systemd Basics

Every Linux server you’ll touch runs systemd. Learn five unit types, five commands, and one config file — that’s 90% of the day-to-day.

Unit types you’ll see

Suffix	What it describes
.service	A long-running process
.socket	A socket-activated service
.timer	A cron replacement
.target	A grouping (like a runlevel)
.mount	A filesystem mount, alternative to /etc/fstab

The service unit you’ll write

/etc/systemd/system/reetwiz-api.service

[Unit]
Description=Reetwiz API
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
User=reetwiz
Group=reetwiz
WorkingDirectory=/opt/reetwiz-api
ExecStart=/opt/reetwiz-api/bin/api
Restart=on-failure
RestartSec=5s

# Sandboxing
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/reetwiz-api

[Install]
WantedBy=multi-user.target

Free sandboxing

Those five Protect* / Private* directives cost nothing and prevent a compromised service from touching most of the filesystem or reading other users’ data. Add them to every unit.

Verify hardening

systemd-analyze security reetwiz-api.service
# Overall exposure level: 2.1 OK

Aim for < 3.0.

Timers — the cron replacement

Service (the work)

/etc/systemd/system/backup.service

[Unit]
Description=Nightly backup

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup.sh

Timer (the schedule)

/etc/systemd/system/backup.timer

[Unit]
Description=Run nightly backup

[Timer]
OnCalendar=*-*-* 02:30:00
Persistent=true
RandomizedDelaySec=15min

[Install]
WantedBy=timers.target

Why timers > cron

• Missed runs (host was off) are retried when Persistent=true.
• Randomized delays smooth herd effects across fleets.
• Logs land in the journal with the service’s identity — no more grepping /var/log/cron.

Sockets — auto-start on connect

/etc/systemd/system/echo.socket

[Unit]
Description=Echo socket

[Socket]
ListenStream=127.0.0.1:2222
Accept=yes

[Install]
WantedBy=sockets.target

Now the service is started only when someone connects. Great for infrequently-used tools.

The five commands

1. Reload after editing units

   sudo systemctl daemon-reload

2. Enable + start

   sudo systemctl enable --now reetwiz-api.service

3. Status + recent logs

   systemctl status reetwiz-api.service

4. Follow logs

   journalctl -u reetwiz-api.service -f --since=-15m

5. What’s blocking boot?

   systemd-analyze blame | head -20
   systemd-analyze critical-chain

Cheat sheet: file locations

• Directory/etc/systemd/system/ # your custom units (highest precedence)

  • …
• Directory/run/systemd/system/ # runtime-generated units

  • …
• Directory/lib/systemd/system/ # distribution defaults

  • …
• /etc/systemd/journald.conf # journal size, forwarding
• /etc/systemd/logind.conf # session limits, tty handling