

[–] monomon@programming.dev 5 points 10 months ago (1 children)

It's amazing, the gitea container supports this. Autostarts on machine restart, etc.

[–] Quik@infosec.pub 2 points 10 months ago

Yeah, it's great that Gitea/Forgejo has a copy-paste snippet in the docs, but you can actually use that with pretty much every container.

There is this useful tool to convert containers, podman commands or even compose files to podman-systemd units: https://github.com/containers/podlet

[–] Feyd@programming.dev 4 points 10 months ago

TIL. That's pretty useful!

[–] renegadespork@lemmy.jelliefrontier.net 4 points 10 months ago (1 children)

That’s neat! There’s so many advanced features of systemd I swear I learn something new every time it comes up.

[–] JadedBlueEyes@programming.dev 2 points 10 months ago

This is due to systems generators allowing Podman to plug in to that system

[–] BarbecueCowboy@lemmy.dbzer0.com 2 points 10 months ago (2 children)

That idea feels very useful but I also distrust it and it makes me angry for reasons I can't articulate.

[–] Quik@infosec.pub 3 points 10 months ago

Your distrust is kind of reasonable: I've been using this a lot for the past year and there definitely were two or three moments where it was a bit annoying, too little transparent on what commands will be run, etc.

[–] possiblylinux127@lemmy.zip 0 points 10 months ago

Do the reasons include gate keeping?

[–] dwt@feddit.org 0 points 10 months ago (2 children)

I like this, but even though pod man runs perfect rootless, quadlets can only run as root for now :-(

[–] mholiv@lemmy.world 4 points 10 months ago* (last edited 10 months ago) (2 children)

Not true. I run them rootless on my server as we speak. :)

[–] Quik@infosec.pub 3 points 10 months ago (1 children)

Same here; Rootless Podman Quadlets gang unite (there is two of us in total)

[–] Botzo@lemmy.world 3 points 10 months ago

Make that 3!

[–] dwt@feddit.org 1 points 10 months ago (1 children)

How do you do that? Please link a description. This has been a major stumbling block for me

[–] mholiv@lemmy.world 1 points 10 months ago* (last edited 10 months ago) (1 children)

Are you placing your service files in ~/.config/containers/systemd of the home dir of the user you want them to run as?

Here is a link: https://linuxconfig.org/how-to-run-podman-containers-under-systemd-with-quadlet

[–] dwt@feddit.org 1 points 10 months ago (1 children)

Yeah, that works, but it means the services cannot be managed by systemctl as root anymore. Or am I missing something?

[–] mholiv@lemmy.world 2 points 10 months ago* (last edited 10 months ago)

You can if you want to. But I don’t think that is best practice. The idea of quadlets is the bring Linux norms to containers. You contain and manage all permissions for that container in that user.

I personally have completely separated users and selinux mls contexts for each container group (formerly docker compose file) and I manage them thusly. It’s more annoying but it substantially more secure.

This being said I think you can do it as root. I think this might work but I am not certain sudo systemctl --user -M theuser@ status myunit.service

[–] Quik@infosec.pub 2 points 10 months ago (1 children)

Just place your Quadlets in the $HOME/.config/containers/systemd/ directory for this ;)

The reference I linked to earlier also contains more information on rootless.

[–] dwt@feddit.org 1 points 10 months ago (1 children)

While that is true, that is not how I would run services normally with SystemD. Those would be defined globally, but run as a user.

Definitiv then in the user home, means that I dint see them with systemctl which is very annoying.

[–] Quik@infosec.pub 2 points 9 months ago

Yes, you'd have to do systemctl --user