in systemd runlevels are basically just targets (it still sets rc?.d symlinks in /etc akaik) which have services they want and are wanted by, it’s the basis for dependency handling
plus you get cool security features like syscall filtering, capability limits, user switching, etc
Well in Void (using runit) each runlevel is just a directory with symlinks to the services.
I didn’t realize systemd had these security features (except for user/group switching, which is pretty standard). You can get those with other init systems, but it’s probably easier on systemd so I assume more people actually do it. I wonder if average distros take the time to harden their unit files.
You can end up with a lot of boiler plate code and with duplication you run the risk that one unit tweaks the boiler plate in a way that behaves differently. This isn’t insurmountable and a lot of rc scripts source a library of common functions shared between units. However from the point of view of the executor each unit is it’s own whole ball of shell script code.
What does this mean? How is an imperative shell scripts doing something subtly different? Why won’t a declarative config file do the same?
Runlevels don’t really have anything to do with dependency resolution though?
Maybe it is, but you didn’t explain why.
in systemd runlevels are basically just targets (it still sets rc?.d symlinks in /etc akaik) which have services they want and are wanted by, it’s the basis for dependency handling plus you get cool security features like syscall filtering, capability limits, user switching, etc
Well in Void (using runit) each runlevel is just a directory with symlinks to the services.
I didn’t realize systemd had these security features (except for user/group switching, which is pretty standard). You can get those with other init systems, but it’s probably easier on systemd so I assume more people actually do it. I wonder if average distros take the time to harden their unit files.
You can end up with a lot of boiler plate code and with duplication you run the risk that one unit tweaks the boiler plate in a way that behaves differently. This isn’t insurmountable and a lot of rc scripts source a library of common functions shared between units. However from the point of view of the executor each unit is it’s own whole ball of shell script code.
Most service scripts on my machine (Void with runit) are less than 10 lines long, and don’t contain any “boiler plate” other than a shebang.