---
title: "systemd"
description: "1 posts about systemd, summarised, each linking to the original."
---

# systemd
> 1 posts about systemd, summarised, each linking to the original.

## Articles

### [Self-encrypting VM images for confidential environments hands on](https://yomu.fyi/post/self-encrypting-vm-images-for-confidential-environments-hands-on.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Vitaly Kuznetsov
- Published: Sep 24, 2026
- Type: Tutorial

Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect runtime data but leave persistent storage protection to the guest OS. This article demonstrates a method using Fedora Rawhide that combines dm-verity integrity for the immutable base image with a dm-crypt encrypted overlay for mutable parts. The base /usr partition remains verity-protected, while on first boot systemd-repart creates an encrypted root partition with a key sealed to the virtual TPM, ensuring each VM gets a unique key. An overlay filesystem mounts the immutable base under the writable overlay, avoiding a full copy of the base image and reducing boot time significantly in cloud environments. The article also outlines current limitations, including the lack of proof of origin for the overlay partition and the absence of integrity or replay attack protection.