3 ms·

I mean have you actually used the alternatives? I find most of the people with that opinion are young pups who jumped on the linux train after most of the syste

I mean have you actually used the alternatives? I find most of the people with that opinion are young pups who jumped on the linux train after most of the systemd bugs have been ironed out, but who still have zero experience with the alternatives.

lrvick 4y ago
I have used all the alternatives, and written my own init systems from 0. Systemd is really well designed and makes Linux workstation use predictable and more secure across distros in numerous ways. You can have any service you want now, even xorg/ wayland, as an unprivileged user. It basically removes all need to use root if used correctly. Systemd however is however not designed for server use, but neither is OpenRC or any of the alternatives. Servers filesystems should contain a kernel, a shim init binary, and a static binary for a target service. When you want to upgrade your fleet you compile a new bundle of those three things into a new filesystem image and boot servers from the new image.
- traverseda 4y ago
  I mean it's pretty hard to debate the merits of systemd as a server init system when you think we should all be using come kind of containerization system :p
  - lrvick 4y ago
    I did not say anything about containers.
    - traverseda 4y ago
      One service per server? That seems incredibly wasteful.
      - lrvick 4y ago
        One service per kernel. Hypervisors allow you to run many kernels on the same physical hardware.
        traverseda 4y ago
        Right, so instead of processes you have kernels, and instead of kernels you have hypervisors... So like containers, but heavier weight and you need to pre-allocate ram for every ~~process~~ kernel? It sounds like you've reinvented the multiprocessing operating system.
        lrvick 4y ago
        The Linux kernel is simply not designed to run trusted code and untrusted code at the same time. One service has a bug or a security flaw and everything goes down with it. The sandboxing is a convoluted mess few even know where to start learning to use. Lets say you successfully configure process namespacing, network namespacing, filesystem namespacing, cgroups, and apparmor or selinux all correctly to restrict every last syscall. You will still get burned by a crash, resource exhaustion, or security breach due to the next of a long series of implementation bugs in each of these arcane features. Humans cannot create a large codebase of coherent and provably correct C code with memory safety and they really should stop trying. Hypervisors are the only sandbox that works reasonably well and burning some extra ram is cheaper than most security breaches.
- effie 4y ago
  > Systemd is really well designed and makes Linux workstation use predictable and more secure across distros in numerous ways. You can have any service you want now, even xorg/ wayland, as an unprivileged user. It basically removes all need to use root if used correctly. It sometimes randomly fails to boot, waiting for some strange condition, while I am not able to intervene via keyboard in any way. That is "well designed"? I run Xorg as unprivileged user by executing startx, on sysvinit system. There is no problem that needs systemd solution here.

lrvick 4y ago

I have used all the alternatives, and written my own init systems from 0. Systemd is really well designed and makes Linux workstation use predictable and more secure across distros in numerous ways. You can have any service you want now, even xorg/ wayland, as an unprivileged user. It basically removes all need to use root if used correctly. Systemd however is however not designed for server use, but neither is OpenRC or any of the alternatives. Servers filesystems should contain a kernel, a shim init binary, and a static binary for a target service. When you want to upgrade your fleet you compile a new bundle of those three things into a new filesystem image and boot servers from the new image.

traverseda 4y ago
I mean it's pretty hard to debate the merits of systemd as a server init system when you think we should all be using come kind of containerization system :p
- lrvick 4y ago
  I did not say anything about containers.
  - traverseda 4y ago
    One service per server? That seems incredibly wasteful.
    - lrvick 4y ago
      One service per kernel. Hypervisors allow you to run many kernels on the same physical hardware.
      - traverseda 4y ago
        Right, so instead of processes you have kernels, and instead of kernels you have hypervisors... So like containers, but heavier weight and you need to pre-allocate ram for every ~~process~~ kernel? It sounds like you've reinvented the multiprocessing operating system.
        lrvick 4y ago
        The Linux kernel is simply not designed to run trusted code and untrusted code at the same time. One service has a bug or a security flaw and everything goes down with it. The sandboxing is a convoluted mess few even know where to start learning to use. Lets say you successfully configure process namespacing, network namespacing, filesystem namespacing, cgroups, and apparmor or selinux all correctly to restrict every last syscall. You will still get burned by a crash, resource exhaustion, or security breach due to the next of a long series of implementation bugs in each of these arcane features. Humans cannot create a large codebase of coherent and provably correct C code with memory safety and they really should stop trying. Hypervisors are the only sandbox that works reasonably well and burning some extra ram is cheaper than most security breaches.
effie 4y ago
> Systemd is really well designed and makes Linux workstation use predictable and more secure across distros in numerous ways. You can have any service you want now, even xorg/ wayland, as an unprivileged user. It basically removes all need to use root if used correctly. It sometimes randomly fails to boot, waiting for some strange condition, while I am not able to intervene via keyboard in any way. That is "well designed"? I run Xorg as unprivileged user by executing startx, on sysvinit system. There is no problem that needs systemd solution here.