Hacker News Reader

Comment by grepLeigh | Hacker News Reader

I've developed a distrust for anyone who hates on systemd in 2022, especially if their rationale is vague dogma like "it does more than 1 thing, it's not Unix-like!"

It's usually a signal that the person is not a practioner.

Systemd is the most important and well-developed Linux framework, besides the Linux kernel itself.

View on HN

I don't trust anyone's opinion, for or against, unless they've used alternatives. I've used systemd, I'll probably use it again, and I'll keep hating on it if someone gets me started. Fortunately on my own systems I've been a happy OpenRC user instead.

My S/O is a Gentoo maintainer so this comes up often in my household!

As a longtime user I thank your S/O, you're lucky to have them!

I've used both (OpenRC and systemd). I like the simplicity of OpenRC and still uses it on a few servers running on Gentoo, but on a laptop/desktop I think systemd is a better fit, having user services with user level logging for example.

Feigned certainty is often a indication of the opposite. In many cases people just absorb someone else's opinion on topics just in an effort to feel informed.

I'm not going to say I'm never guilty of it myself, but often asking even for the slightest bit of further explanation collapses that or otherwise just leads to repetition.

I mean have you actually used the alternatives? I find most of the people with that opinion are young pups who jumped on the linux train after most of the systemd bugs have been ironed out, but who still have zero experience with the alternatives.

I have used all the alternatives, and written my own init systems from 0.

Systemd is really well designed and makes Linux workstation use predictable and more secure across distros in numerous ways. You can have any service you want now, even xorg/ wayland, as an unprivileged user. It basically removes all need to use root if used correctly.

Systemd however is however not designed for server use, but neither is OpenRC or any of the alternatives. Servers filesystems should contain a kernel, a shim init binary, and a static binary for a target service.

When you want to upgrade your fleet you compile a new bundle of those three things into a new filesystem image and boot servers from the new image.

I mean it's pretty hard to debate the merits of systemd as a server init system when you think we should all be using come kind of containerization system :p

I did not say anything about containers.

One service per server? That seems incredibly wasteful.

One service per kernel. Hypervisors allow you to run many kernels on the same physical hardware.

Right, so instead of processes you have kernels, and instead of kernels you have hypervisors...

So like containers, but heavier weight and you need to pre-allocate ram for every ~~process~~ kernel?

It sounds like you've reinvented the multiprocessing operating system.

The Linux kernel is simply not designed to run trusted code and untrusted code at the same time. One service has a bug or a security flaw and everything goes down with it.

The sandboxing is a convoluted mess few even know where to start learning to use. Lets say you successfully configure process namespacing, network namespacing, filesystem namespacing, cgroups, and apparmor or selinux all correctly to restrict every last syscall. You will still get burned by a crash, resource exhaustion, or security breach due to the next of a long series of implementation bugs in each of these arcane features.

Humans cannot create a large codebase of coherent and provably correct C code with memory safety and they really should stop trying.

Hypervisors are the only sandbox that works reasonably well and burning some extra ram is cheaper than most security breaches.

> Systemd is really well designed and makes Linux workstation use predictable and more secure across distros in numerous ways. You can have any service you want now, even xorg/ wayland, as an unprivileged user. It basically removes all need to use root if used correctly.

It sometimes randomly fails to boot, waiting for some strange condition, while I am not able to intervene via keyboard in any way. That is "well designed"?

I run Xorg as unprivileged user by executing startx, on sysvinit system. There is no problem that needs systemd solution here.

Reply on news.ycombinator.com