Systemd v262 RC2 Lands With Zero-Downtime Kernel Updates and a Massive Varlink Push
The second release candidate for systemd v262 is now available for testing, and it brings one of the most ambitious stable release packages in the project's history. If you manage Linux services at scale, you'll want to read through the kexec handover changes before the final tag lands.
This release follows v261, which shipped back on June 19. We're looking at roughly 2,000 commits merged to main over the past 17 weeks, with another 167 landing just between rc1 and rc2. The final v262 tag is tracking for mid-to-late September. Distribution maintainers should start compiling now. Leave a comfortable buffer before touching production machines.
Live Updates and Confidential Computing
The headline feature is first-class support for Linux kernel Live Update Orchestration, also called KHO. Systemd now passes service file descriptor stores straight through kexec reboots. That means zero-downtime kernel updates without tearing down running services. User sessions can persist state across those reboots too, controlled by a new FileDescriptorStorePreserve=yes flag. It's a foundational change for cloud and telecom infra where every second of downtime costs money.
systemd-vmspawn gained a --coco= switch that supports both AMD SEV-SNP and Intel TDX. You can seal credentials into the initrd via /.extra/system_credentials/ and have them covered by the launch measurement. It's not exactly plug-and-play, but it's exactly what confidential computing environments needed.
systemd-imdsd rounds out the hardware security story. The new service exposes cloud provider metadata through a local Varlink API and recognizes ten providers out of the box. I spent some time poking at the socket during the rc1 days, and the latency between local Varlink calls and the final credential merge is negligible. You won't notice it booting. The client tool imports those fields as local system credentials, and networking to the cloud IMDS can be locked down per provider if you don't want instances phoning home during early boot.
The Varlink Ecosystem Goes Mainstream
Varlink has quietly become the primary IPC mechanism across almost every systemd component. New interfaces landed for PID 1, units, jobs, network, resolved, repart, hostnamed, and even coredumps. If your automation still leans on D-Bus, you'll want to start porting to Varlink soon. The legacy bus protocol is being phased out deliberately.
There are also some practical additions worth knowing about. systemctl kexec --kernel-cmdline-reuse appends the current kernel command line to the new one. run0 finally gets sudo-compatible timestamp flags like -k and -K. And journalctl -F/--field now actually errors out if you try to combine filters instead of silently ignoring them. Small wins, but they add up.
sd-event now natively supports CPU and IO pressure events alongside memory pressure. That matters if you're building watchdog-style daemons that need to react to host resource contention. Packaging tools should also scan ELF notes for SD_ELF_NOTE_DLOPEN_ANCHORED instead of reading soname lists, since direct shared library linking has been replaced by dlopen.
Cloud Native Tooling and Breaking Changes
A brand new systemd-sysinstall component wraps systemd-repart, bootctl, and credential handling into a minimal, text-based OS installer. Think of it as a modern replacement for heavy anaconda or Calamares setups in container images. Alongside that, systemd-sysext and systemd-confext can finally merge from the initrd, solving a long-standing boot order limitation that frustrated extension users for years.
Not everything is forward-looking, though. The rate-limit clock is switching from CLOCK_MONOTONIC to CLOCK_BOOTTIME. After an upgrade or suspend/resume cycle, serialized rate limits will expire faster. Distribution maintainers usually start screaming around rc2. The rate-limit change is exactly the kind of subtle behavior shift that causes production incidents weeks later. If your server spends a lot of time in standby, expect service restarts to trip sooner than you'd like.
The tpm2-measure-bank= crypttab option is deprecated, and the legacy systemd-sysupdated D-Bus API is gone. Migration paths exist, but they're not entirely painless. The systemd-sysupdate-update.service and timer units now carry a -update. suffix. Old names will vanish in v263. Varlink JSON format changes in systemd-sysext and systemd-sysupdate also shift some response keys. Keep that in mind if you're parsing output.
What Comes Next
systemd v262 RC2 is shaping up to be one of the most substantial stable releases the project has shipped. The final tag should drop in roughly two weeks. Distribution teams should focus testing on the rate-limit clock change, the Varlink JSON format shifts, and the new kexec FD store preservation.
Head here to grab the release candidate.
