{"acronym":"asg2026","aspect_ratio":"16:9","created_at":"2026-09-30T11:37:02.023+02:00","updated_at":"2026-10-20T22:45:10.097+02:00","title":"All Systems Go! 2026","schedule_url":"https://cfp.all-systems-go.io/all-systems-go-2026/schedule.xml","slug":"conferences/all_systems_go/asg2026","event_last_released_at":"2026-10-01T00:00:00.000+02:00","link":"","description":"","webgen_location":"conferences/all_systems_go/asg2026","logo_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/logo.png","images_url":"https://static.media.ccc.de/media/events/all_systems_go/2026","images":[{"type":"logo","url":"https://static.media.ccc.de/media/events/all_systems_go/2026/logo.png","mime_type":"image/png"}],"recordings_url":"https://cdn.media.ccc.de/events/all_systems_go/2026","url":"https://api.media.ccc.de/public/conferences/asg2026","events":[{"guid":"6c328e0c-1963-5f7a-9cec-6736acad9cf7","title":"Disk encryption using attestation for Confidential VMs","subtitle":null,"slug":"all-systems-go-2026-405-disk-encryption-using-attestation-for-confidential-vms","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/TKKLMZ/","description":"When a VM is confidential (CVM), the host cannot access its memory, enabling data-in-use protection. Hardware vendors like Intel (TDX) and AMD (SEV-SNP) provide the underlying technology to achieve this. The use case becomes more complex when a persistent disk is added to a CVM: the disk must also be encrypted, but how can we safely manage its encryption keys without trusting the host? We propose a mechanism to encrypt and decrypt a disk using remote attestation: the passphrase is stored in a Key Broker Service (KBS) that only releases it when the identity of the VM is verified. During the first boot, systemd-repart encrypts the root disk using a random key that is generated and stored in KBS. On subsequent boots, systemd-cryptsetup requests the same key to decrypt the disk. We present the changes we are working on to support this use case in components like KubeVirt, Trustee, and systemd-repart. We present PRs for Trustee, systemd-repart, and KubeVirt, along with a new LUKS token plugin that integrates systemd-repart and systemd-cryptsetup with KBS for key retrieval. This use case extends beyond KubeVirt and applies to any environment where confidential workloads require encrypted persistent storage, including bare metal deployments.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Matias Vara Larsen"],"view_count":186,"promoted":false,"date":"2026-10-01T12:10:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-19T19:15:08.432+02:00","tags":["405","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":1162,"duration":1162,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/405-6c328e0c-1963-5f7a-9cec-6736acad9cf7.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/405-6c328e0c-1963-5f7a-9cec-6736acad9cf7_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/405-6c328e0c-1963-5f7a-9cec-6736acad9cf7.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/405-6c328e0c-1963-5f7a-9cec-6736acad9cf7.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-405-disk-encryption-using-attestation-for-confidential-vms","url":"https://api.media.ccc.de/public/events/6c328e0c-1963-5f7a-9cec-6736acad9cf7","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"485cf1f0-2be1-5d8a-ae8d-5c409337b8b4","title":"binfmt_bpf","subtitle":null,"slug":"all-systems-go-2026-440-binfmtbpf","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/8SCGQC/","description":"In this talk we will look at how binfmt and bpf can be integrated.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Christian Brauner"],"view_count":72,"promoted":false,"date":"2026-10-01T17:00:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-18T21:00:07.524+02:00","tags":["440","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":1523,"duration":1523,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/440-485cf1f0-2be1-5d8a-ae8d-5c409337b8b4.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/440-485cf1f0-2be1-5d8a-ae8d-5c409337b8b4_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/440-485cf1f0-2be1-5d8a-ae8d-5c409337b8b4.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/440-485cf1f0-2be1-5d8a-ae8d-5c409337b8b4.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-440-binfmtbpf","url":"https://api.media.ccc.de/public/events/485cf1f0-2be1-5d8a-ae8d-5c409337b8b4","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"f46235f5-6342-5549-8eda-019adbbb43b7","title":"Kmod — teaching old dog new tricks","subtitle":null,"slug":"all-systems-go-2026-425-kmod-teaching-old-dog-new-tricks","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/TTFUPB/","description":"In this talk we'll cover the developments in kmod over the past few years. We'll wiz past the documentation and contribution updates, outline some of the performance improvements and discuss  the latest APIs introduced.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Emil Velikov"],"view_count":102,"promoted":false,"date":"2026-10-01T17:00:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T17:00:07.363+02:00","tags":["425","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":1042,"duration":1042,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/425-f46235f5-6342-5549-8eda-019adbbb43b7.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/425-f46235f5-6342-5549-8eda-019adbbb43b7_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/425-f46235f5-6342-5549-8eda-019adbbb43b7.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/425-f46235f5-6342-5549-8eda-019adbbb43b7.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-425-kmod-teaching-old-dog-new-tricks","url":"https://api.media.ccc.de/public/events/f46235f5-6342-5549-8eda-019adbbb43b7","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"9f1ef3fb-d209-550c-afe1-1a7c468b85de","title":"Ten Years Building Container Networking: Lessons Learned and What the Future Might Look Like","subtitle":null,"slug":"all-systems-go-2026-408-ten-years-building-container-networking-lessons-learned-and-what-the-future-might-look-like","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/R7BEEK/","description":"A decade ago, container networking was in its infancy, relying heavily on complex bridges and iptables rules. Today, the landscape has fundamentally shifted towards highly performant, secure, and observable dataplanes powered by eBPF.  \n  \nIn this talk, a core contributor to Cilium reflects on a decade of building container networking solutions - from the early days of Weave Net to modern eBPF-based architectures. We will explore the hard-fought engineering lessons from migrating away from traditional kernel bottlenecks and discuss how Cilium evolved into the most widely used container networking plugin (CNI) and a foundational platform for advanced networking research. Finally, we will look to the horizon to discuss what the next decade of Linux system networking holds.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Martynas Pumputis"],"view_count":113,"promoted":false,"date":"2026-10-01T16:30:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-19T12:15:04.075+02:00","tags":["408","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":1538,"duration":1538,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/408-9f1ef3fb-d209-550c-afe1-1a7c468b85de.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/408-9f1ef3fb-d209-550c-afe1-1a7c468b85de_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/408-9f1ef3fb-d209-550c-afe1-1a7c468b85de.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/408-9f1ef3fb-d209-550c-afe1-1a7c468b85de.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-408-ten-years-building-container-networking-lessons-learned-and-what-the-future-might-look-like","url":"https://api.media.ccc.de/public/events/9f1ef3fb-d209-550c-afe1-1a7c468b85de","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"37703396-54c9-5dcd-978c-ac48c8ffb14b","title":"Hold My Beer, I'm Building 100 Images at Once","subtitle":null,"slug":"all-systems-go-2026-392-hold-my-beer-i-m-building-100-images-at-once","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/YSR3PP/","description":"In this talk, we'll walk through the architecture of Amutable's OS image build system. We'll dive into how we mirror rpms from Fedora and orchestrate building those rpms from source, as well as building OS images with buck2, an open source monorepo build system.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Daan De Meyer","Martin Pitt"],"view_count":100,"promoted":false,"date":"2026-10-01T16:00:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T13:15:10.709+02:00","tags":["392","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":1508,"duration":1508,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/392-37703396-54c9-5dcd-978c-ac48c8ffb14b.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/392-37703396-54c9-5dcd-978c-ac48c8ffb14b_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/392-37703396-54c9-5dcd-978c-ac48c8ffb14b.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/392-37703396-54c9-5dcd-978c-ac48c8ffb14b.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-392-hold-my-beer-i-m-building-100-images-at-once","url":"https://api.media.ccc.de/public/events/37703396-54c9-5dcd-978c-ac48c8ffb14b","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"bc672c96-6fac-5fcd-9897-8e1f44344ee9","title":"Managing the new mount api","subtitle":null,"slug":"all-systems-go-2026-441-managing-the-new-mount-api","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/J9TM7X/","description":"A fundamental aspect of an OS security policy is the ability to manage mounting. That includes filesystem mounts, remounts, bind-mounts, and property changes. Contrary to popular believe Linux exposes only barebones policy hooks. This is about to change.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Christian Brauner"],"view_count":69,"promoted":false,"date":"2026-10-01T16:30:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T18:30:06.528+02:00","tags":["441","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":1522,"duration":1522,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/441-bc672c96-6fac-5fcd-9897-8e1f44344ee9.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/441-bc672c96-6fac-5fcd-9897-8e1f44344ee9_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/441-bc672c96-6fac-5fcd-9897-8e1f44344ee9.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/441-bc672c96-6fac-5fcd-9897-8e1f44344ee9.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-441-managing-the-new-mount-api","url":"https://api.media.ccc.de/public/events/bc672c96-6fac-5fcd-9897-8e1f44344ee9","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"d20f427d-86c5-55cf-8c4b-31e1db728976","title":"Making NoNewPrivs the default","subtitle":null,"slug":"all-systems-go-2026-387-making-nonewprivs-the-default","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/CG9K7H/","description":"This talk will give an update on make NoNewPrivs the default on a Linux distribution.\n\nRunning systems with “NoNewPrivs” by default is already possible  without issues for many use cases, but there are still some cases where it doesn't work. As followup to last year's presentation “Accessing shadow records via varlink” this session provides an up-to-date status report on the progress made and the issues that remain.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Thorsten Kukuk"],"view_count":86,"promoted":false,"date":"2026-10-01T16:00:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T22:45:10.095+02:00","tags":["387","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":1529,"duration":1529,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/387-d20f427d-86c5-55cf-8c4b-31e1db728976.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/387-d20f427d-86c5-55cf-8c4b-31e1db728976_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/387-d20f427d-86c5-55cf-8c4b-31e1db728976.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/387-d20f427d-86c5-55cf-8c4b-31e1db728976.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-387-making-nonewprivs-the-default","url":"https://api.media.ccc.de/public/events/d20f427d-86c5-55cf-8c4b-31e1db728976","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"3e14be2b-6d9e-5e3b-9969-64f867c05a8b","title":"Varlink observability","subtitle":null,"slug":"all-systems-go-2026-437-varlink-observability","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/FKWEC8/","description":"Varlink is slowly getting adopted in the desktop space. This brings a few new challenges, one of them being observability: D-Bus allows us to capture the entire system and session bus and then drill down on specific interactions in the system. Varlink on the other hand is just a protocol spoken over AF_UNIX sockets and thus has no bus and no global view of the system. The talk explores how we can use eBPF and extended attributes on sockets to give us back the observability we're used to with D-Bus.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Sebastian Wick"],"view_count":113,"promoted":false,"date":"2026-10-01T15:20:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T22:45:09.085+02:00","tags":["437","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":1460,"duration":1460,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/437-3e14be2b-6d9e-5e3b-9969-64f867c05a8b.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/437-3e14be2b-6d9e-5e3b-9969-64f867c05a8b_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/437-3e14be2b-6d9e-5e3b-9969-64f867c05a8b.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/437-3e14be2b-6d9e-5e3b-9969-64f867c05a8b.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-437-varlink-observability","url":"https://api.media.ccc.de/public/events/3e14be2b-6d9e-5e3b-9969-64f867c05a8b","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"454fd98a-35e5-5b72-8887-5750a414cda7","title":"OSPool and thin volumes: Storage for Image-based systems","subtitle":null,"slug":"all-systems-go-2026-401-ospool-and-thin-volumes-storage-for-image-based-systems","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/WSNAQL/","description":"Image-based Linux systems have different storage requirements from traditional mutable systems as they rely on signed, immutable disk images for software delivery and separate writable filesystems for data.\n\nTechnologies like systemd-homed require that multiple writable filesystems share the same backing storage. This thin provisioning is not something that is well supported by Linux today as filesystems are not aware of it. Another area for improvement is that many disk images often contain similar data that could be deduplicated.\n\nWe will present a storage system prototype designed for the usecases of image based systems and our plans for improving thin provisioning on Linux.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Ada Magicat"],"view_count":67,"promoted":false,"date":"2026-10-01T15:20:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T03:30:03.045+02:00","tags":["401","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":1390,"duration":1390,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/401-454fd98a-35e5-5b72-8887-5750a414cda7.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/401-454fd98a-35e5-5b72-8887-5750a414cda7_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/401-454fd98a-35e5-5b72-8887-5750a414cda7.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/401-454fd98a-35e5-5b72-8887-5750a414cda7.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-401-ospool-and-thin-volumes-storage-for-image-based-systems","url":"https://api.media.ccc.de/public/events/454fd98a-35e5-5b72-8887-5750a414cda7","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"7c1d8289-f0dc-5fb6-be8e-534ec1ba9c32","title":"Delivering the OS via OCI images: Btrfs snapshots, delta updates and 3-way merges","subtitle":null,"slug":"all-systems-go-2026-417-delivering-the-os-via-oci-images-btrfs-snapshots-delta-updates-and-3-way-merges","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/E7L8GD/","description":"Delivering a Linux OS via OCI images unifies infrastructure management but often introduces severe network and state-reconciliation bottlenecks. This talk dives into the mechanics of solving these challenges by applying OS updates directly from OCI images to btrfs snapshots. We will explore how to drastically optimize these atomic upgrades using zstd-chunked compression, enabling systems to execute file-level delta updates via HTTP range requests instead of pulling full layers. Finally, we will demonstrate how to leverage snapper for seamless 3-way merges, safely reconciling upstream OS changes with local user configurations.\n\nThe transition to image-based, immutable Linux systems fundamentally changes OS management, but it also introduces complex network and storage challenges that are often abstracted away. This session explores the architecture and technical workflows required to provision and upgrade an OS using OCI images, advanced compression, and copy-on-write filesystems.\nThe foundation of this approach relies on mapping OCI images directly to btrfs snapshots. OCI image layers are pulled, unpacked, and directly applied as immutable btrfs snapshots, forming the read-only root volume of the system while maintaining distinct writable areas for persistent state.\nTo eliminate the network bottleneck of pulling full OCI layers for minor patches, we will detail efficient delta updates with zstd-chunked OCI images. The OS agent identifies and downloads only the specific files that have changed between the current running image and the target image. We will explain the mechanics of using HTTP range requests to extract these payloads and write them directly into the target btrfs snapshot on the fly, drastically reducing update times and bandwidth consumption without requiring full local extraction.\nFinally, an immutable OS still requires localized configuration (e.g., in /etc), creating a challenge when the base OS image is updated. We will explore how to solve this using a 3-way merge strategy. In particular we will see how snapper is utilized to navigate btrfs snapshot trees and isolate the precise differences between the original base image, the user's localized state, and the incoming update. Having a clear picture of the differences in multiple directions allows us to define an algorithmic approach to safely merging these three states.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["David Cassany","Dirk Müller"],"view_count":87,"promoted":false,"date":"2026-10-01T14:50:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-19T13:15:09.218+02:00","tags":["417","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":1731,"duration":1731,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/417-7c1d8289-f0dc-5fb6-be8e-534ec1ba9c32.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/417-7c1d8289-f0dc-5fb6-be8e-534ec1ba9c32_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/417-7c1d8289-f0dc-5fb6-be8e-534ec1ba9c32.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/417-7c1d8289-f0dc-5fb6-be8e-534ec1ba9c32.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-417-delivering-the-os-via-oci-images-btrfs-snapshots-delta-updates-and-3-way-merges","url":"https://api.media.ccc.de/public/events/7c1d8289-f0dc-5fb6-be8e-534ec1ba9c32","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"7feb9e3e-54ce-5075-ba0a-b9ed7a94cbcd","title":"Modernising Software Distribution with Quarry","subtitle":null,"slug":"all-systems-go-2026-431-modernising-software-distribution-with-quarry","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/BBJYFH/","description":"`systemd-sysupdate` provides a lot of incredibly useful primitives for doing system updates, but it is still mostly designed around old-school `SHA256SUMS` distribution and static transfer definitions.\n\nThe need to have more autonomous systems for updating systems and adding components became quite clear when we started developing such systems at Amutable. This approach also dove-tailed nicely into developing an autonomous provisioning system using the same underlying mechanism, [leading us to build Quarry](https://amutable.com/blog/distributing-images-quarry) (which has been [recently open sourced](https://github.com/amutable-systems/quarry)).\n\nThis talk will contain a discussion of the architecture we came up with, the pain points with integration with `systemd-sysupdate`, as well as some of the caveats that such an architecture has with generic distributions.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Aleksa Sarai"],"view_count":75,"promoted":false,"date":"2026-10-01T14:50:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T21:15:06.881+02:00","tags":["431","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":1493,"duration":1493,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/431-7feb9e3e-54ce-5075-ba0a-b9ed7a94cbcd.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/431-7feb9e3e-54ce-5075-ba0a-b9ed7a94cbcd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/431-7feb9e3e-54ce-5075-ba0a-b9ed7a94cbcd.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/431-7feb9e3e-54ce-5075-ba0a-b9ed7a94cbcd.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-431-modernising-software-distribution-with-quarry","url":"https://api.media.ccc.de/public/events/7feb9e3e-54ce-5075-ba0a-b9ed7a94cbcd","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"8d949343-0bd6-527f-9773-99eab8f9dbb9","title":"Building IncusOS","subtitle":null,"slug":"all-systems-go-2026-402-building-incusos","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/ER3SSR/","description":"[IncusOS](https://linuxcontainers.org/incus-os) is an immutable OS based on Debian 13 and built using mkosi. It's designed to be as secure as possible, actively relying on both UEFI Secure Boot and a TPM 2.0 module to provide strong boot security as well as encryption at rest through LUKS+TPM.\n\nIts whole purpose is to provide an ideal environment for running [Incus](https://linuxcontainers.org/incus/) with a focus on running on bare metal with pretty complex local and remote storage as well as a variety of networking options.\n\nUnlike most other Linux systems, IncusOS doesn't provide any local or remote shell access to the system. Instead it's entirely API driven with its management API being available through the Incus API itself.\n\nThat management API allows for system configuration, update management, installation of additional components (systemd system extensions), configuring a variety of system services, ... But it also needs to handle a variety of fallback and recovery/patching mechanisms for when something goes wrong.\n\nThis talk will cover why we built IncusOS, how we built it, its current state and what we're working towards in the near future.\n\n[Incus](https://linuxcontainers.org/incus/) is a modern container and virtual machine manager with native support for both system and application containers as well as virtual machines. It's designed to behave just like a private cloud, but one that you can run on your laptop or Raspberry Pi as well as on clusters of hundreds or thousands of servers.\n\nIt's got support for a wide variety of local and remote storage options as well as both software defined and traditional networking. It has built-in clustering allowing for hundreds of servers to act as one with a consistent API and distributed database providing high availability and automated recovery.\n\nIncus is widely available through packages in most Linux distributions with IncusOS providing another method of deployment particularly targeted to those who don't want to have to manage yet another Linux system or those who want to perform large scale deployments with known identical systems.\n\nIncusOS can be deployed and managed at scale through [Operations Center](https://github.com/futurfusion/operations-center), allowing for hundreds of clusters to be deployed, updated and tracked in one place.\n\nIncus, IncusOS, Operations Center and generally everything related to Incus is Open Source and released under the Apache 2.0 license.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Stéphane Graber"],"view_count":128,"promoted":false,"date":"2026-10-01T14:05:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-19T22:30:11.440+02:00","tags":["402","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":2426,"duration":2426,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/402-8d949343-0bd6-527f-9773-99eab8f9dbb9.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/402-8d949343-0bd6-527f-9773-99eab8f9dbb9_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/402-8d949343-0bd6-527f-9773-99eab8f9dbb9.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/402-8d949343-0bd6-527f-9773-99eab8f9dbb9.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-402-building-incusos","url":"https://api.media.ccc.de/public/events/8d949343-0bd6-527f-9773-99eab8f9dbb9","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"74362ca8-ad35-5eb5-a96e-8d3720a47c22","title":"Building image-based operating system images with BuildStream and mkosi","subtitle":null,"slug":"all-systems-go-2026-423-building-image-based-operating-system-images-with-buildstream-and-mkosi","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/DUNFF9/","description":"BuildStream is a tool for building / integrating software stacks. In a way, it has a similar goal to bitbake / yocto and Android's repo, but takes a completely different approach. It can be used to take software from various sources, build it with various buildsystems in a reproducible sandbox, and cache results for speedy rebuilds.\n\nmkosi is a tool for easily building customized OS images. It is generally used with distros that have a package manager such as dnf or apt. There is however recent development to add support for using it with BuildStream.\n\nIn this talk I give a brief overview of Buildstream, and freedesktop-sdk which is a BuildStream project that can be used as a base to build your own operating system. While BuildStream on its own can build the whole thing, there are some advantages to using mkosi which I'll go over in this talk.\n\nI'll also go over the challenges faced moving GNOME OS to use mkosi for generating the image.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Abderrahim Kitouni"],"view_count":101,"promoted":false,"date":"2026-10-01T14:05:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T00:15:03.516+02:00","tags":["423","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":2170,"duration":2170,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/423-74362ca8-ad35-5eb5-a96e-8d3720a47c22.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/423-74362ca8-ad35-5eb5-a96e-8d3720a47c22_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/423-74362ca8-ad35-5eb5-a96e-8d3720a47c22.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/423-74362ca8-ad35-5eb5-a96e-8d3720a47c22.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-423-building-image-based-operating-system-images-with-buildstream-and-mkosi","url":"https://api.media.ccc.de/public/events/74362ca8-ad35-5eb5-a96e-8d3720a47c22","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"2f14c798-d2de-51aa-82df-284ad3c3dcc8","title":"An API for systemd Machines","subtitle":null,"slug":"all-systems-go-2026-433-an-api-for-systemd-machines","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/RZ3PUB/","description":"In this talk I'd like to provide a vision for accessing systemd hosts via local IPC APIs and remote RPC APIs. With the Varlinkification of systemd going full steam ahead, I'd like to explain what I think should be next for systemd and how things fit together with our focus on APIs.\n\nWe'll talk about metrics/reports, Varlink in general, the Varlink HTTP proxy specifically, about security models, and zero-agent remote access, secure system parameterization and more. We'll talk about design patterns to follow, both for systemd components, and for other OS components, outside of it.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Lennart Poettering"],"view_count":225,"promoted":false,"date":"2026-10-01T10:00:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-19T22:45:09.532+02:00","tags":["433","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":2430,"duration":2430,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/433-2f14c798-d2de-51aa-82df-284ad3c3dcc8.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/433-2f14c798-d2de-51aa-82df-284ad3c3dcc8_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/433-2f14c798-d2de-51aa-82df-284ad3c3dcc8.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/433-2f14c798-d2de-51aa-82df-284ad3c3dcc8.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-433-an-api-for-systemd-machines","url":"https://api.media.ccc.de/public/events/2f14c798-d2de-51aa-82df-284ad3c3dcc8","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"295fed84-a14f-5608-940e-0b28d5fd1b85","title":"systemd: reducing impact of servicing interruptions on restart/reboot","subtitle":null,"slug":"all-systems-go-2026-393-systemd-reducing-impact-of-servicing-interruptions-on-restart-reboot","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/XFZKN8/","description":"When a machine/server/node is serviced and experiences a downtime, that results in a service interruption, customers or users tend to get quite sad. This talk will explore two recent additions to systemd that aim to make these service interruptions as minimal as possible.\n\nsystemd v260 and v261 added two features which aim to let service owners minimize downtime.\n\nFirstly, when services use dm-verity images, profiling data showed that the largest bottleneck by far was loading the new images, which used to happen after the running service had already stopped during a unit restart. Since v260, when very specific conditions are met, this bottleneck has been removed from the critical path.\n\nSecondly, a common issue causing slowdowns for services is having to serialize and deserialize large amount of state from slow disks after a reboot due to an OS update. Since v261, systemd supports the kernel's Live Update Orchestration, and uses it to persist the content of the FD Store across a kexec reboot. Services can use a memfd for their runtime state, hand it over the systemd when they are stopped/restarted, and they will get it back and can mmap it and use it straight away on restart. With LUO support, services can rely on this even across a kexec, removing the need to use serialize and deserialize state to disk.\n\nThis talk will explore both features, explaining how they work and how they can be used.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Luca Boccassi"],"view_count":67,"promoted":false,"date":"2026-10-01T12:10:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-17T09:45:04.424+02:00","tags":["393","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":1340,"duration":1340,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/393-295fed84-a14f-5608-940e-0b28d5fd1b85.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/393-295fed84-a14f-5608-940e-0b28d5fd1b85_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/393-295fed84-a14f-5608-940e-0b28d5fd1b85.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/393-295fed84-a14f-5608-940e-0b28d5fd1b85.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-393-systemd-reducing-impact-of-servicing-interruptions-on-restart-reboot","url":"https://api.media.ccc.de/public/events/295fed84-a14f-5608-940e-0b28d5fd1b85","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"454959b1-8c6b-53d8-8388-a9069e9d6901","title":"Running mutable OS images on Confidential VMs: is there any hope?","subtitle":null,"slug":"all-systems-go-2026-399-running-mutable-os-images-on-confidential-vms-is-there-any-hope-","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/VNXPQS/","description":"Confidential VM (CVM) instance types are becoming ubiquitous, with all major cloud providers offering them as a key component for achieving “zero trust.” While complete zero trust is currently more of a marketing term than a technical reality, we can acknowledge that CVM technologies help reduce the Trusted Computing Base (TCB) when utilized properly. But do we actually know how to use them effectively?\nWhen transitioning from a world of traditional, mutable operating systems, users often expect to gain security benefits simply by moving their existing workloads to new CVM instance types, perhaps with some level of attestation. Unfortunately, in many cases, this looks more like a role play in a “security theater”.\nOver the past few years, we have investigated what security benefits can truly be unlocked when mutable RHEL or Fedora workloads are deployed on confidential VMs, whether in the public cloud or on-premises. While immutable OSes offer distinct advantages in such scenarios, we pose the question: can traditional (mutable) OSes also benefit? Over the last year, we have contributed several features to systemd (and other components) that we believe can improve the situation. In particular, we are focused on preventing certain attack scenarios against a VM which is normally deployed from a publicly available cloud (marketplace) image. We have further ideas, and in this talk, we will share our vision for how these pieces can fit together.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Vitaly Kuznetsov","Simran Paul Singh"],"view_count":56,"promoted":false,"date":"2026-10-01T11:25:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T08:45:08.841+02:00","tags":["399","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":2183,"duration":2183,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/399-454959b1-8c6b-53d8-8388-a9069e9d6901.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/399-454959b1-8c6b-53d8-8388-a9069e9d6901_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/399-454959b1-8c6b-53d8-8388-a9069e9d6901.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/399-454959b1-8c6b-53d8-8388-a9069e9d6901.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-399-running-mutable-os-images-on-confidential-vms-is-there-any-hope-","url":"https://api.media.ccc.de/public/events/454959b1-8c6b-53d8-8388-a9069e9d6901","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"b23e7390-95a8-5c6e-bc93-35864b84b95c","title":"Seamless Upgrades with KHO, LUO, and systemd","subtitle":null,"slug":"all-systems-go-2026-430-seamless-upgrades-with-kho-luo-and-systemd","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/J8GNND/","description":"For years, kexec was the standard way to skip lengthy firmware and bootloader delays at reboot. However, in modern cloud environments, even a fast reboot causes severe service degradation. Guests evacuation in virtualized environments or rebuild of massive in-memory caches for large databases is costly and disruptive.\n\nKernel HandOver (KHO) and Live Update Orchestrator (LUO) introduce a complete framework for seamless kernel and userspace state preservation across upgrades.\n\nKHO provides the infrastructure to preserve kernel data structures and arbitrary memory regions across kexec. Physically contiguous memory areas managed by KHO let the incoming kernel to bootstrap itself without touching the preserved memory.\n\nOn top of KHO, LUO provides userspace APIs for coordination of the transition and allows applications to preserve file descriptors across kexec. With initial support for memory file descriptors (memfd), the ecosystem is rapidly expanding to cover subsystems like PCI, VFIO, KVM, guestmemfd, and iommufd.\n\nMoreover, the ecosystem now features native systemd integration, leveraging the standard fdstore interface to pass resources across the kernel reboot.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Mike Rapoport"],"view_count":78,"promoted":false,"date":"2026-10-01T11:25:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T22:45:09.188+02:00","tags":["430","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":2218,"duration":2218,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/430-b23e7390-95a8-5c6e-bc93-35864b84b95c.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/430-b23e7390-95a8-5c6e-bc93-35864b84b95c_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/430-b23e7390-95a8-5c6e-bc93-35864b84b95c.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/430-b23e7390-95a8-5c6e-bc93-35864b84b95c.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-430-seamless-upgrades-with-kho-luo-and-systemd","url":"https://api.media.ccc.de/public/events/b23e7390-95a8-5c6e-bc93-35864b84b95c","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"27dafc2c-48af-55ef-ad16-a46c90e776e0","title":"Native OS enrollment for the Linux userspace: A proposal for open APIs and protocols","subtitle":null,"slug":"all-systems-go-2026-397-native-os-enrollment-for-the-linux-userspace-a-proposal-for-open-apis-and-protocols","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/3RTJNA/","description":"Enterprise Linux deployments lack a standardized, native enrollment flow. Current solutions rely on distro‑specific first‑boot mechanisms (systemd-firstboot, cloud‑init, realmd, ignition, kickstart and more) or external configuration management layered post‑deployment, resulting in poor feature sets w.r.t. modern features enabled by TPM2 or UEFI setting management.\n\nThis talk proposes to explore minimal, vendor‑neutral set of APIs and protocols for OS enrollment, *analogous to* Windows Autopilot but designed for the Linux userspace stack and specifically for the ParticleOS ecosystem. We will examine a concrete model based on device identity (TPM, SMBIOS information), secure attestation, policy discovery, and management‑hint delivery, decoupled from any particular configuration management system.\n\nThere might be a live demonstration presenting a reference implementation on NixOS communicating with a lightweight enrollment service over HTTP(S) leveraging a bunch of Varlink APIs built across the past years and presented at ASG.\n\nThe primary outcome is a community‑reviewed specification draft for enrollment APIs, intended for integration into systemd and distro installers.\n\nThe talk is not a proposal for a new tool but rather invite the attendees to think about the problem space around corporate enrollment for Linux distributions and how do we build native solutions for distributions interested by this idea.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Ryan Lahfa (@raitobezarius)"],"view_count":129,"promoted":false,"date":"2026-10-01T10:45:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-19T07:45:03.223+02:00","tags":["397","2026","asg2026","Loft","asg2026-eng","asg2026","Day 2"],"length":1080,"duration":1080,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/397-27dafc2c-48af-55ef-ad16-a46c90e776e0.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/397-27dafc2c-48af-55ef-ad16-a46c90e776e0_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/397-27dafc2c-48af-55ef-ad16-a46c90e776e0.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/397-27dafc2c-48af-55ef-ad16-a46c90e776e0.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-397-native-os-enrollment-for-the-linux-userspace-a-proposal-for-open-apis-and-protocols","url":"https://api.media.ccc.de/public/events/27dafc2c-48af-55ef-ad16-a46c90e776e0","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"52ca4659-77eb-5657-8401-71035bd4dd5e","title":"KDE Linux Under the Hood","subtitle":null,"slug":"all-systems-go-2026-416-kde-linux-under-the-hood","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/VXGVJF/","description":"KDE's new image-based Linux distribution embraces modern technologies whenever possible. We'll explore all the tools that contribute, and how they are being utilized to form the final product. From building the disk image to eventually updating it on the user's system.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Harald Sitter"],"view_count":194,"promoted":false,"date":"2026-10-01T10:45:00.000+02:00","release_date":"2026-10-01T00:00:00.000+02:00","updated_at":"2026-10-20T17:45:05.245+02:00","tags":["416","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 2"],"length":1399,"duration":1399,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/416-52ca4659-77eb-5657-8401-71035bd4dd5e.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/416-52ca4659-77eb-5657-8401-71035bd4dd5e_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/416-52ca4659-77eb-5657-8401-71035bd4dd5e.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/416-52ca4659-77eb-5657-8401-71035bd4dd5e.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-416-kde-linux-under-the-hood","url":"https://api.media.ccc.de/public/events/52ca4659-77eb-5657-8401-71035bd4dd5e","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"5b74ae6e-b822-56c9-992a-6bbcc83c894d","title":"systemd services as microvms","subtitle":null,"slug":"all-systems-go-2026-448-systemd-services-as-microvms","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/7U77A3/","description":"What if we could run systemd services on top of virtual cpu/memory, to get hypervisor/cpu protection of memory pages? Demo of a very much work-in-progress proof-of-concept\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Luca Boccassi"],"view_count":165,"promoted":false,"date":"2026-09-30T17:30:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T21:45:08.018+02:00","tags":["448","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":209,"duration":209,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/448-5b74ae6e-b822-56c9-992a-6bbcc83c894d.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/448-5b74ae6e-b822-56c9-992a-6bbcc83c894d_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/448-5b74ae6e-b822-56c9-992a-6bbcc83c894d.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/448-5b74ae6e-b822-56c9-992a-6bbcc83c894d.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-448-systemd-services-as-microvms","url":"https://api.media.ccc.de/public/events/5b74ae6e-b822-56c9-992a-6bbcc83c894d","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"350cd483-8078-53e3-907c-6efc046537cb","title":"Make Debian Immutable with mkosi and Nix","subtitle":null,"slug":"all-systems-go-2026-415-make-debian-immutable-with-mkosi-and-nix","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/BEDGKF/","description":"Immutable, image-based Linux has gone mainstream — on Fedora. Nearly every atomic distro descends from the RPM/ostree lineage. Debian is conspicuously rare, with really only Vanilla OS and Endless OS to its name. There's a reason, and it's apt: Debian's package manager expects a writable root filesystem, so the moment you seal the rootfs, the native way to install and update software stops working. That's the wall every immutable Debian hits, and most climb it with Flatpak or containers. This talk takes a different route — Nix. Nix keeps everything in a self-contained, content-addressed /nix/store, so it never needs a writable rootfs. The base is built once with mkosi and frozen (apt isn't even installed) and Nix manages everything that changes after that, reproducibly. The result is an immutable Debian rootfs with the entire Nix package ecosystem available on top.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Frank Vasquez"],"view_count":310,"promoted":false,"date":"2026-09-30T16:15:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T22:00:08.512+02:00","tags":["415","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":2384,"duration":2384,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/415-350cd483-8078-53e3-907c-6efc046537cb.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/415-350cd483-8078-53e3-907c-6efc046537cb_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/415-350cd483-8078-53e3-907c-6efc046537cb.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/415-350cd483-8078-53e3-907c-6efc046537cb.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-415-make-debian-immutable-with-mkosi-and-nix","url":"https://api.media.ccc.de/public/events/350cd483-8078-53e3-907c-6efc046537cb","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"e42f3783-8315-5eb0-8b66-a587324a9f0a","title":"zbus 6.0","subtitle":null,"slug":"all-systems-go-2026-447-zbus-6-0","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/3C8PUC/","description":"What's new in zbus\n\nhttps://zeenix.github.io/presentations-marp/LTs/zbus-6-whats-new.html\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Zeeshan Ali Khan"],"view_count":90,"promoted":false,"date":"2026-09-30T17:25:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T18:30:06.542+02:00","tags":["447","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":371,"duration":371,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/447-e42f3783-8315-5eb0-8b66-a587324a9f0a.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/447-e42f3783-8315-5eb0-8b66-a587324a9f0a_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/447-e42f3783-8315-5eb0-8b66-a587324a9f0a.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/447-e42f3783-8315-5eb0-8b66-a587324a9f0a.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-447-zbus-6-0","url":"https://api.media.ccc.de/public/events/e42f3783-8315-5eb0-8b66-a587324a9f0a","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"5aabf3ed-7f7c-5513-97ef-b7bef7371144","title":"The state of systemd sandboxing in Debian","subtitle":null,"slug":"all-systems-go-2026-400-the-state-of-systemd-sandboxing-in-debian","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/VLBXZ8/","description":"Marco will review the state of systemd sandboxing in Debian packages, what we need to fix to have more and what will break by enabling too much of it.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Marco d'Itri"],"view_count":104,"promoted":false,"date":"2026-09-30T17:20:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T21:45:10.273+02:00","tags":["400","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":341,"duration":341,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/400-5aabf3ed-7f7c-5513-97ef-b7bef7371144.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/400-5aabf3ed-7f7c-5513-97ef-b7bef7371144_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/400-5aabf3ed-7f7c-5513-97ef-b7bef7371144.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/400-5aabf3ed-7f7c-5513-97ef-b7bef7371144.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-400-the-state-of-systemd-sandboxing-in-debian","url":"https://api.media.ccc.de/public/events/5aabf3ed-7f7c-5513-97ef-b7bef7371144","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"d672c0b5-5b41-59ed-9495-9e0ce89f5ec4","title":"From fsync to Block I/O: Tracing Storage with eBPF","subtitle":null,"slug":"all-systems-go-2026-418-from-fsync-to-block-i-o-tracing-storage-with-ebpf","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/XHJX3N/","description":"Observability stacks have gotten good at CPU, memory, and network — but storage is still where the picture goes dark. When a workload stalls on I/O, device-level tools like iostat or blktrace tell you the disk was busy; they don't tell you which service caused it, or where in the stack the latency actually accrued: a slow fsync, writeback pressure in the page cache, a filesystem journal commit, or a saturated block queue.\n\nThis talk follows a single write from the syscall boundary down to the block layer, using eBPF to instrument each handoff — VFS, the filesystem, the page cache, and block I/O submission and completion — without patching applications or running a custom kernel. We'll look at which attach points (tracepoints, fentry/fexit, kprobes) give honest per-layer latency, how to keep the measurement overhead from biasing the result, and how to attribute the latency back to the responsible cgroup or systemd service instead of an aggregate line on a dashboard. Examples range from fsync-heavy database commits to large sequential writes that look fine at the device level but stall well above it.\n\nAttendees will leave with a concrete method for turning storage from a black box into a traceable path — and an honest sense of where eBPF helps, and where it still can't see.\n\nFollow a single write from syscall to block layer with eBPF, measuring honest per-layer latency at each handoff and attributing storage stalls to the service that caused them.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Kritik Sachdeva"],"view_count":50,"promoted":false,"date":"2026-09-30T17:10:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T21:15:08.214+02:00","tags":["418","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":397,"duration":397,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/418-d672c0b5-5b41-59ed-9495-9e0ce89f5ec4.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/418-d672c0b5-5b41-59ed-9495-9e0ce89f5ec4_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/418-d672c0b5-5b41-59ed-9495-9e0ce89f5ec4.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/418-d672c0b5-5b41-59ed-9495-9e0ce89f5ec4.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-418-from-fsync-to-block-i-o-tracing-storage-with-ebpf","url":"https://api.media.ccc.de/public/events/d672c0b5-5b41-59ed-9495-9e0ce89f5ec4","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"863d4702-cf23-5e03-942d-773cdc2ccbef","title":"Rethinking systemd-homed's Key Hierarchy","subtitle":null,"slug":"all-systems-go-2026-412-rethinking-systemd-homed-s-key-hierarchy","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/TL3KGN/","description":"When you lock your systemd-homed enabled Linux desktop today, your home directory (including the desktop session) is fully frozen. This happens because systemd-homed uses a single cryptographic key (the LUKS volume key) and throws it away during lock. Want to lock away just your credentials as on a normal screen lock while keeping music playing and notifications coming through? You can't.\n\nThis talk presents the work done as part of the systemd STF grant to extend the systemd-homed's key hierarchy that fixes this issue.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Dhanuka Warusadura"],"view_count":71,"promoted":false,"date":"2026-09-30T17:15:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T12:30:06.203+02:00","tags":["412","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":187,"duration":187,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/412-863d4702-cf23-5e03-942d-773cdc2ccbef.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/412-863d4702-cf23-5e03-942d-773cdc2ccbef_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/412-863d4702-cf23-5e03-942d-773cdc2ccbef.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/412-863d4702-cf23-5e03-942d-773cdc2ccbef.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-412-rethinking-systemd-homed-s-key-hierarchy","url":"https://api.media.ccc.de/public/events/863d4702-cf23-5e03-942d-773cdc2ccbef","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"02e60db7-20dc-5495-a643-10171d7f38f7","title":"Couple Services, Not the Host: Portable Services and Capsules","subtitle":null,"slug":"all-systems-go-2026-436-couple-services-not-the-host-portable-services-and-capsules","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/K9GPKV/","description":"System extensions (sysexts) become part of the host's /usr, making them available to all users. But what if we want to run tightly coupled services without exposing their binaries to everyone else on the system?\n\nThis lightning talk will show how to ship a real-world stack (kubelet, containerd, and runc) without making them accessible to the rest of the host. We will demonstrate how to use portable services and systemd capsules to allow these components to invoke each other and share some namespaces, all while keeping the host OS clean.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Rodrigo Campos Catelin"],"view_count":31,"promoted":false,"date":"2026-09-30T17:05:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-17T16:00:05.185+02:00","tags":["436","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":245,"duration":245,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/436-02e60db7-20dc-5495-a643-10171d7f38f7.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/436-02e60db7-20dc-5495-a643-10171d7f38f7_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/436-02e60db7-20dc-5495-a643-10171d7f38f7.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/436-02e60db7-20dc-5495-a643-10171d7f38f7.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-436-couple-services-not-the-host-portable-services-and-capsules","url":"https://api.media.ccc.de/public/events/02e60db7-20dc-5495-a643-10171d7f38f7","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"210a35a1-0980-5b55-8723-c14847aa9682","title":"Modernizing local storage management for systemd services","subtitle":null,"slug":"all-systems-go-2026-410-modernizing-local-storage-management-for-systemd-services","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/N93KWW/","description":"The storage directory settings in systemd help define where services store their data. Two important features have been implemented for these directories. The first one is id-mapped mounts, which is a filesystem feature that allows a mount namespace to show a different UID than what is stored on a file. Storage directories now support id-mapping, so that the files within the mount namespace of a service defined with DynamicUser=yes are owned by its unprivileged UID/GID. The second feature is storage quota support. Storage limits can now be defined in terms of percentages or absolute values to enforce quotas on the consumption of State, Cache, and Logs directories. These features enhance the security and resource management of systemd services.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Andres Beltran"],"view_count":92,"promoted":false,"date":"2026-09-30T16:15:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T01:45:03.963+02:00","tags":["410","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":2347,"duration":2347,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/410-210a35a1-0980-5b55-8723-c14847aa9682.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/410-210a35a1-0980-5b55-8723-c14847aa9682_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/410-210a35a1-0980-5b55-8723-c14847aa9682.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/410-210a35a1-0980-5b55-8723-c14847aa9682.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-410-modernizing-local-storage-management-for-systemd-services","url":"https://api.media.ccc.de/public/events/210a35a1-0980-5b55-8723-c14847aa9682","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"77c7da84-07e0-5723-bd69-5154710d6da1","title":"An update on systemd-sysext/confext","subtitle":null,"slug":"all-systems-go-2026-429-an-update-on-systemd-sysext-confext","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/RMC879/","description":"The limitations of systemd-sysext/confext from the early days are mostly gone nowadays. The loading of extension images from the initrd means that generic content will behave as expected without any workarounds. New settings help making live reconfiguration work better as well. We will see how declarative configuration management with systemd-sysext/confext from git can be done with an OpenTofu/Terraform module. For image-based Linux binding configuration together with a pinned OS version is now possible through bootctl link. OS builders can ship /etc files through a default confext image.\n\nsystemd-sysext/confext: https://www.freedesktop.org/software/systemd/man/devel/systemd-sysext.html\nbootctl: https://www.freedesktop.org/software/systemd/man/devel/bootctl.html\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Kai Lüke"],"view_count":88,"promoted":false,"date":"2026-09-30T17:00:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T11:00:05.921+02:00","tags":["429","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":362,"duration":362,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/429-77c7da84-07e0-5723-bd69-5154710d6da1.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/429-77c7da84-07e0-5723-bd69-5154710d6da1_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/429-77c7da84-07e0-5723-bd69-5154710d6da1.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/429-77c7da84-07e0-5723-bd69-5154710d6da1.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-429-an-update-on-systemd-sysext-confext","url":"https://api.media.ccc.de/public/events/77c7da84-07e0-5723-bd69-5154710d6da1","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"08c82394-512b-595b-9361-b26698f3888e","title":"Immutable, Fully-Confined Debian Server Images, Even on a Raspberry Pi 3","subtitle":null,"slug":"all-systems-go-2026-422-immutable-fully-confined-debian-server-images-even-on-a-raspberry-pi-3","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/KJNYQ8/","description":"Using mkosi and apparmor.d as building blocks, this talk presents a prototype minimal Debian server. The goal is not to provide yet another Linux distribution, but to explore how hard it is to build personalized, hardened server images.\n\nOn top of the usual mkosi-backed features such as UKIs, A/B updates and dm-verity, the project adds a whole-system AppArmor policy and an immutable `/etc`. Because older devices also matter, the prototype supports the Raspberry Pi 3 (UEFI) too, with minor changes to the security model. The talk presents the differences in design, attacker model, and implementation between the various targets.\n\nThis talk walks through a prototype: a minimal, hardened Debian server built with `mkosi` and `apparmor.d`. It composes three layers of systemd and Debian tooling that are well understood alone but rarely combined, each reinforcing the others:\n\n- **Image-based OS:** `mkosi` magic.\n- **Whole-system MAC:** AppArmor policies that confine every process on the system. It also brings:\n    - Multi-layered policy loading, fixing the AppArmor load-time issues that hurt small devices.\n    - Immutable security policies.\n    - Compatibility with systemd sysext/confext.\n- **Immutable `/etc`:** assembled from signed `systemd-confext` images, closing immutability's usual escape hatch.\n\nThe same image targets both an x86-64 server and a Raspberry Pi 3 (UEFI), and that contrast is where it gets interesting. The two share a single build but diverge on attacker model and security guarantees: what an embedded device with no Secure Boot can promise versus a server, and where the implementation has to bend. We walk those differences, the limitations, and what would have to land upstream to make this kind of image easier.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Alexandre Pujol"],"view_count":98,"promoted":false,"date":"2026-09-30T15:35:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T18:00:04.171+02:00","tags":["422","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1430,"duration":1430,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/422-08c82394-512b-595b-9361-b26698f3888e.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/422-08c82394-512b-595b-9361-b26698f3888e_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/422-08c82394-512b-595b-9361-b26698f3888e.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/422-08c82394-512b-595b-9361-b26698f3888e.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-422-immutable-fully-confined-debian-server-images-even-on-a-raspberry-pi-3","url":"https://api.media.ccc.de/public/events/08c82394-512b-595b-9361-b26698f3888e","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"2c2479f4-fccf-5076-a02c-77966ac8ba5b","title":"systemd \u0026 OCI","subtitle":null,"slug":"all-systems-go-2026-435-systemd-oci","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/BWWVCN/","description":"Recently systemd acquired functionality to download \u0026 invoke OCI containers directly. In this talk I'd like to explain where we are at with this, what we have, where the gaps are and where we are going, to make OCI containers a thing you can directly execute with systemd, without external tools.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Lennart Poettering"],"view_count":565,"promoted":false,"date":"2026-09-30T15:35:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T22:45:11.734+02:00","tags":["435","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1596,"duration":1596,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/435-2c2479f4-fccf-5076-a02c-77966ac8ba5b.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/435-2c2479f4-fccf-5076-a02c-77966ac8ba5b_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/435-2c2479f4-fccf-5076-a02c-77966ac8ba5b.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/435-2c2479f4-fccf-5076-a02c-77966ac8ba5b.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-435-systemd-oci","url":"https://api.media.ccc.de/public/events/2c2479f4-fccf-5076-a02c-77966ac8ba5b","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"c0186a8b-1d94-53fe-989d-93ede50dc571","title":"single-file containers with statically linked systemd","subtitle":null,"slug":"all-systems-go-2026-427-single-file-containers-with-statically-linked-systemd","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/XU9CJR/","description":"Systemd can now be linked as a single static binary, which is enough to run a \"full system\" container that boots into a running manager. Transient units can then be used to do more things in the container. Thanks to systemd-nsresourced and systemd-mountfsd, this now works fully unprivileged and with no suid helpers. I want to show that this actually works and can be used for experimentation, development, and custom container images.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Zbigniew Jędrzejewski-Szmek"],"view_count":67,"promoted":false,"date":"2026-09-30T15:05:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T22:45:10.083+02:00","tags":["427","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1587,"duration":1587,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/427-c0186a8b-1d94-53fe-989d-93ede50dc571.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/427-c0186a8b-1d94-53fe-989d-93ede50dc571_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/427-c0186a8b-1d94-53fe-989d-93ede50dc571.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/427-c0186a8b-1d94-53fe-989d-93ede50dc571.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-427-single-file-containers-with-statically-linked-systemd","url":"https://api.media.ccc.de/public/events/c0186a8b-1d94-53fe-989d-93ede50dc571","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"c073b66f-dd73-5f26-9374-9e026c064df7","title":"Forget \"podman generate systemd\": How Quadlet Really Works","subtitle":null,"slug":"all-systems-go-2026-424-forget-podman-generate-systemd-how-quadlet-really-works","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/PXBVLE/","description":"For a while, the standard way to run Podman containers under systemd was podman generate systemd. It worked, but the output was static and awkward to maintain. Quadlet replaced it — and most guides stop at \"drop an INI file in a directory and your container starts.\" leaving the machinery a black box. \n\nThis talk demystifies that black box, because the internals are exactly what you reach for when things break. Quadlet isn't a daemon. It's a systemd generator that runs at daemon-reload and turns your .container, .pod, and .network files into ordinary .service units. \n\nIn session, we'll trace one stack example from end to end, watching a three-line container file expand into a full podman run command, and cross-unit references become injected After=/Wants= dependency edges with name-mangled volumes and networks.\n\nYou'll leave knowing exactly what gets generated, why edits need a daemon-reload, how to dump \u0026 debug a failing unit yourself, and explain why keeping only the source files under version control is reliable. Less magic, more model.\n\nQuadlet isn't magic—it's a systemd generator. Watch a three-line .container file expand into a full service unit, and learn to dump, debug, and reason about what really gets generated.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Kritik Sachdeva"],"view_count":202,"promoted":false,"date":"2026-09-30T15:05:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T13:45:08.645+02:00","tags":["424","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1146,"duration":1146,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/424-c073b66f-dd73-5f26-9374-9e026c064df7.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/424-c073b66f-dd73-5f26-9374-9e026c064df7_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/424-c073b66f-dd73-5f26-9374-9e026c064df7.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/424-c073b66f-dd73-5f26-9374-9e026c064df7.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-424-forget-podman-generate-systemd-how-quadlet-really-works","url":"https://api.media.ccc.de/public/events/c073b66f-dd73-5f26-9374-9e026c064df7","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"e2f479b8-b1d0-55d7-a086-3b4b34b1aacf","title":"Containers without a new runtime: sdme on systemd-nspawn","subtitle":null,"slug":"all-systems-go-2026-403-containers-without-a-new-runtime-sdme-on-systemd-nspawn","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/E7MHZJ/","description":"sdme is a single static binary that boots systemd-nspawn containers using copy-on-write roots (overlayfs layers or btrfs snapshots), with OCI registry pulling and Kubernetes Pod YAML support. No daemon, no runtime dependency beyond the systemd you already run.\n\nWhy I built it. Every container runtime reinvents what systemd already does well: process supervision, logging, cgroups, service ordering, socket activation. sdme makes the opposite bet. systemd-nspawn already boots a full system in isolation; the kernel already gives it a cheap copy-on-write root, whether through overlayfs or a btrfs snapshot. Put a thin, daemonless CLI over the two and you get container workflows (clone, import, pull, run) without a new runtime to install or a daemon to keep alive. It began as a one-command clone of the running host, but the bet is bigger than that: lean on the init system instead of rebuilding it.\n\nWhat you get. Proper machine-like containers: each one runs a full systemd init with journald, D-Bus, and systemctl, not a single foreground process. Each container is highly configurable through native systemd surfaces, with per-container resource limits, networking, and drop-in config. Clone your running host into a throwaway container in one command; run a Docker Hub image (nginx, redis, postgres) as a managed systemd service instead of a foreground process; deploy a multi-container pod from Kubernetes Pod YAML with health probes, secrets, and configmaps. A rootfs can also come from any distro, an OCI registry, a tarball, or a QCOW2 image, and you can build your own from a Dockerfile-like config.\n\nHow it works. One copy-on-write root and one systemd-nspawn invocation give you a fully booted system. Storage is pluggable per container. The overlayfs backend mounts the host / (or any imported rootfs) as an immutable lower layer with a fresh upper, so clones are instant. The btrfs backend snapshots the base rootfs as a subvolume instead, which makes the container root a real filesystem: nested containers work, user namespaces use native idmapped mounts, and per-container disk quotas come from qgroups. It runs directly on a btrfs data directory, or inside a loopback pool image on any other filesystem. The binary does two jobs: it manages those copy-on-write roots, and it drives systemd over D-Bus to start, stop, and supervise containers. Everything else (init, journald, cgroups, service ordering) is systemd doing what it already does, with no daemon in the middle.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Alexandre Fiori"],"view_count":426,"promoted":false,"date":"2026-09-30T14:20:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T19:45:05.607+02:00","tags":["403","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":2433,"duration":2433,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/403-e2f479b8-b1d0-55d7-a086-3b4b34b1aacf.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/403-e2f479b8-b1d0-55d7-a086-3b4b34b1aacf_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/403-e2f479b8-b1d0-55d7-a086-3b4b34b1aacf.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/403-e2f479b8-b1d0-55d7-a086-3b4b34b1aacf.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-403-containers-without-a-new-runtime-sdme-on-systemd-nspawn","url":"https://api.media.ccc.de/public/events/e2f479b8-b1d0-55d7-a086-3b4b34b1aacf","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"12e431be-561c-5a31-ab43-3529f43e232c","title":"A unified OS installer in systemd","subtitle":null,"slug":"all-systems-go-2026-404-a-unified-os-installer-in-systemd","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/SBUXXA/","description":"Linux doesn't have a unified way to be installed. Every distribution implements their own installer with a different feature set and UX. systemd-sysinstall is a tool to install an OS to a device. It leverages repart to format the disk and bootctl to manage UEFI and the boot partition and supports disk encryption and TPM integration. In addition, it exposes a varlink interface to be used by graphical installers.\n\n\nIn this talk we will explore what sysinstall does, how the GNOME OS installer (gnome-setup) leverages it to install GNOME OS, why distributions shipping GNOME should switch to gnome-setup, and how other desktop environments can build installers using the same stack.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Julian Sparber"],"view_count":181,"promoted":false,"date":"2026-09-30T14:20:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T22:45:06.463+02:00","tags":["404","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":2025,"duration":2025,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/404-12e431be-561c-5a31-ab43-3529f43e232c.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/404-12e431be-561c-5a31-ab43-3529f43e232c_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/404-12e431be-561c-5a31-ab43-3529f43e232c.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/404-12e431be-561c-5a31-ab43-3529f43e232c.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-404-a-unified-os-installer-in-systemd","url":"https://api.media.ccc.de/public/events/12e431be-561c-5a31-ab43-3529f43e232c","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"f00ce030-06a4-5753-a902-837a0acc2aa6","title":"Measured Boot in NixOS \u0026 Other systemd Updates","subtitle":null,"slug":"all-systems-go-2026-391-measured-boot-in-nixos-other-systemd-updates","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/QDB7AL/","description":"This talk will present the newest updates and advancements in NixOS related to Secure \u0026 Measured Boot. It will take a look at what we have achieved this far, what issues we have come across, what we would like to see from the ecosystem, and what we are working towards next. Additionally, it will go over some other exciting things that happened related to systemd in NixOS.\n\nKey advancements:\n- [Support for Measured Boot via systemd-pcrlock in Lanzaboote](https://github.com/nix-community/lanzaboote/pull/564) (the boot security toolkit for NixOS)\n- [Support for Boot Counting in Lanzabooote](https://github.com/nix-community/lanzaboote/pull/477)\n- [Removed most patches from systemd (18 -\u003e 6)](https://github.com/NixOS/nixpkgs/pull/488508) and added a patch policy that prohibits most new patches.\n- [systemd initrd is now the default](https://github.com/NixOS/nixpkgs/pull/435781)\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Niklas Sturm"],"view_count":158,"promoted":false,"date":"2026-09-30T12:25:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-18T17:30:07.234+02:00","tags":["391","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1439,"duration":1439,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/391-f00ce030-06a4-5753-a902-837a0acc2aa6.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/391-f00ce030-06a4-5753-a902-837a0acc2aa6_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/391-f00ce030-06a4-5753-a902-837a0acc2aa6.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/391-f00ce030-06a4-5753-a902-837a0acc2aa6.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-391-measured-boot-in-nixos-other-systemd-updates","url":"https://api.media.ccc.de/public/events/f00ce030-06a4-5753-a902-837a0acc2aa6","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"c6f8d047-d6a3-5a25-9d87-6c1f487590bc","title":"Do Users Actually Want a Trusted, Immutable OS?  Lessons from the Industry","subtitle":null,"slug":"all-systems-go-2026-395-do-users-actually-want-a-trusted-immutable-os-lessons-from-the-industry","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/R8XMRT/","description":"Recent years have spurred much discussion in Linux communities about the idea of building an OS that is both Trusted and Immutable.  While successful in many ways, attempts to implement these ideas have created numerous sharp edges for end users.  At the same time, these initiatives bear many advantages for the ecosystem's push towards becoming more reliable, accessible, and consumable.  What lessons can we take from other OS vendors to improve user experience and accelerate adoption?\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Katie Miller"],"view_count":446,"promoted":false,"date":"2026-09-30T12:25:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T17:00:07.603+02:00","tags":["395","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1301,"duration":1301,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/395-c6f8d047-d6a3-5a25-9d87-6c1f487590bc.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/395-c6f8d047-d6a3-5a25-9d87-6c1f487590bc_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/395-c6f8d047-d6a3-5a25-9d87-6c1f487590bc.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/395-c6f8d047-d6a3-5a25-9d87-6c1f487590bc.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-395-do-users-actually-want-a-trusted-immutable-os-lessons-from-the-industry","url":"https://api.media.ccc.de/public/events/c6f8d047-d6a3-5a25-9d87-6c1f487590bc","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"efb38d7d-3ebb-5e3e-8e8d-60a97940c534","title":"systemd: round table","subtitle":null,"slug":"all-systems-go-2026-390-systemd-round-table","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/RN9E3E/","description":"Let's have an open discussion with systemd developers who are at ASG and users in the audience. We will open with the developers saying what they plan to work on in the near future, and then allow questions / comments from the audience.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Luca Boccassi","Zbigniew Jędrzejewski-Szmek","Lennart Poettering","Daan De Meyer"],"view_count":136,"promoted":false,"date":"2026-09-30T11:55:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T18:00:03.337+02:00","tags":["390","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1602,"duration":1602,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/390-efb38d7d-3ebb-5e3e-8e8d-60a97940c534.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/390-efb38d7d-3ebb-5e3e-8e8d-60a97940c534_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/390-efb38d7d-3ebb-5e3e-8e8d-60a97940c534.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/390-efb38d7d-3ebb-5e3e-8e8d-60a97940c534.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-390-systemd-round-table","url":"https://api.media.ccc.de/public/events/efb38d7d-3ebb-5e3e-8e8d-60a97940c534","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"6a8ae828-3791-5ceb-a655-b8bc6366533d","title":"Moonforge: Making Yocto Easy To Assemble","subtitle":null,"slug":"all-systems-go-2026-409-moonforge-making-yocto-easy-to-assemble","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/HNUWBK/","description":"The Yocto project contains multitudes, and as such it contains the ability to create a modern, image based, integrator friendly operating system, taking advantage of various layers of tooling for hardware and feature support. Moonforge is the result of the work done by Igalia in this space, and it focuses on making it easy to create, build, test, deploy, and update a OS image for multiple products and verticals.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Emmanuele Bassi","Martín Abente Lahaye"],"view_count":52,"promoted":false,"date":"2026-09-30T11:55:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T09:45:07.056+02:00","tags":["409","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1432,"duration":1432,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/409-6a8ae828-3791-5ceb-a655-b8bc6366533d.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/409-6a8ae828-3791-5ceb-a655-b8bc6366533d_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/409-6a8ae828-3791-5ceb-a655-b8bc6366533d.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/409-6a8ae828-3791-5ceb-a655-b8bc6366533d.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-409-moonforge-making-yocto-easy-to-assemble","url":"https://api.media.ccc.de/public/events/6a8ae828-3791-5ceb-a655-b8bc6366533d","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"e8f38a6b-69e4-5d5e-82bb-9041d0331099","title":"systemd: state of the project","subtitle":null,"slug":"all-systems-go-2026-389-systemd-state-of-the-project","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/BTLLGC/","description":"Same as every year, a lot has happened in the systemd project since last year's\nASG. We released multiple versions, packed with new components and features.\nThis talk will provide an overview of these changes, commenting on successes and\nchallenges, and a sneak peak at what lies ahead.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Luca Boccassi","Zbigniew Jędrzejewski-Szmek"],"view_count":418,"promoted":false,"date":"2026-09-30T11:25:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T22:45:06.691+02:00","tags":["389","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1331,"duration":1331,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/389-e8f38a6b-69e4-5d5e-82bb-9041d0331099.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/389-e8f38a6b-69e4-5d5e-82bb-9041d0331099_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/389-e8f38a6b-69e4-5d5e-82bb-9041d0331099.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/389-e8f38a6b-69e4-5d5e-82bb-9041d0331099.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-389-systemd-state-of-the-project","url":"https://api.media.ccc.de/public/events/e8f38a6b-69e4-5d5e-82bb-9041d0331099","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"9cbe8d11-14a1-5a9d-b7c9-a7e7a8723da2","title":"Image Based Modular Deployment for Large Teams in Embedded Systems","subtitle":null,"slug":"all-systems-go-2026-413-image-based-modular-deployment-for-large-teams-in-embedded-systems","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/VLKVKW/","description":"The image based Linux vision is clear: immutable system images, declarative composition, no imperative package installation at runtime. But what happens when you need dozens of independently deployable application modules on the same device, each owned by a different team in a large enterprise, each on its own release cadence, while keeping the root filesystem untouched?\n\nWe built a modular deployment system for production Linux devices that takes the image based philosophy to its logical conclusion: every module is a read only ext4 filesystem image, built deterministically at build time, deployed to its own A/B partition with zero installation, and managed entirely through systemd transient services. No unit files on the rootfs. No package manager on the device. No post deploy scripts. The image is the truth.\n\nOn the packaging side, we use deterministic ext4 creation with constant timestamps to produce (mostly) reproducible images regardless of build environment. This reproducibility directly enables efficient delta based OTA: because the on device image is read only and byte identical to what was built, we can chunk-diff against it and deliver only changed blocks critical for constrained networks.\n\nOn the runtime side, a oneshot service mounts each module and starts it via systemd-run as a transient service inheriting automatic restart, cgroup resource control, and clean lifecycle semantics without ever writing a .service file to disk. We deliberately rejected the alternative of modules shipping their own unit files precisely because it violates the principle that deployment must not modify the root filesystem. Transient services give us the systemd machinery we need while preserving an immutable rootfs compatible with dm-verity.\n\nModules are fully isolated: separate uid/gid, sandboxed filesystem access, dedicated persistent storage, and communication exclusively through a formal interface (gRPC unix domain sockets in our case). Each module treats every other module as a remote server: no hard startup dependencies, no shared state, no assumption that any other module is even present on the same device\n\nThe talk will cover:\n\n* Applying image based Linux principles at the application module level, not just the OS\n* Packaging modules as (mostly) reproducible, read only ext4 images with deterministic tooling\n* How image based module packaging enables per-module automated testing: deploying test harnesses as modules themselves, composing versioned module sets for deterministic integration testing, and unlocking independent CI/CD pipelines per team\n* Why deb/rpm, Flatpak, and AppImage each fail for independently deployable A/B modules\n* Delta-based OTA delivery that exploits immutable images for chunk-level diffing\n* systemd transient services as a module lifecycle manager: all the benefits of systemd, none of the rootfs side effects\n* Per-module sandboxing, cgroup isolation, and gRPC-only IPC\n* Lessons from production: independently updating 40+ modules without device reboot\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Corin Rypkema","Mike Sandige","Gopal Paudel"],"view_count":52,"promoted":false,"date":"2026-09-30T11:25:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T10:00:05.821+02:00","tags":["413","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1675,"duration":1675,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/413-9cbe8d11-14a1-5a9d-b7c9-a7e7a8723da2.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/413-9cbe8d11-14a1-5a9d-b7c9-a7e7a8723da2_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/413-9cbe8d11-14a1-5a9d-b7c9-a7e7a8723da2.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/413-9cbe8d11-14a1-5a9d-b7c9-a7e7a8723da2.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-413-image-based-modular-deployment-for-large-teams-in-embedded-systems","url":"https://api.media.ccc.de/public/events/9cbe8d11-14a1-5a9d-b7c9-a7e7a8723da2","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","title":"Proposal for TPM2+FIDO2 enrollment in systemd","subtitle":null,"slug":"all-systems-go-2026-394-proposal-for-tpm2-fido2-enrollment-in-systemd","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/SD3X9L/","description":"User space based Full Disk Encryption in openSUSE is old news. We already can set up FDE installations using the systemd toolset. This allows us to use traditional passwords, the TPM2 to validate the status before mounting the encrypted device or a FIDO2 key to validate the presence of a token owned by authorized users. To increase the security, in Tumbleweed, we recommend combining both TPM2 and a password (TPM2+PIN). This guarantees the system is in a healthy state and the user has the correct authorization, but it still doesn't support a combination of TPM2 and FIDO2 keys. To fix this issue, we are proposing a new enrollment method in systemd: TPM2+FIDO2.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Alberto Planas Dominguez"],"view_count":73,"promoted":false,"date":"2026-09-30T10:45:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-18T20:30:06.268+02:00","tags":["394","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1307,"duration":1307,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/394-23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-394-proposal-for-tpm2-fido2-enrollment-in-systemd","url":"https://api.media.ccc.de/public/events/23b0213c-cfe6-5daf-a7f9-dd6bb7cafcec","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"f859278b-e2af-5765-a085-756644211b26","title":"Bridging the (varlink) gap","subtitle":null,"slug":"all-systems-go-2026-407-bridging-the-varlink-gap","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/WDRTYW/","description":"Systemd provides a growing set of very useful varlink APIs. With the new Rust-based varlink-http-bridge, it is possible to expose any number of them over the network securely via https/websockets, including over vsock, with all of the interesting varlink features like \"more\" support or \"protocol-upgrade\" support.\n\nThis presentation gives an overview of why varlink and websockets are such a good fit, why the varlink-http-bridge implementation is mostly just a transparent byte proxy, and how it plugs into varlinkctl seamlessly to make networked varlinkctl calls \"just work\". It also explains the security model and the plans for the future.\n\nThe project lives in https://github.com/systemd/varlink-http-bridge.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Michael Vogt"],"view_count":190,"promoted":false,"date":"2026-09-30T10:15:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-19T12:45:07.032+02:00","tags":["407","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":1555,"duration":1555,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/407-f859278b-e2af-5765-a085-756644211b26.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/407-f859278b-e2af-5765-a085-756644211b26_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/407-f859278b-e2af-5765-a085-756644211b26.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/407-f859278b-e2af-5765-a085-756644211b26.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-407-bridging-the-varlink-gap","url":"https://api.media.ccc.de/public/events/f859278b-e2af-5765-a085-756644211b26","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"1838a8da-6c04-5fea-aedb-d86fbe7561ca","title":"Provisioning and Deployment Mechanisms in systemd","subtitle":null,"slug":"all-systems-go-2026-434-provisioning-and-deployment-mechanisms-in-systemd","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/NLRDPH/","description":"In recent systemd releases we substantially improved the tooling for provisioning and deploying operating systems with systemd. For example, systemd-sysinstall, systemd-sysupdate, credentials, systemd-firstboot, systemd-stub's parameterization logic, systemd-confext, systemd-imds, systemd-import all are relevant components for getting a node up and running with the right configuration, securely and robustly.\n\nIn this talk I'd like to explain the current landscape, and how the various components matter in various scenarios, and how they fit together. I'll also discuss what's next, what's missing, and where we should be going with all this.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Lennart Poettering"],"view_count":339,"promoted":false,"date":"2026-09-30T09:30:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T22:00:08.617+02:00","tags":["434","2026","asg2026","Loft","asg2026-eng","asg2026","Day 1"],"length":2480,"duration":2480,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/434-1838a8da-6c04-5fea-aedb-d86fbe7561ca.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/434-1838a8da-6c04-5fea-aedb-d86fbe7561ca_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/434-1838a8da-6c04-5fea-aedb-d86fbe7561ca.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/434-1838a8da-6c04-5fea-aedb-d86fbe7561ca.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-434-provisioning-and-deployment-mechanisms-in-systemd","url":"https://api.media.ccc.de/public/events/1838a8da-6c04-5fea-aedb-d86fbe7561ca","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"23d6c6b3-8a6b-5a07-8531-d9bab98c051b","title":"attezt: device attestation, PKCS11 and ACME","subtitle":null,"slug":"all-systems-go-2026-414-attezt-device-attestation-pkcs11-and-acme","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/8XRBTA/","description":"IETF is standardizing a new ACME challenge, `device-attest-01`, which allows organizations to provision device bound certificates to machines, and enables machines to present signing certificates that can't be extracted out of machines they where intended for. This is useful for cases where you want to provide reverse proxies with mTLS with a strong sense of device identity.\n\nattezt is intended to be a suite of tools to work the new `device-attest-01` ACME challenges for Linux. It provides an ACME client, an attestation server with (simple) support for inventory systems and a PKCS11 agent which together enables the support of this ACME challenge on Linux.\n\nThis talk will give an introduction to the new ACME challenge, a quick rundown of how an attestation server works and how attezt works.\n\nhttps://datatracker.ietf.org/doc/draft-ietf-acme-device-attest/\nhttps://github.com/Foxboron/attezt\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Morten Linderud"],"view_count":636,"promoted":false,"date":"2026-09-30T10:15:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T17:45:05.814+02:00","tags":["414","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1427,"duration":1427,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/414-23d6c6b3-8a6b-5a07-8531-d9bab98c051b.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-414-attezt-device-attestation-pkcs11-and-acme","url":"https://api.media.ccc.de/public/events/23d6c6b3-8a6b-5a07-8531-d9bab98c051b","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]},{"guid":"979df6f7-685d-5c80-9a2d-0370c9c6c180","title":"ParticleOS in action","subtitle":null,"slug":"all-systems-go-2026-445-particleos-in-action","link":"https://cfp.all-systems-go.io/all-systems-go-2026/talk/L3KZRV/","description":"At Axis, we are always interested in standard technologies and how we can align with them. With that in mind, we have been studying the principles and ideas behind ParticleOS. In this session, we will build ParticleOS live with mkosi and boot it in a VM. We will look into the provisioning steps of such a machine and the changes in the OS image layout.\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/de/","original_language":"eng","persons":["Umut Tezduyar Lindskog"],"view_count":131,"promoted":false,"date":"2026-09-30T10:45:00.000+02:00","release_date":"2026-09-30T00:00:00.000+02:00","updated_at":"2026-10-20T22:45:09.060+02:00","tags":["445","2026","asg2026","Galerie","asg2026-eng","asg2026","Day 1"],"length":1373,"duration":1373,"thumb_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/445-979df6f7-685d-5c80-9a2d-0370c9c6c180.jpg","poster_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/445-979df6f7-685d-5c80-9a2d-0370c9c6c180_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/445-979df6f7-685d-5c80-9a2d-0370c9c6c180.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/all_systems_go/2026/445-979df6f7-685d-5c80-9a2d-0370c9c6c180.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/all-systems-go-2026-445-particleos-in-action","url":"https://api.media.ccc.de/public/events/979df6f7-685d-5c80-9a2d-0370c9c6c180","conference_title":"All Systems Go! 2026","conference_url":"https://api.media.ccc.de/public/conferences/asg2026","related":[]}]}