feat: add systemd.maskedUnits option #361
Open
+190
−18
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Author
|
wow, my markdown formatter really garbled this one in the pr view. i can edit if it's hard to read! |
jfroche
reviewed
Feb 11, 2026
Member
jfroche
left a comment
jfroche
left a comment
There was a problem hiding this comment.
Thank you for taking the time to create this feature !
At first glance I see:
- we could simplify the test by masking an existing service started in the container like
unattended-upgrades.service - masking a unit doesn't stop the service. Should we mask the service before reloading systemd or should we stop the service explicitly ?
- system-manager deactivation should unmask the masked services
mushrowan
force-pushed
the
mushrowan/306
branch
2 times, most recently
from
8056787 to
f2ea34c
Compare
Author
hopefully addressed all of these in the latest push - using dbus for masking, and unattended-upgrades for testing. masked services are now added to the stop list before the mask. thank you for reviewing! |
Member
|
All good, last nitpick before we merge: in the test we should check that the service is running before activation and stopped after activation: + with subtest("Service can be started before activation"):
+ assert machine.service("unattended-upgrades").is_running, "unattended-upgrades should be running before activation"
machine.activate()
machine.wait_for_unit("system-manager.target")
+ with subtest("Masked service is not running"):
+ assert not machine.service("unattended-upgrades").is_running, "unattended-upgrades should not be running" |
jfroche
approved these changes
Feb 13, 2026
symlink units to /dev/null to prevent them from starting, useful for disabling distro-shipped units like ssh.service or unattended-upgrades.service - nix option with assertion preventing overlap with defined units - masked entries in services.json with storePath null - mask/unmask via D-Bus MaskUnitFiles/UnmaskUnitFiles - running services are explicitly stopped when masked - deactivation unmasks via D-Bus before daemon-reload - container test masks unattended-upgrades.service and verifies masking, start prevention, and unmask on deactivation closes numtide#306
mushrowan
force-pushed
the
mushrowan/306
branch
from
f2ea34c to
ad27867
Compare
Author
edited, thanks :) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
summary
adds
systemd.maskedUnitsoption to mask units shipped by the host distro (e.g.ssh.serviceon ubuntu). masked units are symlinked to/dev/null, preventingthem from starting manually or as a dependency.
closes #306
usage
changes
systemd.maskedUnitslist option insystemd.nixservices.jsonwithmasked: trueServiceConfig.store_pathis nowOption<StorePath>for masked unitsdesign note
went with a top-level list rather than per-service
systemd.services.<name>.mask = true— the use case is masking units you don'tdefine yourself. for units you define,
enable = falsealready works.