Also known as: systemctl · journald · systemd unit
systemd is the init system and service manager used by most major Linux distributions, handling service startup and supervision, logging, device management, and system state through a unified set of components.
Its practical advantages are substantial: declarative unit files replace shell scripts, dependency-aware parallel startup reduces boot time, and services can be automatically restarted, resource-limited via cgroups, and sandboxed through built-in hardening directives.
Those hardening options — restricting filesystem access, dropping capabilities, applying seccomp filters — are among the most underused security features on a typical Linux server, since they require nothing beyond additions to a unit file.
Init System
The init system is the first user-space process started by the kernel at boot, running as PID 1, responsible for starting and supervising all other system services and handling shutdown.
cgroups
cgroups (control groups) are a Linux kernel feature that limits, accounts for, and isolates the resource usage — CPU, memory, disk I/O, network — of a group of processes.
seccomp
seccomp is a Linux kernel feature that restricts which system calls a process may make, reducing the kernel attack surface available to a compromised or untrusted program.
Kernel
The kernel is the core of an operating system, responsible for managing memory, scheduling processes, and mediating all access between software and hardware. The Linux kernel is the component that makes a system 'Linux'.
Linux Distribution
A Linux distribution is a complete operating system built around the Linux kernel, bundling it with system libraries, a package manager, default utilities, and a curated set of software, along with policies for how all of it is maintained and updated.