How Ubuntu Is Using Rust to Rebuild Core System Tools

Summary

Canonical is selectively adopting Rust to rewrite core system utilities across Ubuntu releases to improve memory safety, security, and long-term resilience. Starting in Ubuntu 26.04 LTS, uutils coreutils shipped as the default implementation targeting complete GNU compatibility, alongside sudo-rs, which introduced intentional behavior changes like asterisk display on password entry. Canonical is also funding ntpd-rs to consolidate NTP, NTS, and PTP into a single utility, while collaborating on UPKI to bring certificate revocation to system utilities. To manage Rust packaging at distribution scale, Canonical vendors dependencies per package rather than creating individual Debian packages for crates and embeds software bills of materials into binaries using cargo auditable. Future plans include exploring Rust implementations of compression libraries like bzip2-rs, zlib-rs, and zstd-rs.

Context

Ubuntu powers 15 million deployments across servers, desktops, edge devices, and vehicles, where legacy C utilities carry decades of accumulated bugs. In critical infrastructure, unhandled crashes and memory flaws present severe security and reliability risks.

Approach / What changed

Canonical is executing an incremental Rust migration at LTS release boundaries. It vendors Rust dependencies into single package tarballs, embeds SBOMs using cargo auditable, and replaces core utilities with alternatives like uutils coreutils, sudo-rs, ntpd-rs, and UPKI.

Takeaways

• uutils coreutils prioritizes 100% bug-for-bug GNU compatibility, whereas sudo-rs deliberately redesigns behavior, including displaying asterisks during password entry.
• ntpd-rs is planned to replace chrony and linuxptp by combining NTP, NTS, and PTP into a single memory-safe tool with one configuration file.
• Canonical packages Rust by vendoring crates into tarballs per package and embeds an SBOM in every Rust binary using cargo auditable.

Related reading

• Grab · Jun 20, 2025

  Counter Service: How we rewrote it in Rust

  The Integrity Data Platform team rewrote Counter Service, a high-throughput Golang microservice serving event counts for fraud rules and machine learning models, to evaluate the operational return on investment of Rust. Rather than performing a line-by-line translation, engineers approached the service as a black box, reimplementing core application logic from scratch to satisfy established gRPC contracts across Scylla and Redis. The team resolved internal Go tooling dependencies by building custom configuration template parsers using the nom parser combinator and selected targeted open-source crates such as fred.rs and Cadence. Adapting to Rust required navigating cooperative, stackless async execution compared to Go's preemptive concurrency model, alongside managing borrow checker constraints. Ultimately, the rewrite achieved a 70% reduction in infrastructure costs while maintaining comparable service performance.

  Jia Long Loh

• Cloudflare · Aug 6, 2026

  The next generation of MCP

  Model Context Protocol previously required stateful connections between clients and remote servers, creating operational complexity around sticky sessions, message replay, and open streams. The newly released MCP 2026-07-28 specification transitions MCP to a fully stateless protocol alongside updated SDKs across TypeScript, Python, Go, and C#. The protocol eliminates mandatory handshakes and session identifiers from core request paths while enabling servers to run on request-scoped infrastructure like Cloudflare Workers. Interactive elicitation is restructured through Multi Round-Trip Requests, which allow servers to return input requirements without sustaining persistent connections. Standardized headers for method names and improved OAuth authorization mechanisms further enable standard web infrastructure to inspect and manage MCP traffic efficiently.

  Matt Carey

• Github · Jul 29, 2026

  Tame Dependabot: Group your updates, slow the cadence, keep security fast

  Dependabot often floods repository maintainers with individual daily pull requests for single patch bumps, wasting review and continuous integration resources. Microsoft's GCToolkit project mitigated this issue by updating its dependabot.yml configuration to group dependency updates using wildcard patterns and slowing the schedule interval to monthly. The project also expanded coverage to include Maven alongside GitHub Actions so all relevant package ecosystems receive managed updates. Because Dependabot processes security alerts independently of regular version schedules and enforces a default three-day package cooldown, critical vulnerability fixes remain fast while routine maintenance noise drops significantly.

  Bruno Borges

• Slack · Jul 14, 2026

  Shipyard: How We Built Slack’s Next-Generation EC2 Platform

  Slack developed Shipyard to modernize its EC2 infrastructure by replacing continuously updated, mutable instances with immutable deployable artifacts. The platform adopts a layered image architecture starting with a standardized base image called slack-zero, which is built using AWS Image Builder and consumed by downstream service-specific machine images. Rather than running periodic Chef jobs in the background, configuration management is restricted to image baking and initial instance provisioning phases. Fleet management is handled through the Peekaboo inventory system, metric-driven progressive rollouts via Gondola, and automated instance rotation managed by a lifecycle component known as the Reaper. Developers validate cookbook updates prior to merging using Ship Quick, which provisions real infrastructure across dedicated worker fleets to verify provisioning workflows.

  Archie Gunasekara