systemd Deep Dive in 2026: What's Changed

Between September 2025 and June 2026, systemd shipped four releases — v258 through v261 — that collectively remove decades-old infrastructure and raise the baseline for what a modern Linux init system expects. If you administer Linux servers, here is what actually matters.

cgroup v1 is gone. v258 (September 2025) dropped cgroup v1 support entirely. systemd now mounts cgroup v2 exclusively. Any server still running a legacy or hybrid cgroup v1 configuration must migrate before upgrading past v257. Most modern distributions already default to v2, but older containers or monitoring tools tied to v1 paths will break.

SysV init scripts are dead. v259 deprecated the SysV compatibility layer; v260 (March 2026) removed systemd-sysv-generator, systemd-rc-local-generator, and systemd-sysv-install for good. Any package still shipping an LSB or SysV-style init script now fails silently — it must ship a native .service unit. Audit your custom init scripts and third-party packages before upgrading.

Journald now persists by default. v259 changed the journal storage default from auto to persistent. Previously journald only wrote to disk if /var/log/journal existed. Now it always persists. This is a welcome change for troubleshooting but means you should monitor disk usage on systems with heavy logging — especially containers and busy web servers.

iptables NAT is out; nftables is required. systemd-networkd and systemd-nspawn dropped iptables/libiptc NAT support in v259. Only nftables is supported. If you rely on systemd-networkd for NAT or use systemd-nspawn containers with legacy firewall rules, convert your rulesets before upgrading.

Minimum kernel and library requirements jumped. v260 raised the baseline to kernel 5.10 (recommended 5.14, 6.6 for full features), glibc 2.34, OpenSSL 3.0, and util-linux 2.37. Enterprise distributions on older long-term kernels (pre-5.10) cannot run current systemd without backports or a major OS upgrade.

Kexec file descriptors survive reboots. v261 (June 2026) added FileDescriptorStorePreserve=yes for units that need to keep filedescriptor stores across kexec kernel reloads. Useful for stateful services that must survive planned kernel upgrades without full restarts.

BPF LSM enforcement is here. Also in v261, RestrictFileSystemAccess= confines execution to binaries stored on signed or dm-verity-protected filesystems. This is opt-in but signals where systemd’s security model is heading.

Plan ahead for v262. The project already announced removals of the /run/boot-loader-entries/ interface and the experimental systemd-sysupdated D-Bus API in the next release.

For rolling-release distributions — Arch, Fedora, openSUSE Tumbleweed — these changes are already live. For enterprise distributions on older systemd versions, expect these changes to land via backports or the next major OS release. Review your init scripts, cgroup configuration, and firewall rules before the next upgrade window.