Chaos Computer Club - recent audio-only feed

The limitations of systemd-sysext/confext from the early days are mostly gone nowadays. The loading of extension images from the initrd means that generic content will behave as expected without any workarounds. New settings help making live reconfiguration work better as well. We will see how declarative configuration management with systemd-sysext/confext from git can be done with an OpenTofu/Te...

The storage directory settings in systemd help define where services store their data. Two important features have been implemented for these directories. The first one is id-mapped mounts, which is a filesystem feature that allows a mount namespace to show a different UID than what is stored on a file. Storage directories now support id-mapping, so that the files within the mount namespace of a s...

Immutable, image-based Linux has gone mainstream — on Fedora. Nearly every atomic distro descends from the RPM/ostree lineage. Debian is conspicuously rare, with really only Vanilla OS and Endless OS to its name. There's a reason, and it's apt: Debian's package manager expects a writable root filesystem, so the moment you seal the rootfs, the native way to install and update software stops working...

Recently systemd acquired functionality to download & invoke OCI containers directly. In this talk I'd like to explain where we are at with this, what we have, where the gaps are and where we are going, to make OCI containers a thing you can directly execute with systemd, without external tools. Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/ about this event: https://...

Using mkosi and apparmor.d as building blocks, this talk presents a prototype minimal Debian server. The goal is not to provide yet another Linux distribution, but to explore how hard it is to build personalized, hardened server images. On top of the usual mkosi-backed features such as UKIs, A/B updates and dm-verity, the project adds a whole-system AppArmor policy and an immutable `/etc`. Because...

Systemd can now be linked as a single static binary, which is enough to run a "full system" container that boots into a running manager. Transient units can then be used to do more things in the container. Thanks to systemd-nsresourced and systemd-mountfsd, this now works fully unprivileged and with no suid helpers. I want to show that this actually works and can be used for experimentation, devel...

For a while, the standard way to run Podman containers under systemd was podman generate systemd. It worked, but the output was static and awkward to maintain. Quadlet replaced it — and most guides stop at "drop an INI file in a directory and your container starts." leaving the machinery a black box. This talk demystifies that black box, because the internals are exactly what you reach for when th...

Linux doesn't have a unified way to be installed. Every distribution implements their own installer with a different feature set and UX. systemd-sysinstall is a tool to install an OS to a device. It leverages repart to format the disk and bootctl to manage UEFI and the boot partition and supports disk encryption and TPM integration. In addition, it exposes a varlink interface to be used by graphic...

sdme is a single static binary that boots systemd-nspawn containers using copy-on-write roots (overlayfs layers or btrfs snapshots), with OCI registry pulling and Kubernetes Pod YAML support. No daemon, no runtime dependency beyond the systemd you already run. Why I built it. Every container runtime reinvents what systemd already does well: process supervision, logging, cgroups, service ordering,...

This talk will present the newest updates and advancements in NixOS related to Secure & Measured Boot. It will take a look at what we have achieved this far, what issues we have come across, what we would like to see from the ecosystem, and what we are working towards next. Additionally, it will go over some other exciting things that happened related to systemd in NixOS. Key advancements: - [Supp...

Recent years have spurred much discussion in Linux communities about the idea of building an OS that is both Trusted and Immutable. While successful in many ways, attempts to implement these ideas have created numerous sharp edges for end users. At the same time, these initiatives bear many advantages for the ecosystem's push towards becoming more reliable, accessible, and consumable. What lessons...

Let's have an open discussion with systemd developers who are at ASG and users in the audience. We will open with the developers saying what they plan to work on in the near future, and then allow questions / comments from the audience. Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/ about this event: https://cfp.all-systems-go.io/all-systems-go-2026/talk/RN9E3E/

The Yocto project contains multitudes, and as such it contains the ability to create a modern, image based, integrator friendly operating system, taking advantage of various layers of tooling for hardware and feature support. Moonforge is the result of the work done by Igalia in this space, and it focuses on making it easy to create, build, test, deploy, and update a OS image for multiple products...

Same as every year, a lot has happened in the systemd project since last year's ASG. We released multiple versions, packed with new components and features. This talk will provide an overview of these changes, commenting on successes and challenges, and a sneak peak at what lies ahead. Licensed to the public under https://creativecommons.org/licenses/by/4.0/de/ about this event: https://cfp.all-sy...

The image based Linux vision is clear: immutable system images, declarative composition, no imperative package installation at runtime. But what happens when you need dozens of independently deployable application modules on the same device, each owned by a different team in a large enterprise, each on its own release cadence, while keeping the root filesystem untouched? We built a modular deploym...

User space based Full Disk Encryption in openSUSE is old news. We already can set up FDE installations using the systemd toolset. This allows us to use traditional passwords, the TPM2 to validate the status before mounting the encrypted device or a FIDO2 key to validate the presence of a token owned by authorized users. To increase the security, in Tumbleweed, we recommend combining both TPM2 and...

At Axis, we are always interested in standard technologies and how we can align with them. With that in mind, we have been studying the principles and ideas behind ParticleOS. In this session, we will build ParticleOS live with mkosi and boot it in a VM. We will look into the provisioning steps of such a machine and the changes in the OS image layout. Licensed to the public under https://creativec...

Systemd provides a growing set of very useful varlink APIs. With the new Rust-based varlink-http-bridge, it is possible to expose any number of them over the network securely via https/websockets, including over vsock, with all of the interesting varlink features like "more" support or "protocol-upgrade" support. This presentation gives an overview of why varlink and websockets are such a good fit...

IETF is standardizing a new ACME challenge, `device-attest-01`, which allows organizations to provision device bound certificates to machines, and enables machines to present signing certificates that can't be extracted out of machines they where intended for. This is useful for cases where you want to provide reverse proxies with mTLS with a strong sense of device identity. attezt is intended to...

In recent systemd releases we substantially improved the tooling for provisioning and deploying operating systems with systemd. For example, systemd-sysinstall, systemd-sysupdate, credentials, systemd-firstboot, systemd-stub's parameterization logic, systemd-confext, systemd-imds, systemd-import all are relevant components for getting a node up and running with the right configuration, securely an...

Abschluss der Quellc0d3 bis zum nächsten Jahr Wir werfen einen blick zurück auf die vergangenen tage, hoffentlich mit ein paar zahlen. Geben euch einen kleinen einblick wie wir die Quellc0d3 auf die Beine gestellt haben https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://pretalx.0x90.space/quellcode-2026/talk/MFYKSS/

Annoyed by ansible's yaml syntax? With pyinfra, you can write your declarative infrastructure config in python instead. With all the control flow logic, reusable libraries, and whole power of a turing-complete language you already know. I can show you how we define our infrastructure in pyinfra, and some pyinfra libraries I wrote (for borgbackup, nginx, and wireguard). Then we can think together a...

This talk is about how I built a Corsi-Rosenthal box fan filter without the resources used typically in the USA. You probably have heard of them, maybe even saw them yourself: A box, with a bunch of air filters, and a fan on the top, all tied together with duct tape. It sucks air through the filters, and purified air comes out. This DIY air purifier, as simple and cheap looking as it might be, tur...

Ich nehme euch mit auf meine (noch lange nicht abgeschlossene) Reise. Ich zeige euch meine Erfolge, meine (mitunter dummen) Fehler, echte Gamechanger und warum ich manchmal bewusst auf den Profi-Ansatz verzichtet habe. Und wie man im Dschungel aus 2,6 Millionen Modellen die Richtigen für den eigenen Zweck finden. **Für Einsteiger und Technisch versierte Wesen:** *Ich beginne den Vortrag mit einer...

Lightning talk slot, to present some lightning talks. A slot for short talks about different topics, Can be in English or German. Ein Programm Punkt in dem kurze Vorträge über verschiedene Themen vorgetragen werden können. Die Vorträge können in Deutsch oder Englisch gehalten werden. https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://pretalx.0x90.space/quellcode-2026/talk/8A...