Website review
This review may include AI-generated content and is not individually verified. Domain, certificate and other facts come from the observed data on this page.
What is systemd?
systemd is a Linux init system and service manager. The kernel starts it first, so it runs as PID 1, and it is responsible for starting the other daemons an operating system needs, such as networking, cron and syslog. The site frames it as a claimed "good and modern replacement" for the older SysVinit, but its scope goes well beyond the traditional init role: it also manages services, logging (journald), name resolution, time, mounts and user sessions.
Why the site is critical of it
The page's argument is not that systemd fails to boot machines, but that concentrating so much core plumbing in one project creates risk and lock-in. Its evidence is a list of notable bugs and security issues, including:
- A Datadog outage attributed to a systemd upgrade, described as costing millions.
- An Azure incident where a systemd update broke DNS resolution across instances.
- CVE-listed flaws such as an out-of-bounds write in systemd-networkd DHCPv6 handling and the systemd-journald "System Down" exploit chain.
- Operational oddities: PID 1 stuck in a logging loop, slow
systemctl statuswith a disk journal, services going silent after a journal restart, and configuration changes that disconnect unrelated network interfaces.
For a sysadmin or distribution maintainer, the practical takeaway is that a systemd upgrade is not a small, isolated change — it can alter networking, logging and boot behaviour at once, so staged rollouts and tested fallbacks matter more than with a narrower init.
Alternatives the page points to
The site lists other init daemons and their status, including SysVinit, OpenRC, runit, s6, Shepherd, finit, Dinit and superd, alongside several inactive projects (Upstart, uselessd, InitNG, cinit, minit, Epoch). If you want a distribution without systemd, that list is the starting point rather than the answer itself; check whether your preferred distro actually ships and supports one of these, and whether your software stack assumes systemd-specific tooling such as systemctl units or journald.
A useful next step: pick one candidate init, confirm it is actively maintained, and test it on a spare machine or VM with your real workload — networking, scheduled jobs and logging — before committing. No systemd
What are the main problems and security risks associated with systemd?
The main objections on No systemd fall into two groups: architectural criticism of what systemd is, and a long list of concrete bugs and security issues. The site's framing is that systemd is not just an init daemon (the first process the kernel starts, PID 1, responsible for launching networking, cron, syslog and other daemons) but a broad, tightly coupled suite that has absorbed many of those separate roles. That concentration is the root of most of the complaints: more code in PID 1 and its companions, more shared assumptions, and a bigger blast radius when something breaks.
Concrete problems the site documents
The page collects specific incidents and bug reports rather than only arguing in the abstract. Examples include:
- Outages caused by updates. A Datadog outage reportedly costing 5 million dollars attributed to a systemd upgrade, and a widespread Azure outage after a systemd package was published to a security pocket, leaving instances unable to resolve DNS.
- PID 1 misbehaving. A report of PID 1 getting stuck printing "Time has been changed" continuously, and slow
systemctlstatus checks (over 10 seconds) when the disk journal is used. - Data-handling and filesystem bugs. The journal dropping all bytes after a null character, and a
tmpfilesrule (R! /dir/.*) destroying root. - Security vulnerabilities. An out-of-bounds write in
systemd-networkdDHCPv6 option handling (CVE-2018-15688), a DNS resolver loop on packets with pseudo DNS types (CVE-2017-15908), and the "System Down"systemd-journaldexploit (CVE-2018-16864, CVE-2018-16865, CVE-2018-16866). - Everyday breakage. Encrypted root partitions failing to boot, services writing to stdout going silent after a journal restart, networkd configuration disconnecting all other interfaces, and user-manager interference with ecryptfs private directories.
How to read this list
These are the site's selected examples, not a neutral audit, so treat them as a starting point for your own risk assessment rather than a verdict. The practical question is whether the failure modes matter for your systems. If you run a fleet where a single package update can take down DNS resolution across many hosts, the Azure-style incident is the relevant lesson: pin and stage init-related updates, and test them on a canary host before broad rollout. If you care about PID 1 reliability, the stuck-loop and slow-status reports matter more, because PID 1 problems are hard to recover from without a reboot.
Alternatives the site points to
For readers who want to move away, the page lists init systems including SysVinit, OpenRC, runit, s6, Shepherd, finit, Dinit, procd and others, marking several (uselessd, Upstart, InitNG, cinit, minit, Epoch) as inactive for years. The trade-off is real: smaller init systems are easier to reason about and audit, but you lose systemd's integrated logging, service dependencies and tooling, and some desktop and server software assumes systemd is present.
A useful next step: pick one or two incidents above that resemble your environment (a distro update breaking networking, or a journald vulnerability) and check whether your distribution's current version and update policy already address them. Then decide whether the remaining risk justifies switching init systems or just tightening update staging.
Which Linux distributions don't use systemd by default?
Distributions that avoid systemd by default cluster into a few init families. The site's own list of init daemons names SysVinit, OpenRC, runit, s6, Shepherd, finit, Dinit, procd and several others, so "no systemd" does not mean "one shared replacement".
Common choices
| Distribution | Default init | Typical audience |
|---|---|---|
| Devuan | SysVinit (OpenRC, runit possible) | Debian users who want Debian without systemd |
| Alpine Linux | OpenRC | Containers, routers, small servers |
| Void Linux | runit | Desktop and server users wanting simplicity |
| Artix Linux | OpenRC, runit, s6 or Dinit | Arch-style rolling release without systemd |
| Gentoo | OpenRC (systemd optional) | Users who compile and tune their system |
| Slackware | SysVinit-style scripts | Traditional, hands-on administration |
| antiX and MX Linux | SysVinit (systemd optional or absent) | Older hardware, lightweight desktops |
| Chimera Linux | dinit | Users curious about newer init designs |
A simple decision rule: pick Devuan if you want Debian packages and behaviour with a familiar init; Alpine if the machine is small, containerised or network-facing; Void or Artix if you want a rolling release and are comfortable reading init documentation; Gentoo if you already build software from source.
The trade-off is ecosystem friction rather than raw capability. Some upstream software assumes systemd for logging, session management, timers or service supervision, so you may need to adapt units, use alternative logging, or accept missing features. Desktop environments and proprietary software are the usual pain points; servers running standard daemons are generally easy.
As a next step, check the init-specific documentation before installing: Void's runit service directory, Alpine's OpenRC runlevels and Artix's per-init installation notes differ enough that copying commands between them causes breakage. For background on why people make this choice, and for the wider list of init daemons and alternatives, see No systemd.
How can I replace systemd with an alternative init system like OpenRC or runit?
Replacing systemd means two separate jobs: getting a distribution that supports another init, and then learning how that init manages services. The No systemd site frames the issue this way: the init daemon is the first process spawned by the kernel (PID 1) and is responsible for starting the other daemons the OS needs, such as networking, cron and syslog. Swapping it is not a package install on most systems; it changes how the machine boots and how services are controlled.
The practical path
The least painful route is to choose a distribution that ships a non-systemd init by default, rather than trying to convert an existing systemd installation. The site's own list of init daemons includes SysVinit, OpenRC, runit, s6, Shepherd, finit and Dinit, with several others marked inactive. That list is a useful starting point for checking what a distribution actually uses.
If you want OpenRC or runit specifically, look for distributions built around them. Gentoo uses OpenRC by default and lets you choose between OpenRC and systemd, so it is a common home for people who want to stay on OpenRC. Alpine Linux uses OpenRC and is widely used for containers and small servers. Void Linux uses runit and is the usual recommendation for a runit-based desktop or server. Devuan is a Debian derivative that keeps SysVinit or OpenRC instead of systemd. Artix Linux offers OpenRC, runit, s6 and Dinit variants of Arch.
| Init | Typical distributions | Service commands | Best for |
|---|---|---|---|
| OpenRC | Gentoo, Alpine, Artix, Devuan | rc-service, rc-update |
People who want a familiar SysV-style layout with dependency handling |
| runit | Void Linux, Artix | sv, service directories under /etc/sv |
Small, fast systems and users who like simple supervision |
| s6 | Artix, source-based setups | s6-rc, s6-svc |
Users who want a process supervision suite and don't mind a steeper learning curve |
| SysVinit | Devuan, some older distros | service, update-rc.d |
Conservative servers and minimal change from older Debian |
What changes day to day
With systemd you use systemctl for everything: starting, enabling, checking status and reading logs. With OpenRC you use rc-service and rc-update, and logs usually go to files under /var/log or to a syslog daemon. With runit you create or edit a service directory and use sv to start, stop or check it, with svlogd handling logs. The concepts are similar, but the commands and file layouts are not interchangeable, so budget time to relearn them.
The site's case against systemd is largely a list of bugs and outages, including a Datadog outage attributed to a systemd upgrade, an Azure incident where a systemd update broke DNS resolution, and several CVEs in systemd-journald and systemd-networkd. Treat that as the site's editorial position rather than a neutral survey; the concrete lesson is that a monolithic PID 1 touches a lot of the system, so a bad update can have wide effects. That is an argument for picking an init you can reason about, not proof that any alternative is bug-free.
A concrete next step
Pick one distribution that matches the init you want, install it in a virtual machine, and do three things: confirm PID 1 with ps -p 1, start and enable a simple service, and find where its logs go. If those three tasks feel manageable, move the same setup to real hardware. If you are converting an existing machine, back up first and expect to reinstall rather than switch in place, because the boot process and service definitions are deeply tied to the init.
For background and the full list of alternatives, see No systemd. For distribution-specific instructions, check the documentation of Gentoo, Alpine, Void, Devuan or Artix directly; their official sites are the reliable source for install and service commands.
Is systemd more secure than traditional init systems like SysVinit?
Whether systemd is more secure than SysVinit is not a simple yes or no. Both approaches can be configured well or badly. The honest answer is that systemd adds security-oriented features that classic SysVinit lacks, while also introducing a much larger attack surface and a record of serious bugs. Which risk matters more depends on how you run your machines.
Where systemd can be stronger
Classic SysVinit starts services through shell scripts, usually with little isolation. systemd was designed with hardening options that SysVinit does not offer natively:
- Per-service sandboxing (
ProtectSystem,PrivateTmp,NoNewPrivileges, cgroup and namespace restrictions). - Declarative unit files, which are easier to audit than long shell scripts.
- Socket and service activation with dependency tracking, so fewer ad-hoc startup hacks.
- Centralised logging through the journal, which can help after an incident.
For a single-purpose server where you want each daemon tightly confined, these are real advantages.
Where the case weakens
The No systemd page collects bugs and CVEs that undercut the "more secure by design" claim. Examples it lists include out-of-bounds writes in systemd-networkd DHCPv6 handling (CVE-2018-15688) and the systemd-journald exploit chain (CVE-2018-16864/16865/16866), plus the Datadog outage caused by a systemd upgrade. It also notes that systemd is a large, fast-moving codebase with many components — journald, resolved, networkd, logind, udev — so a flaw in any one of them affects PID 1's ecosystem.
The trade-off is structural: systemd concentrates more functionality in one project, so a single vulnerability can have broader reach. SysVinit plus separate tools spreads that risk across smaller, simpler programs, though those programs are not automatically safe either.
A practical way to decide
Ask what your threat model actually is:
- Hardened single server, small team: systemd's sandboxing options are worth using; audit your unit files rather than trusting defaults.
- Minimal or embedded system: a small init such as OpenRC, runit or s6 keeps the trusted computing base smaller, which is often the stronger security argument.
- Distro-level preference: if you want to avoid systemd entirely, distributions built without it are the cleanest route; the No systemd page maintains a list of them.
If you want to evaluate this yourself, pick one service you run, compare its systemd unit against its SysVinit script, and check which hardening options each actually applies. That comparison will tell you more about your real exposure than the general debate.
What are the most reliable systemd alternatives for servers or embedded devices?
The most reliable alternatives depend on what you mean by "reliable": for servers, OpenRC and runit are the most battle-tested and widely deployed; for embedded devices, BusyBox init, runit and s6 are common because they are small and predictable. No systemd lists these alongside SysVinit, Shepherd, finit and others as init daemons worth considering.
How the main alternatives differ
| Init | Best suited to | Trade-off |
|---|---|---|
| SysVinit | Traditional servers, conservative setups | Simple and familiar, but slow serial boot and limited service supervision |
| OpenRC | Servers and desktops on Gentoo, Alpine, Artix | Dependency-based and scriptable; less integrated than systemd |
| runit | Small servers, containers, embedded | Tiny and fast; supervision is basic, logging is separate |
| s6 | Embedded and appliances needing strict process supervision | Very robust supervision; steeper learning curve |
| BusyBox init | Constrained embedded devices | Minimal footprint; very few features |
What "reliable" means here
Reliability usually comes down to three things: whether PID 1 keeps running when services fail, whether services restart automatically, and whether the system boots predictably after an upgrade. The page's catalogue of systemd bugs and security issues—such as the Datadog outage attributed to a systemd upgrade and the Azure DNS resolution failure after a systemd package update—illustrates the risk that a large, fast-moving init can introduce into production. Alternatives tend to be smaller and change more slowly, which is itself a reliability argument.
A practical next step
If you are choosing for a server, start with OpenRC or runit and test it on one non-critical machine: write your service scripts, reboot, kill a service process, and confirm it restarts. For embedded, start with BusyBox init or runit and measure boot time and memory. For distributions that ship these by default, see Alpine Linux (OpenRC), Gentoo (OpenRC), Artix Linux (OpenRC, runit, s6 or dinit) and Void Linux (runit).
User reviews (0)