Systemd 262 has been released as the latest stable version of the widely used Linux system and service manager, introducing new container and virtualization capabilities, TPM and encryption improvements, better journal recovery, and several service-management enhancements.
One notable addition is support for building systemd as a single statically linked PID 1/executor binary, aimed primarily at very small container environments. These builds avoid loading optional libraries dynamically and use simplified user and group lookups instead of NSS.
Service management has received several additions. A new RestartRandomizedDelaySec= option introduces a random delay before automatic service restarts, helping prevent many services from restarting simultaneously after a failure. Slice units also gain ActivatingConcurrencyMax=, which limits how many units in a slice hierarchy can activate at once, with additional jobs queued until capacity is available.
Regarding virtualization, systemd-vmspawn now supports Intel TDX confidential virtual machines through its --coco= option, joining existing AMD SEV-SNP support. Secure Boot can be enabled with compatible confidential VM firmware.
There are important TPM-related improvements as well. TPM-sealed credentials are now pinned to the TPM’s Storage Root Key, adding protection against attacks involving an interposed TPM device. Systemd 262 also adds Argon2id support for TPM2 PIN enrollment, strengthening PIN-derived key material compared with the older direct/PBKDF2-compatible approach.
Moreover, systemd-cryptenroll gains an optional first-boot wizard for adding additional disk unlock mechanisms on systems that rely on unattended TPM-based encryption. New --unlock-empty and --unlock-headless options are also available for automated or headless setups.
Another notable storage-related change affects systemd-homed. Newly created fscrypt-backed home directories use fscrypt v2 policies by default. Existing v1 homes remain supported, although there is no in-place upgrade path between the two formats.
The journal stack receives reliability improvements. systemd can now try to recover valid entries from active journal files whose header or tail data was truncated during an unclean shutdown under heavy write activity. Importantly, journal sealing support has moved from libgcrypt to OpenSSL.
On the networking side, systemd-networkd can match network configurations against machine tags, while networkctl reload gains a new --no-reconfigure option for reloading configuration files without immediately reconfiguring existing interfaces. Several stacked network-device settings can also accept multiple device names at once.
Moreover, systemd 262 further expands systemd-sysupdate, which now keeps a persistent database of installed files and can remove files no longer matched by the current configuration through a new cleanup operation.
Components and features also gain a suggestion mechanism that can automatically recommend or enable items depending on architecture, virtualization environment, firmware properties, machine tags, and other system characteristics.
Other changes include OpenSSL 4 support, new run0 options compatible with several familiar sudo behaviors, a headless mode for systemd.firstboot=, improved FIDO2 PIN feedback, and a new experimental --introspect-cli option that exposes machine-readable command metadata in JSON instead of requiring scripts to parse --help output.
As usual for a major systemd release, version 262 introduces several compatibility changes and deprecations. Among them, the legacy udev control socket protocol has been removed in favor of Varlink IPC, several old Meson build options are gone, and some command output and JSON interfaces have changed.
For additional details, see the full changelog.
