docs/ENVIRONMENT.md

   1 ---
   2 title: Known Environment Variables
   3 category: Interfaces
   4 layout: default
   5 SPDX-License-Identifier: LGPL-2.1-or-later
   6 ---
   7
   8 # Known Environment Variables
   9
  10 A number of systemd components take additional runtime parameters via
  11 environment variables. Many of these environment variables are not supported at
  12 the same level as command line switches and other interfaces are: we don't
  13 document them in the man pages and we make no stability guarantees for
  14 them. While they generally are unlikely to be dropped any time soon again, we
  15 do not want to guarantee that they stay around for good either.
  16
  17 Below is an (incomprehensive) list of the environment variables understood by
  18 the various tools. Note that this list only covers environment variables not
  19 documented in the proper man pages.
  20
  21 All tools:
  22
  23 * `$SYSTEMD_OFFLINE=[0|1]` — if set to `1`, then `systemctl` will refrain from
  24   talking to PID 1; this has the same effect as the historical detection of
  25   `chroot()`. Setting this variable to `0` instead has a similar effect as
  26   `$SYSTEMD_IGNORE_CHROOT=1`; i.e. tools will try to communicate with PID 1
  27   even if a `chroot()` environment is detected. You almost certainly want to
  28   set this to `1` if you maintain a package build system or similar and are
  29   trying to use a modern container system and not plain `chroot()`.
  30
  31 * `$SYSTEMD_IGNORE_CHROOT=1` — if set, don't check whether being invoked in a
  32   `chroot()` environment. This is particularly relevant for systemctl, as it
  33   will not alter its behaviour for `chroot()` environments if set. Normally it
  34   refrains from talking to PID 1 in such a case; turning most operations such
  35   as `start` into no-ops.  If that's what's explicitly desired, you might
  36   consider setting `$SYSTEMD_OFFLINE=1`.
  37
  38 * `$SD_EVENT_PROFILE_DELAYS=1` — if set, the sd-event event loop implementation
  39   will print latency information at runtime.
  40
  41 * `$SYSTEMD_PROC_CMDLINE` — if set, the contents are used as the kernel command
  42   line instead of the actual one in `/proc/cmdline`. This is useful for
  43   debugging, in order to test generators and other code against specific kernel
  44   command lines.
  45
  46 * `$SYSTEMD_OS_RELEASE` — if set, use this path instead of `/etc/os-release` or
  47   `/usr/lib/os-release`. When operating under some root (e.g. `systemctl
  48   --root=…`), the path is taken relative to the outside root. Only useful for
  49   debugging.
  50
  51 * `$SYSTEMD_FSTAB` — if set, use this path instead of `/etc/fstab`. Only useful
  52   for debugging.
  53
  54 * `$SYSTEMD_SYSROOT_FSTAB` — if set, use this path instead of
  55   `/sysroot/etc/fstab`. Only useful for debugging `systemd-fstab-generator`.
  56
  57 * `$SYSTEMD_CRYPTTAB` — if set, use this path instead of `/etc/crypttab`. Only
  58   useful for debugging. Currently only supported by
  59   `systemd-cryptsetup-generator`.
  60
  61 * `$SYSTEMD_INTEGRITYTAB` — if set, use this path instead of
  62   `/etc/integritytab`. Only useful for debugging. Currently only supported by
  63   `systemd-integritysetup-generator`.
  64
  65 * `$SYSTEMD_VERITYTAB` — if set, use this path instead of
  66   `/etc/veritytab`. Only useful for debugging. Currently only supported by
  67   `systemd-veritysetup-generator`.
  68
  69 * `$SYSTEMD_EFI_OPTIONS` — if set, used instead of the string in the
  70   `SystemdOptions` EFI variable. Analogous to `$SYSTEMD_PROC_CMDLINE`.
  71
  72 * `$SYSTEMD_DEFAULT_HOSTNAME` — override the compiled-in fallback hostname
  73   (relevant in particular for the system manager and `systemd-hostnamed`).
  74   Must be a valid hostname (either a single label or a FQDN).
  75
  76 * `$SYSTEMD_IN_INITRD` — takes a boolean. If set, overrides initrd detection.
  77   This is useful for debugging and testing initrd-only programs in the main
  78   system.
  79
  80 * `$SYSTEMD_BUS_TIMEOUT=SECS` — specifies the maximum time to wait for method call
  81   completion. If no time unit is specified, assumes seconds. The usual other units
  82   are understood, too (us, ms, s, min, h, d, w, month, y). If it is not set or set
  83   to 0, then the built-in default is used.
  84
  85 * `$SYSTEMD_MEMPOOL=0` — if set, the internal memory caching logic employed by
  86   hash tables is turned off, and libc `malloc()` is used for all allocations.
  87
  88 * `$SYSTEMD_EMOJI=0` — if set, tools such as `systemd-analyze security` will
  89   not output graphical smiley emojis, but ASCII alternatives instead. Note that
  90   this only controls use of Unicode emoji glyphs, and has no effect on other
  91   Unicode glyphs.
  92
  93 * `$RUNTIME_DIRECTORY` — various tools use this variable to locate the
  94   appropriate path under `/run/`. This variable is also set by the manager when
  95   `RuntimeDirectory=` is used, see systemd.exec(5).
  96
  97 * `$SYSTEMD_CRYPT_PREFIX` — if set configures the hash method prefix to use for
  98   UNIX `crypt()` when generating passwords. By default the system's "preferred
  99   method" is used, but this can be overridden with this environment variable.
 100   Takes a prefix such as `$6$` or `$y$`. (Note that this is only honoured on
 101   systems built with libxcrypt and is ignored on systems using glibc's
 102   original, internal `crypt()` implementation.)
 103
 104 * `$SYSTEMD_SECCOMP=0` — if set, seccomp filters will not be enforced, even if
 105   support for it is compiled in and available in the kernel.
 106
 107 * `$SYSTEMD_LOG_SECCOMP=1` — if set, system calls blocked by seccomp filtering,
 108   for example in `systemd-nspawn`, will be logged to the audit log, if the
 109   kernel supports this.
 110
 111 `systemctl`:
 112
 113 * `$SYSTEMCTL_FORCE_BUS=1` — if set, do not connect to PID 1's private D-Bus
 114   listener, and instead always connect through the dbus-daemon D-bus broker.
 115
 116 * `$SYSTEMCTL_INSTALL_CLIENT_SIDE=1` — if set, enable or disable unit files on
 117   the client side, instead of asking PID 1 to do this.
 118
 119 * `$SYSTEMCTL_SKIP_SYSV=1` — if set, do not call SysV compatibility hooks.
 120
 121 `systemd-nspawn`:
 122
 123 * `$SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1` — if set, force `systemd-nspawn` into
 124   unified cgroup hierarchy mode.
 125
 126 * `$SYSTEMD_NSPAWN_API_VFS_WRITABLE=1` — if set, make `/sys/`, `/proc/sys/`,
 127   and friends writable in the container. If set to "network", leave only
 128   `/proc/sys/net/` writable.
 129
 130 * `$SYSTEMD_NSPAWN_CONTAINER_SERVICE=…` — override the "service" name nspawn
 131   uses to register with machined. If unset defaults to "nspawn", but with this
 132   variable may be set to any other value.
 133
 134 * `$SYSTEMD_NSPAWN_USE_CGNS=0` — if set, do not use cgroup namespacing, even if
 135   it is available.
 136
 137 * `$SYSTEMD_NSPAWN_LOCK=0` — if set, do not lock container images when running.
 138
 139 * `$SYSTEMD_NSPAWN_TMPFS_TMP=0` — if set, do not overmount `/tmp/` in the
 140   container with a tmpfs, but leave the directory from the image in place.
 141
 142 * `$SYSTEMD_SUPPRESS_SYNC=1` — if set, all disk synchronization syscalls are
 143   blocked to the container payload (e.g. `sync()`, `fsync()`, `syncfs()`, …)
 144   and the `O_SYNC`/`O_DSYNC` flags are made unavailable to `open()` and
 145   friends. This is equivalent to passing `--suppress-sync=yes` on the
 146   `systemd-nspawn` command line.
 147
 148 `systemd-logind`:
 149
 150 * `$SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1` — if set, report that
 151   hibernation is available even if the swap devices do not provide enough room
 152   for it.
 153
 154 * `$SYSTEMD_REBOOT_TO_FIRMWARE_SETUP` — if set, overrides `systemd-logind`'s
 155   built-in EFI logic of requesting a reboot into the firmware. Takes a boolean.
 156   If set to false, the functionality is turned off entirely. If set to true,
 157   instead of requesting a reboot into the firmware setup UI through EFI a file,
 158   `/run/systemd/reboot-to-firmware-setup` is created whenever this is
 159   requested. This file may be checked for by services run during system
 160   shutdown in order to request the appropriate operation from the firmware in
 161   an alternative fashion.
 162
 163 * `$SYSTEMD_REBOOT_TO_BOOT_LOADER_MENU` — similar to the above, allows
 164   overriding of `systemd-logind`'s built-in EFI logic of requesting a reboot
 165   into the boot loader menu. Takes a boolean. If set to false, the
 166   functionality is turned off entirely. If set to true, instead of requesting a
 167   reboot into the boot loader menu through EFI, the file
 168   `/run/systemd/reboot-to-boot-loader-menu` is created whenever this is
 169   requested. The file contains the requested boot loader menu timeout in µs,
 170   formatted in ASCII decimals, or zero in case no timeout is requested. This
 171   file may be checked for by services run during system shutdown in order to
 172   request the appropriate operation from the boot loader in an alternative
 173   fashion.
 174
 175 * `$SYSTEMD_REBOOT_TO_BOOT_LOADER_ENTRY` — similar to the above, allows
 176   overriding of `systemd-logind`'s built-in EFI logic of requesting a reboot
 177   into a specific boot loader entry. Takes a boolean. If set to false, the
 178   functionality is turned off entirely. If set to true, instead of requesting a
 179   reboot into a specific boot loader entry through EFI, the file
 180   `/run/systemd/reboot-to-boot-loader-entry` is created whenever this is
 181   requested. The file contains the requested boot loader entry identifier. This
 182   file may be checked for by services run during system shutdown in order to
 183   request the appropriate operation from the boot loader in an alternative
 184   fashion. Note that by default only boot loader entries which follow the
 185   [Boot Loader Specification](BOOT_LOADER_SPECIFICATION.md) and are
 186   placed in the ESP or the Extended Boot Loader partition may be selected this
 187   way. However, if a directory `/run/boot-loader-entries/` exists, the entries
 188   are loaded from there instead. The directory should contain the usual
 189   directory hierarchy mandated by the Boot Loader Specification, i.e. the entry
 190   drop-ins should be placed in
 191   `/run/boot-loader-entries/loader/entries/*.conf`, and the files referenced by
 192   the drop-ins (including the kernels and initrds) somewhere else below
 193   `/run/boot-loader-entries/`. Note that all these files may be (and are
 194   supposed to be) symlinks. `systemd-logind` will load these files on-demand,
 195   these files can hence be updated (ideally atomically) whenever the boot
 196   loader configuration changes. A foreign boot loader installer script should
 197   hence synthesize drop-in snippets and symlinks for all boot entries at boot
 198   or whenever they change if it wants to integrate with `systemd-logind`'s
 199   APIs.
 200
 201 `systemd-udevd` and sd-device library:
 202
 203 * `$NET_NAMING_SCHEME=` — if set, takes a network naming scheme (i.e. one of
 204   "v238", "v239", "v240"…, or the special value "latest") as parameter. If
 205   specified udev's `net_id` builtin will follow the specified naming scheme
 206   when determining stable network interface names. This may be used to revert
 207   to naming schemes of older udev versions, in order to provide more stable
 208   naming across updates. This environment variable takes precedence over the
 209   kernel command line option `net.naming-scheme=`, except if the value is
 210   prefixed with `:` in which case the kernel command line option takes
 211   precedence, if it is specified as well.
 212
 213 * `$SYSTEMD_DEVICE_VERIFY_SYSFS` — if set to "0", disables verification that
 214   devices sysfs path are actually backed by sysfs. Relaxing this verification
 215   is useful for testing purposes.
 216
 217 `nss-systemd`:
 218
 219 * `$SYSTEMD_NSS_BYPASS_SYNTHETIC=1` — if set, `nss-systemd` won't synthesize
 220   user/group records for the `root` and `nobody` users if they are missing from
 221   `/etc/passwd`.
 222
 223 * `$SYSTEMD_NSS_DYNAMIC_BYPASS=1` — if set, `nss-systemd` won't return
 224   user/group records for dynamically registered service users (i.e. users
 225   registered through `DynamicUser=1`).
 226
 227 `systemd-timedated`:
 228
 229 * `$SYSTEMD_TIMEDATED_NTP_SERVICES=…` — colon-separated list of unit names of
 230   NTP client services. If set, `timedatectl set-ntp on` enables and starts the
 231   first existing unit listed in the environment variable, and
 232   `timedatectl set-ntp off` disables and stops all listed units.
 233
 234 `systemd-sulogin-shell`:
 235
 236 * `$SYSTEMD_SULOGIN_FORCE=1` — This skips asking for the root password if the
 237   root password is not available (such as when the root account is locked).
 238   See `sulogin(8)` for more details.
 239
 240 `bootctl` and other tools that access the EFI System Partition (ESP):
 241
 242 * `$SYSTEMD_RELAX_ESP_CHECKS=1` — if set, the ESP validation checks are
 243   relaxed. Specifically, validation checks that ensure the specified ESP path
 244   is a FAT file system are turned off, as are checks that the path is located
 245   on a GPT partition with the correct type UUID.
 246
 247 * `$SYSTEMD_ESP_PATH=…` — override the path to the EFI System Partition. This
 248   may be used to override ESP path auto detection, and redirect any accesses to
 249   the ESP to the specified directory. Note that unlike with `bootctl`'s
 250   `--path=` switch only very superficial validation of the specified path is
 251   done when this environment variable is used.
 252
 253 `systemd` itself:
 254
 255 * `$SYSTEMD_ACTIVATION_UNIT` — set for all NSS and PAM module invocations that
 256   are done by the service manager on behalf of a specific unit, in child
 257   processes that are later (after execve()) going to become unit
 258   processes. Contains the full unit name (e.g. "foobar.service"). NSS and PAM
 259   modules can use this information to determine in which context and on whose
 260   behalf they are being called, which may be useful to avoid deadlocks, for
 261   example to bypass IPC calls to the very service that is about to be
 262   started. Note that NSS and PAM modules should be careful to only rely on this
 263   data when invoked privileged, or possibly only when getppid() returns 1, as
 264   setting environment variables is of course possible in any even unprivileged
 265   contexts.
 266
 267 * `$SYSTEMD_ACTIVATION_SCOPE` — closely related to `$SYSTEMD_ACTIVATION_UNIT`,
 268   it is either set to `system` or `user` depending on whether the NSS/PAM
 269   module is called by systemd in `--system` or `--user` mode.
 270
 271 `systemd-remount-fs`:
 272
 273 * `$SYSTEMD_REMOUNT_ROOT_RW=1` — if set and no entry for the root directory
 274   exists in `/etc/fstab` (this file always takes precedence), then the root
 275   directory is remounted writable. This is primarily used by
 276   `systemd-gpt-auto-generator` to ensure the root partition is mounted writable
 277   in accordance to the GPT partition flags.
 278
 279 `systemd-firstboot` and `localectl`:
 280
 281 * `$SYSTEMD_LIST_NON_UTF8_LOCALES=1` — if set, non-UTF-8 locales are listed among
 282   the installed ones. By default non-UTF-8 locales are suppressed from the
 283   selection, since we are living in the 21st century.
 284
 285 `systemd-resolved`:
 286
 287 * `$SYSTEMD_RESOLVED_SYNTHESIZE_HOSTNAME` — if set to "0", `systemd-resolved`
 288   won't synthesize system hostname on both regular and reverse lookups.
 289
 290 `systemd-sysext`:
 291
 292 * `$SYSTEMD_SYSEXT_HIERARCHIES` — this variable may be used to override which
 293   hierarchies are managed by `systemd-sysext`. By default only `/usr/` and
 294   `/opt/` are managed, and directories may be added or removed to that list by
 295   setting this environment variable to a colon-separated list of absolute
 296   paths. Only "real" file systems and directories that only contain "real" file
 297   systems as submounts should be used. Do not specify API file systems such as
 298   `/proc/` or `/sys/` here, or hierarchies that have them as submounts. In
 299   particular, do not specify the root directory `/` here.
 300
 301 `systemd-tmpfiles`:
 302
 303 * `$SYSTEMD_TMPFILES_FORCE_SUBVOL` — if unset, `v`/`q`/`Q` lines will create
 304   subvolumes only if the OS itself is installed into a subvolume. If set to `1`
 305   (or another value interpreted as true), these lines will always create
 306   subvolumes if the backing filesystem supports them. If set to `0`, these
 307   lines will always create directories.
 308
 309 `systemd-sysusers`
 310
 311 * `SOURCE_DATE_EPOCH` — if unset, the field of the date of last password change
 312   in `/etc/shadow` will be the number of days from Jan 1, 1970 00:00 UTC until
 313   today. If SOURCE_DATE_EPOCH is set to a valid UNIX epoch value in seconds,
 314   then the field will be the number of days until that time instead. This is to
 315   support creating bit-by-bit reproducible system images by choosing a
 316   reproducible value for the field of the date of last password change in
 317   `/etc/shadow`. See: https://reproducible-builds.org/specs/source-date-epoch/
 318
 319 `systemd-sysv-generator`:
 320
 321 * `$SYSTEMD_SYSVINIT_PATH` — Controls where `systemd-sysv-generator` looks for
 322   SysV init scripts.
 323
 324 * `$SYSTEMD_SYSVRCND_PATH` — Controls where `systemd-sysv-generator` looks for
 325   SysV init script runlevel link farms.
 326
 327 systemd tests:
 328
 329 * `$SYSTEMD_TEST_DATA` — override the location of test data. This is useful if
 330   a test executable is moved to an arbitrary location.
 331
 332 * `$SYSTEMD_TEST_NSS_BUFSIZE` — size of scratch buffers for "reentrant"
 333   functions exported by the nss modules.
 334
 335 fuzzers:
 336
 337 * `$SYSTEMD_FUZZ_OUTPUT` — A boolean that specifies whether to write output to
 338   stdout. Setting to true is useful in manual invocations, since all output is
 339   suppressed by default.
 340
 341 * `$SYSTEMD_FUZZ_RUNS` — The number of times execution should be repeated in
 342   manual invocations.
 343
 344 Note that it may be also useful to set `$SYSTEMD_LOG_LEVEL`, since all logging
 345 is suppressed by default.
 346
 347 `systemd-importd`:
 348
 349 * `$SYSTEMD_IMPORT_BTRFS_SUBVOL` — takes a boolean, which controls whether to
 350   prefer creating btrfs subvolumes over plain directories for machine
 351   images. Has no effect on non-btrfs file systems where subvolumes are not
 352   available anyway. If not set, defaults to true.
 353
 354 * `$SYSTEMD_IMPORT_BTRFS_QUOTA` — takes a boolean, which controls whether to set
 355   up quota automatically for created btrfs subvolumes for machine images. If
 356   not set, defaults to true. Has no effect if machines are placed in regular
 357   directories, because btrfs subvolumes are not supported or disabled. If
 358   enabled, the quota group of the subvolume is automatically added to a
 359   combined quota group for all such machine subvolumes.
 360
 361 * `$SYSTEMD_IMPORT_SYNC` — takes a boolean, which controls whether to
 362   synchronize images to disk after installing them, before completing the
 363   operation. If not set, defaults to true. If disabled installation of images
 364   will be quicker, but not as safe.
 365
 366 `systemd-dissect`, `systemd-nspawn` and all other tools that may operate on
 367 disk images with `--image=` or similar:
 368
 369 * `$SYSTEMD_DISSECT_VERITY_SIDECAR` — takes a boolean, which controls whether to
 370   load "sidecar" Verity metadata files. If enabled (which is the default),
 371   whenever a disk image is used, a set of files with the `.roothash`,
 372   `.usrhash`, `.roothash.p7s`, `.usrhash.p7s`, `.verity` suffixes are searched
 373   adjacent to disk image file, containing the Verity root hashes, their
 374   signatures or the Verity data itself. If disabled this automatic discovery of
 375   Verity metadata files is turned off.
 376
 377 * `$SYSTEMD_DISSECT_VERITY_EMBEDDED` — takes a boolean, which controls whether
 378   to load the embedded Verity signature data. If enabled (which is the
 379   default), Verity root hash information and a suitable signature is
 380   automatically acquired from a signature partition, following the
 381   [Discoverable Partitions Specification](DISCOVERABLE_PARTITIONS.md).
 382   If disabled any such partition is ignored. Note that this only disables
 383   discovery of the root hash and its signature, the Verity data partition
 384   itself is still searched in the GPT image.
 385
 386 * `$SYSTEMD_DISSECT_VERITY_SIGNATURE` — takes a boolean, which controls whether
 387   to validate the signature of the Verity root hash if available. If enabled
 388   (which is the default), the signature of suitable disk images is validated
 389   against any of the certificates in `/etc/verity.d/*.crt` (and similar
 390   directories in `/usr/lib/`, `/run`, …) or passed to the kernel for validation
 391   against its built-in certificates.
 392
 393 * `$SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC=sec` — takes a timespan, which controls
 394   the timeout waiting for the image to be configured. Defaults to 100 msec.
 395
 396 * `$SYSTEMD_LOOP_DIRECT_IO` – takes a boolean, which controls whether to enable
 397   LO_FLAGS_DIRECT_IO (i.e. direct IO + asynchronous IO) on loopback block
 398   devices when opening them. Defaults to on, set this to "0" to disable this
 399   feature.
 400
 401 `systemd-cryptsetup`:
 402
 403 * `$SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE` – takes a boolean, which controls
 404   whether to use the libcryptsetup "token" plugin module logic even when
 405   activating via FIDO2, PKCS#11, TPM2, i.e. mechanisms natively supported by
 406   `systemd-cryptsetup`. Defaults to enabled.
 407
 408 Various tools that read passwords from the TTY, such as `systemd-cryptenroll`
 409 and `homectl`:
 410
 411 * `$PASSWORD` — takes a string: the literal password to use. If this
 412   environment variable is set it is used as password instead of prompting the
 413   user interactively. This exists primarily for debugging and testing
 414   purposes. Do not use this for production code paths, since environment
 415   variables are typically inherited down the process tree without restrictions
 416   and should thus not be used for secrets.
 417
 418 * `$NEWPASSWORD` — similar to `$PASSWORD` above, but is used when both a
 419   current and a future password are required, for example if the password is to
 420   be changed. In that case `$PASSWORD` shall carry the current (i.e. old)
 421   password and `$NEWPASSWORD` the new.
 422
 423 `systemd-homed`:
 424
 425 * `$SYSTEMD_HOME_ROOT` – defines an absolute path where to look for home
 426   directories/images. When unspecified defaults to `/home/`. This is useful for
 427   debugging purposes in order to run a secondary `systemd-homed` instance that
 428   operates on a different directory where home directories/images are placed.
 429
 430 * `$SYSTEMD_HOME_RECORD_DIR` – defines an absolute path where to look for
 431   fixated home records kept on the host. When unspecified defaults to
 432   `/var/lib/systemd/home/`. Similar to `$SYSTEMD_HOME_ROOT` this is useful for
 433   debugging purposes, in order to run a secondary `systemd-homed` instance that
 434   operates on a record database entirely separate from the host's.
 435
 436 * `$SYSTEMD_HOME_DEBUG_SUFFIX` – takes a short string that is suffixed to
 437   `systemd-homed`'s D-Bus and Varlink service names/sockets. This is also
 438   understood by `homectl`. This too is useful for running an additional copy of
 439   `systemd-homed` that doesn't interfere with the host's main one.
 440
 441 * `$SYSTEMD_HOMEWORK_PATH` – configures the path to the `systemd-homework`
 442   binary to invoke. If not specified defaults to
 443   `/usr/lib/systemd/systemd-homework`.
 444
 445   Combining these four environment variables is pretty useful when
 446   debugging/developing `systemd-homed`:
 447 ```sh
 448 SYSTEMD_HOME_DEBUG_SUFFIX=foo \
 449       SYSTEMD_HOMEWORK_PATH=/home/lennart/projects/systemd/build/systemd-homework \
 450       SYSTEMD_HOME_ROOT=/home.foo/ \
 451       SYSTEMD_HOME_RECORD_DIR=/var/lib/systemd/home.foo/ \
 452       /home/lennart/projects/systemd/build/systemd-homed
 453 ```
 454
 455 * `$SYSTEMD_HOME_MOUNT_OPTIONS_BTRFS`, `$SYSTEMD_HOME_MOUNT_OPTIONS_EXT4`,
 456   `$SYSTEMD_HOME_MOUNT_OPTIONS_XFS` – configure the default mount options to
 457   use for LUKS home directories, overriding the built-in default mount
 458   options. There's one variable for each of the supported file systems for the
 459   LUKS home directory backend.
 460
 461 `kernel-install`:
 462
 463 * `$KERNEL_INSTALL_BYPASS` – If set to "1", execution of kernel-install is skipped
 464   when kernel-install is invoked. This can be useful if kernel-install is invoked
 465   unconditionally as a child process by another tool, such as package managers
 466   running kernel-install in a postinstall script.
 467
 468 `systemd-journald`:
 469
 470 * `$SYSTEMD_JOURNAL_COMPACT` - Takes a boolean. If enabled, journal files are written
 471   in a more compact format that reduces the amount of disk space required by the
 472   journal. Note that journal files in compact mode are limited to 4G to allow use of
 473   32-bit offsets. Enabled by default.