systemd-run tips — authorized transient-unit literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run systemd-run on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any privileged --uid / --system write — never launch production-impacting transient units without change control.
3. Record short factual notes; quote short Evidence (unit name, type service/scope, exit status — never Environment= secrets).
4. Optional: persistent peer → systemctl-service-tips.
5. Optional: user-switch peer → runuser-tips.
6. Prefer disposable lab commands for systemd-run drills; quote systemctl status / journalctl -u afterward as Evidence.
7. Prefer --user / short-lived scopes for most Evidence binders unless the syllabus asks for system units.
8. Stop at literacy — no attack or unauthorized privilege-escalation cookbooks.

Allowed framing

• Classroom labs reviewing systemd-run / --scope / --user on authorized disposable hosts.
• Binding short factual notes as Evidence (unit name/type/exit — no secrets).
• Documenting expected vs observed transient unit state for authorized inventory notes.
• Comparing systemd-run ↔ systemctl / machinectl / runuser peer tip pages under one binder.
• Testing privileged --uid / resource limits only when the syllabus authorizes that drill on lab hosts.

Scope we will not cover

• No crack/pirate/keygen via systemd-run.
• No intentional unauthorized transient-unit launches against foreign hosts.
• No secret-theft or credential injection against hosts you do not own.
• No cookbooks that weaken polkit / sandboxing or plant backdoor transient units without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host.
2. Prefer a throwaway lab unit name / short command before any privileged drill.
3. With authorization, run systemd-run --user --unit=lab-echo.service /bin/echo ok (or syllabus peer); quote non-secret unit name/exit as Evidence.
4. Optional: persistent peer with systemctl-service-tips; machine peer with machinectl-tips.
5. Stop at literacy — no attack or unauthorized transient-unit cookbooks.

Practical notes for authorized labs

• systemd-run creates transient units — keep Evidence labels distinct from drop-in edits in systemctl-edit-tips.
• Environment= / LoadCredential= may embed secrets — never paste them into notes or git.
• Pair with journalctl-logs-tips for unit journal Evidence after a run.
• Prefer documenting unit property names the syllabus authorized without dumping full show output with secrets.
• Never commit transient unit dumps with secrets to git — even for labs.
• Label lab-only transient units clearly so they are not mistaken for production posture.

FAQ-aligned refusals (quick)

• Foreign-host transient-unit launch → refuse.
• Unauthorized sandbox-weaken / backdoor-unit cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources