Topic

systemd

1 post about systemd. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Red Hat
Self-encrypting VM images for confidential environments hands on
Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect runtime data but leave persistent storage protection to the guest OS. This article demonstrates a method using Fedora Rawhide that combines dm-verity integrity for the immutable base image with a dm-crypt encrypted overlay for mutable parts. The base /usr partition remains verity-protected, while on first boot systemd-repart creates an encrypted root partition with a key sealed to the virtual TPM, ensuring each VM gets a unique key. An overlay filesystem mounts the immutable base under the writable overlay, avoiding a full copy of the base image and reducing boot time significantly in cloud environments. The article also outlines current limitations, including the lack of proof of origin for the overlay partition and the absence of integrity or replay attack protection.

The best engineering reads, once a week.

Topic

1 post about systemd. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Red Hat
Self-encrypting VM images for confidential environments hands on
Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect runtime data but leave persistent storage protection to the guest OS. This article demonstrates a method using Fedora Rawhide that combines dm-verity integrity for the immutable base image with a dm-crypt encrypted overlay for mutable parts. The base /usr partition remains verity-protected, while on first boot systemd-repart creates an encrypted root partition with a key sealed to the virtual TPM, ensuring each VM gets a unique key. An overlay filesystem mounts the immutable base under the writable overlay, avoiding a full copy of the base image and reducing boot time significantly in cloud environments. The article also outlines current limitations, including the lack of proof of origin for the overlay partition and the absence of integrity or replay attack protection.

The best engineering reads, once a week.