systemd by Example

Become comfortable with the new systemd init system used in Linux distributions to bootstrap the user space and to manage system processes after booting. This exciting tool is already available on your servers. Now is your chance to see examples of service security, sandboxing, container management, metric data collection, and logging aggregation.

Transcript

1. @KeithResar
2. @KeithResar SYSTEMD BY EXAMPLE
4. FAMILIARITY WITH SYSTEMD? Time @KeithResar
5. ARGUMENTS IN THE CORRECT ORDER? (% OF TIME ) Time @KeithResar
7. SURVEY Have you used systemd? @KeithResar
8. SURVEY Have you created custom unit files? @KeithResar
9. SURVEY Have you extended system unit files? @KeithResar
10. SURVEY Have you used non-service functionality? @KeithResar
11. systemd Basics Intro Very brief introduction on systemd 101 Some Fun Examples Share some interesting use cases I stumbled across AGENDA @KeithResar
12. SERVICE MANAGEMENT VIA SYSTEMD # Basic service management > service ssh { start | stop | reload | .. } # Translates directly to... > systemctl ssh { start | stop | reload | .. } @KeithResar
13. SERVICE MANAGEMENT VIA SYSTEMD # Basic service management > service httpd { start | stop | reload | .. } # Translates directly to... > systemctl { start | stop | reload | .. } httpd ... @KeithResar
14. BASIC SERVICE UNIT FILE 1 [Unit] 2 Description=OpenSSH server daemon 3 Documentation=man:sshd(8) man:sshd_config(5) 4 After=network.target sshd-keygen.target 5 Wants=sshd-keygen.target 6 [Install] 7 WantedBy=multi-user.target 8 [Service] 9 Type=notify 10 EnvironmentFile=-/etc/sysconfig/sshd 11 ExecStart=/usr/sbin/sshd -D $OPTIONS $CRYPTO_POLICY 12 ExecReload=/bin/kill -HUP $MAINPID 13 Restart=on-failure 14 RestartSec=42s
15. UNIT FILE LOCATIONS # Default system location /usr/lib/systemd/system # Local unit files live in /etc/systemd/system # Modifications reside in a drop-in directory /etc/systemd/system/$unit.d @KeithResar
16. SYSTEMD BY EXAMPLE @KeithResar
17. BASH COMPLETION @KeithResar
18. SYSTEMD-CGTOP Control Group %CPU Memory Input/s Output/s / - 391.3M - - /user.slice 0.6 66.4M - - /user.slice/user-1000.slice 0.6 66.4M - - /user.slice/user-1000.slice/session-1.scope 0.6 37.2M - - /system.slice 0.1 248.5M - - /system.slice/httpd.service 0.1 21.1M - - /system.slice/rsyslog.service 0.0 15.0M - - /system.slice/sssd.service 0.0 35.5M - - /system.slice/lvm2-lvmetad.service 0.0 536.0K - - /system.slice/rngd.service 0.0 3.2M - - @KeithResar
19. SYSTEMD.RESOURCE-CONTROL # Enable accounting CPUAccounting, MemoryAccounting, IOAccouting, IPAccounting # Weight 1 - 10,000, quota in % of a single CPU CPUWeight, StartupCPUWeight, CPUQuota # Best effort optimization and hard limits MemoryLow, MemoryHigh, MemoryMax, MemorySwapMax # Hard limits applied to provided device and bytes IOReadBandwidthMax, IOWriteBandwidthMax @KeithResar
20. CPU PINNING FOR NUMA OPTIMIZATION @KeithResar 0 1 4 5 CPU Local Memory Node 0 Socket 0 2 3 6 7 CPU Local Memory Node 1 Socket 1 [Service] CPUAffinity=0 1 4 5
21. DYNAMIC USERS [Service] DynamicUser=yes # Optional, explicitly note user name User=foo @KeithResar
22. SYSTEMD TIMERS • Jobs can be easily started independently of their timers. This simplifies debugging. • Each job can be configured to run in a specific environment • Jobs can be attached to cgroups. • Jobs can be set up to depend on other systemd units. • Jobs are logged in the systemd journal for easy debugging. @KeithResar
23. SOCKETS VIA COCKPIT @KeithResar
24. SYSTEMD FOR ADMINISTRATORS BLOG SERIES #1: Verifying Bootup #2: Which Service Owns Which Processes? #3: How Do I Convert A SysV Init Script Into A systemd Service File? #4: Killing Services #5: The Three Levels of "Off" #6: Changing Roots #7: The Blame Game #8: The New Configuration Files #9: On /etc/sysconfig and /etc/default #10: Instantiated Services #11: Converting inetd Services #12: Securing Your Services #13: Log and Service Status #14: The Self-Explanatory Boot #15: Watchdogs #16: Gettys on Serial Consoles (and Elsewhere) #17: Using the Journal #18: Managing Resources #19: Detecting Virtualization #20: Socket Activated Internet Services and OS Containers #21: Container Integration
25. SUMMARY • HUGE upside to kernel integration • No bash means consistency and reliability • More than just services @KeithResar
26. @KeithResar THANKS!