2 title: Known Environment Variables
5 SPDX-License-Identifier: LGPL-2.1-or-later
8 # Known Environment Variables
10 A number of systemd components take additional runtime parameters via
11 environment variables. Many of these environment variables are not supported at
12 the same level as command line switches and other interfaces are: we don't
13 document them in the man pages and we make no stability guarantees for
14 them. While they generally are unlikely to be dropped any time soon again, we
15 do not want to guarantee that they stay around for good either.
17 Below is an (incomprehensive) list of the environment variables understood by
18 the various tools. Note that this list only covers environment variables not
19 documented in the proper man pages.
23 * `$SYSTEMD_OFFLINE=[0|1]` — if set to `1`, then `systemctl` will refrain from
24 talking to PID 1; this has the same effect as the historical detection of
25 `chroot()`. Setting this variable to `0` instead has a similar effect as
26 `$SYSTEMD_IGNORE_CHROOT=1`; i.e. tools will try to communicate with PID 1
27 even if a `chroot()` environment is detected. You almost certainly want to
28 set this to `1` if you maintain a package build system or similar and are
29 trying to use a modern container system and not plain `chroot()`.
31 * `$SYSTEMD_IGNORE_CHROOT=1` — if set, don't check whether being invoked in a
32 `chroot()` environment. This is particularly relevant for systemctl, as it
33 will not alter its behaviour for `chroot()` environments if set. Normally it
34 refrains from talking to PID 1 in such a case; turning most operations such
35 as `start` into no-ops. If that's what's explicitly desired, you might
36 consider setting `$SYSTEMD_OFFLINE=1`.
38 * `$SYSTEMD_FIRST_BOOT=0|1` — if set, assume "first boot" condition to be false
39 or true, instead of checking the flag file created by PID 1.
41 * `$SD_EVENT_PROFILE_DELAYS=1` — if set, the sd-event event loop implementation
42 will print latency information at runtime.
44 * `$SYSTEMD_PROC_CMDLINE` — if set, the contents are used as the kernel command
45 line instead of the actual one in `/proc/cmdline`. This is useful for
46 debugging, in order to test generators and other code against specific kernel
49 * `$SYSTEMD_OS_RELEASE` — if set, use this path instead of `/etc/os-release` or
50 `/usr/lib/os-release`. When operating under some root (e.g. `systemctl
51 --root=…`), the path is prefixed with the root. Only useful for debugging.
53 * `$SYSTEMD_FSTAB` — if set, use this path instead of `/etc/fstab`. Only useful
56 * `$SYSTEMD_SYSROOT_FSTAB` — if set, use this path instead of
57 `/sysroot/etc/fstab`. Only useful for debugging `systemd-fstab-generator`.
59 * `$SYSTEMD_SYSFS_CHECK` — takes a boolean. If set, overrides sysfs container
60 detection that ignores `/dev/` entries in fstab. Only useful for debugging
61 `systemd-fstab-generator`.
63 * `$SYSTEMD_CRYPTTAB` — if set, use this path instead of `/etc/crypttab`. Only
64 useful for debugging. Currently only supported by
65 `systemd-cryptsetup-generator`.
67 * `$SYSTEMD_INTEGRITYTAB` — if set, use this path instead of
68 `/etc/integritytab`. Only useful for debugging. Currently only supported by
69 `systemd-integritysetup-generator`.
71 * `$SYSTEMD_VERITYTAB` — if set, use this path instead of
72 `/etc/veritytab`. Only useful for debugging. Currently only supported by
73 `systemd-veritysetup-generator`.
75 * `$SYSTEMD_EFI_OPTIONS` — if set, used instead of the string in the
76 `SystemdOptions` EFI variable. Analogous to `$SYSTEMD_PROC_CMDLINE`.
78 * `$SYSTEMD_DEFAULT_HOSTNAME` — override the compiled-in fallback hostname
79 (relevant in particular for the system manager and `systemd-hostnamed`).
80 Must be a valid hostname (either a single label or a FQDN).
82 * `$SYSTEMD_IN_INITRD` — takes a boolean. If set, overrides initrd detection.
83 This is useful for debugging and testing initrd-only programs in the main
86 * `$SYSTEMD_BUS_TIMEOUT=SECS` — specifies the maximum time to wait for method call
87 completion. If no time unit is specified, assumes seconds. The usual other units
88 are understood, too (us, ms, s, min, h, d, w, month, y). If it is not set or set
89 to 0, then the built-in default is used.
91 * `$SYSTEMD_MEMPOOL=0` — if set, the internal memory caching logic employed by
92 hash tables is turned off, and libc `malloc()` is used for all allocations.
94 * `$SYSTEMD_UTF8=` — takes a boolean value, and overrides whether to generate
95 non-ASCII special glyphs at various places (i.e. "→" instead of
96 "->"). Usually this is determined automatically, based on `$LC_CTYPE`, but in
97 scenarios where locale definitions are not installed it might make sense to
98 override this check explicitly.
100 * `$SYSTEMD_EMOJI=0` — if set, tools such as `systemd-analyze security` will
101 not output graphical smiley emojis, but ASCII alternatives instead. Note that
102 this only controls use of Unicode emoji glyphs, and has no effect on other
105 * `$RUNTIME_DIRECTORY` — various tools use this variable to locate the
106 appropriate path under `/run/`. This variable is also set by the manager when
107 `RuntimeDirectory=` is used, see systemd.exec(5).
109 * `$SYSTEMD_CRYPT_PREFIX` — if set configures the hash method prefix to use for
110 UNIX `crypt()` when generating passwords. By default the system's "preferred
111 method" is used, but this can be overridden with this environment variable.
112 Takes a prefix such as `$6$` or `$y$`. (Note that this is only honoured on
113 systems built with libxcrypt and is ignored on systems using glibc's
114 original, internal `crypt()` implementation.)
116 * `$SYSTEMD_SECCOMP=0` — if set, seccomp filters will not be enforced, even if
117 support for it is compiled in and available in the kernel.
119 * `$SYSTEMD_LOG_SECCOMP=1` — if set, system calls blocked by seccomp filtering,
120 for example in `systemd-nspawn`, will be logged to the audit log, if the
121 kernel supports this.
123 * `$SYSTEMD_ENABLE_LOG_CONTEXT` — if set, extra fields will always be logged to
124 the journal instead of only when logging in debug mode.
126 * `$SYSTEMD_NETLINK_DEFAULT_TIMEOUT` — specifies the default timeout of waiting
127 replies for netlink messages from the kernel. Defaults to 25 seconds.
131 * `$SYSTEMCTL_FORCE_BUS=1` — if set, do not connect to PID 1's private D-Bus
132 listener, and instead always connect through the dbus-daemon D-bus broker.
134 * `$SYSTEMCTL_INSTALL_CLIENT_SIDE=1` — if set, enable or disable unit files on
135 the client side, instead of asking PID 1 to do this.
137 * `$SYSTEMCTL_SKIP_SYSV=1` — if set, do not call SysV compatibility hooks.
139 * `$SYSTEMCTL_SKIP_AUTO_KEXEC=1` — if set, do not automatically kexec instead of
140 reboot when a new kernel has been loaded.
142 * `$SYSTEMCTL_SKIP_AUTO_SOFT_REBOOT=1` — if set, do not automatically soft-reboot
143 instead of reboot when a new root file system has been loaded in
148 * `$SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1` — if set, force `systemd-nspawn` into
149 unified cgroup hierarchy mode.
151 * `$SYSTEMD_NSPAWN_API_VFS_WRITABLE=1` — if set, make `/sys/`, `/proc/sys/`,
152 and friends writable in the container. If set to "network", leave only
153 `/proc/sys/net/` writable.
155 * `$SYSTEMD_NSPAWN_CONTAINER_SERVICE=…` — override the "service" name nspawn
156 uses to register with machined. If unset defaults to "nspawn", but with this
157 variable may be set to any other value.
159 * `$SYSTEMD_NSPAWN_USE_CGNS=0` — if set, do not use cgroup namespacing, even if
162 * `$SYSTEMD_NSPAWN_LOCK=0` — if set, do not lock container images when running.
164 * `$SYSTEMD_NSPAWN_TMPFS_TMP=0` — if set, do not overmount `/tmp/` in the
165 container with a tmpfs, but leave the directory from the image in place.
167 * `$SYSTEMD_NSPAWN_CHECK_OS_RELEASE=0` — if set, do not fail when trying to
168 boot an OS tree without an os-release file (useful when trying to boot a
169 container with empty `/etc/` and bind-mounted `/usr/`)
171 * `$SYSTEMD_SUPPRESS_SYNC=1` — if set, all disk synchronization syscalls are
172 blocked to the container payload (e.g. `sync()`, `fsync()`, `syncfs()`, …)
173 and the `O_SYNC`/`O_DSYNC` flags are made unavailable to `open()` and
174 friends. This is equivalent to passing `--suppress-sync=yes` on the
175 `systemd-nspawn` command line.
177 * `$SYSTEMD_NSPAWN_NETWORK_MAC=...` — if set, allows users to set a specific MAC
178 address for a container, ensuring that it uses the provided value instead of
179 generating a random one. It is effective when used with `--network-veth`. The
180 expected format is six groups of two hexadecimal digits separated by colons,
181 e.g. `SYSTEMD_NSPAWN_NETWORK_MAC=12:34:56:78:90:AB`
185 * `$SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1` — if set, report that
186 hibernation is available even if the swap devices do not provide enough room
189 * `$SYSTEMD_REBOOT_TO_FIRMWARE_SETUP` — if set, overrides `systemd-logind`'s
190 built-in EFI logic of requesting a reboot into the firmware. Takes a boolean.
191 If set to false, the functionality is turned off entirely. If set to true,
192 instead of requesting a reboot into the firmware setup UI through EFI a file,
193 `/run/systemd/reboot-to-firmware-setup` is created whenever this is
194 requested. This file may be checked for by services run during system
195 shutdown in order to request the appropriate operation from the firmware in
196 an alternative fashion.
198 * `$SYSTEMD_REBOOT_TO_BOOT_LOADER_MENU` — similar to the above, allows
199 overriding of `systemd-logind`'s built-in EFI logic of requesting a reboot
200 into the boot loader menu. Takes a boolean. If set to false, the
201 functionality is turned off entirely. If set to true, instead of requesting a
202 reboot into the boot loader menu through EFI, the file
203 `/run/systemd/reboot-to-boot-loader-menu` is created whenever this is
204 requested. The file contains the requested boot loader menu timeout in µs,
205 formatted in ASCII decimals, or zero in case no timeout is requested. This
206 file may be checked for by services run during system shutdown in order to
207 request the appropriate operation from the boot loader in an alternative
210 * `$SYSTEMD_REBOOT_TO_BOOT_LOADER_ENTRY` — similar to the above, allows
211 overriding of `systemd-logind`'s built-in EFI logic of requesting a reboot
212 into a specific boot loader entry. Takes a boolean. If set to false, the
213 functionality is turned off entirely. If set to true, instead of requesting a
214 reboot into a specific boot loader entry through EFI, the file
215 `/run/systemd/reboot-to-boot-loader-entry` is created whenever this is
216 requested. The file contains the requested boot loader entry identifier. This
217 file may be checked for by services run during system shutdown in order to
218 request the appropriate operation from the boot loader in an alternative
219 fashion. Note that by default only boot loader entries which follow the
220 [Boot Loader Specification](https://uapi-group.org/specifications/specs/boot_loader_specification)
221 and are placed in the ESP or the Extended Boot Loader partition may be
222 selected this way. However, if a directory `/run/boot-loader-entries/`
223 exists, the entries are loaded from there instead. The directory should
224 contain the usual directory hierarchy mandated by the Boot Loader
225 Specification, i.e. the entry drop-ins should be placed in
226 `/run/boot-loader-entries/loader/entries/*.conf`, and the files referenced by
227 the drop-ins (including the kernels and initrds) somewhere else below
228 `/run/boot-loader-entries/`. Note that all these files may be (and are
229 supposed to be) symlinks. `systemd-logind` will load these files on-demand,
230 these files can hence be updated (ideally atomically) whenever the boot
231 loader configuration changes. A foreign boot loader installer script should
232 hence synthesize drop-in snippets and symlinks for all boot entries at boot
233 or whenever they change if it wants to integrate with `systemd-logind`'s
236 `systemd-udevd` and sd-device library:
238 * `$NET_NAMING_SCHEME=` — if set, takes a network naming scheme (i.e. one of
239 "v238", "v239", "v240"…, or the special value "latest") as parameter. If
240 specified udev's `net_id` builtin will follow the specified naming scheme
241 when determining stable network interface names. This may be used to revert
242 to naming schemes of older udev versions, in order to provide more stable
243 naming across updates. This environment variable takes precedence over the
244 kernel command line option `net.naming-scheme=`, except if the value is
245 prefixed with `:` in which case the kernel command line option takes
246 precedence, if it is specified as well.
248 * `$SYSTEMD_DEVICE_VERIFY_SYSFS` — if set to "0", disables verification that
249 devices sysfs path are actually backed by sysfs. Relaxing this verification
250 is useful for testing purposes.
252 * `$SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC=` — Specifies an extra timespan that the
253 udev manager process waits for a worker process kills slow programs specified
254 by IMPORT{program}=, PROGRAM=, or RUN=, and finalizes the processing event.
255 If the worker process cannot finalize the event within the specified timespan,
256 the worker process is killed by the manager process. Defaults to 10 seconds,
257 maximum allowed is 5 hours.
259 `udevadm` and `systemd-hwdb`:
261 * `SYSTEMD_HWDB_UPDATE_BYPASS=` — If set to "1", execution of hwdb updates is skipped
262 when `udevadm hwdb --update` or `systemd-hwdb update` are invoked. This can
263 be useful if either of these tools are invoked unconditionally as a child
264 process by another tool, such as package managers running either of these
265 tools in a postinstall script.
269 * `$SYSTEMD_NSS_BYPASS_SYNTHETIC=1` — if set, `nss-systemd` won't synthesize
270 user/group records for the `root` and `nobody` users if they are missing from
273 * `$SYSTEMD_NSS_DYNAMIC_BYPASS=1` — if set, `nss-systemd` won't return
274 user/group records for dynamically registered service users (i.e. users
275 registered through `DynamicUser=1`).
279 * `$SYSTEMD_TIMEDATED_NTP_SERVICES=…` — colon-separated list of unit names of
280 NTP client services. If set, `timedatectl set-ntp on` enables and starts the
281 first existing unit listed in the environment variable, and
282 `timedatectl set-ntp off` disables and stops all listed units.
284 `systemd-sulogin-shell`:
286 * `$SYSTEMD_SULOGIN_FORCE=1` — This skips asking for the root password if the
287 root password is not available (such as when the root account is locked).
288 See `sulogin(8)` for more details.
290 `bootctl` and other tools that access the EFI System Partition (ESP):
292 * `$SYSTEMD_RELAX_ESP_CHECKS=1` — if set, the ESP validation checks are
293 relaxed. Specifically, validation checks that ensure the specified ESP path
294 is a FAT file system are turned off, as are checks that the path is located
295 on a GPT partition with the correct type UUID.
297 * `$SYSTEMD_ESP_PATH=…` — override the path to the EFI System Partition. This
298 may be used to override ESP path auto detection, and redirect any accesses to
299 the ESP to the specified directory. Note that unlike with `bootctl`'s
300 `--path=` switch only very superficial validation of the specified path is
301 done when this environment variable is used.
303 * `$KERNEL_INSTALL_CONF_ROOT=…` — override the built in default configuration
304 directory /etc/kernel/ to read files like entry-token and install.conf from.
308 * `$SYSTEMD_ACTIVATION_UNIT` — set for all NSS and PAM module invocations that
309 are done by the service manager on behalf of a specific unit, in child
310 processes that are later (after execve()) going to become unit
311 processes. Contains the full unit name (e.g. "foobar.service"). NSS and PAM
312 modules can use this information to determine in which context and on whose
313 behalf they are being called, which may be useful to avoid deadlocks, for
314 example to bypass IPC calls to the very service that is about to be
315 started. Note that NSS and PAM modules should be careful to only rely on this
316 data when invoked privileged, or possibly only when getppid() returns 1, as
317 setting environment variables is of course possible in any even unprivileged
320 * `$SYSTEMD_ACTIVATION_SCOPE` — closely related to `$SYSTEMD_ACTIVATION_UNIT`,
321 it is either set to `system` or `user` depending on whether the NSS/PAM
322 module is called by systemd in `--system` or `--user` mode.
324 * `$SYSTEMD_SUPPORT_DEVICE`, `$SYSTEMD_SUPPORT_MOUNT`, `$SYSTEMD_SUPPORT_SWAP` -
325 can be set to `0` to mark respective unit type as unsupported. Generally,
326 having less units saves system resources so these options might be useful
327 for cases where we don't need to track given unit type, e.g. `--user` manager
328 often doesn't need to deal with device or swap units because they are
329 handled by the `--system` manager (PID 1). Note that setting certain unit
330 type as unsupported may not prevent loading some units of that type if they
331 are referenced by other units of another supported type.
333 * `$SYSTEMD_DEFAULT_MOUNT_RATE_LIMIT_BURST` — can be set to override the mount
334 units burst rate limit for parsing `/proc/self/mountinfo`. On a system with
335 few resources but many mounts the rate limit may be hit, which will cause the
336 processing of mount units to stall. The burst limit may be adjusted when the
337 default is not appropriate for a given system. Defaults to `5`, accepts
340 `systemd-remount-fs`:
342 * `$SYSTEMD_REMOUNT_ROOT_RW=1` — if set and no entry for the root directory
343 exists in `/etc/fstab` (this file always takes precedence), then the root
344 directory is remounted writable. This is primarily used by
345 `systemd-gpt-auto-generator` to ensure the root partition is mounted writable
346 in accordance to the GPT partition flags.
348 `systemd-firstboot` and `localectl`:
350 * `$SYSTEMD_LIST_NON_UTF8_LOCALES=1` — if set, non-UTF-8 locales are listed among
351 the installed ones. By default non-UTF-8 locales are suppressed from the
352 selection, since we are living in the 21st century.
356 * `$SYSTEMD_RESOLVED_SYNTHESIZE_HOSTNAME` — if set to "0", `systemd-resolved`
357 won't synthesize system hostname on both regular and reverse lookups.
361 * `$SYSTEMD_SYSEXT_HIERARCHIES` — this variable may be used to override which
362 hierarchies are managed by `systemd-sysext`. By default only `/usr/` and
363 `/opt/` are managed, and directories may be added or removed to that list by
364 setting this environment variable to a colon-separated list of absolute
365 paths. Only "real" file systems and directories that only contain "real" file
366 systems as submounts should be used. Do not specify API file systems such as
367 `/proc/` or `/sys/` here, or hierarchies that have them as submounts. In
368 particular, do not specify the root directory `/` here. Similarly,
369 `$SYSTEMD_CONFEXT_HIERARCHIES` works for confext images and supports the
370 systemd-confext multi-call functionality of sysext.
374 * `$SYSTEMD_TMPFILES_FORCE_SUBVOL` — if unset, `v`/`q`/`Q` lines will create
375 subvolumes only if the OS itself is installed into a subvolume. If set to `1`
376 (or another value interpreted as true), these lines will always create
377 subvolumes if the backing filesystem supports them. If set to `0`, these
378 lines will always create directories.
382 * `$SOURCE_DATE_EPOCH` — if unset, the field of the date of last password change
383 in `/etc/shadow` will be the number of days from Jan 1, 1970 00:00 UTC until
384 today. If `$SOURCE_DATE_EPOCH` is set to a valid UNIX epoch value in seconds,
385 then the field will be the number of days until that time instead. This is to
386 support creating bit-by-bit reproducible system images by choosing a
387 reproducible value for the field of the date of last password change in
388 `/etc/shadow`. See: https://reproducible-builds.org/specs/source-date-epoch/
390 `systemd-sysv-generator`:
392 * `$SYSTEMD_SYSVINIT_PATH` — Controls where `systemd-sysv-generator` looks for
395 * `$SYSTEMD_SYSVRCND_PATH` — Controls where `systemd-sysv-generator` looks for
396 SysV init script runlevel link farms.
400 * `$SYSTEMD_TEST_DATA` — override the location of test data. This is useful if
401 a test executable is moved to an arbitrary location.
403 * `$SYSTEMD_TEST_NSS_BUFSIZE` — size of scratch buffers for "reentrant"
404 functions exported by the nss modules.
406 * `$TESTFUNCS` – takes a colon separated list of test functions to invoke,
407 causes all non-matching test functions to be skipped. Only applies to tests
408 using our regular test boilerplate.
412 * `$SYSTEMD_FUZZ_OUTPUT` — A boolean that specifies whether to write output to
413 stdout. Setting to true is useful in manual invocations, since all output is
414 suppressed by default.
416 * `$SYSTEMD_FUZZ_RUNS` — The number of times execution should be repeated in
419 Note that it may be also useful to set `$SYSTEMD_LOG_LEVEL`, since all logging
420 is suppressed by default.
424 * `$SYSTEMD_IMPORT_BTRFS_SUBVOL` — takes a boolean, which controls whether to
425 prefer creating btrfs subvolumes over plain directories for machine
426 images. Has no effect on non-btrfs file systems where subvolumes are not
427 available anyway. If not set, defaults to true.
429 * `$SYSTEMD_IMPORT_BTRFS_QUOTA` — takes a boolean, which controls whether to set
430 up quota automatically for created btrfs subvolumes for machine images. If
431 not set, defaults to true. Has no effect if machines are placed in regular
432 directories, because btrfs subvolumes are not supported or disabled. If
433 enabled, the quota group of the subvolume is automatically added to a
434 combined quota group for all such machine subvolumes.
436 * `$SYSTEMD_IMPORT_SYNC` — takes a boolean, which controls whether to
437 synchronize images to disk after installing them, before completing the
438 operation. If not set, defaults to true. If disabled installation of images
439 will be quicker, but not as safe.
441 `systemd-dissect`, `systemd-nspawn` and all other tools that may operate on
442 disk images with `--image=` or similar:
444 * `$SYSTEMD_DISSECT_VERITY_SIDECAR` — takes a boolean, which controls whether to
445 load "sidecar" Verity metadata files. If enabled (which is the default),
446 whenever a disk image is used, a set of files with the `.roothash`,
447 `.usrhash`, `.roothash.p7s`, `.usrhash.p7s`, `.verity` suffixes are searched
448 adjacent to disk image file, containing the Verity root hashes, their
449 signatures or the Verity data itself. If disabled this automatic discovery of
450 Verity metadata files is turned off.
452 * `$SYSTEMD_DISSECT_VERITY_EMBEDDED` — takes a boolean, which controls whether
453 to load the embedded Verity signature data. If enabled (which is the
454 default), Verity root hash information and a suitable signature is
455 automatically acquired from a signature partition, following the
456 [Discoverable Partitions Specification](https://uapi-group.org/specifications/specs/discoverable_partitions_specification).
457 If disabled any such partition is ignored. Note that this only disables
458 discovery of the root hash and its signature, the Verity data partition
459 itself is still searched in the GPT image.
461 * `$SYSTEMD_DISSECT_VERITY_SIGNATURE` — takes a boolean, which controls whether
462 to validate the signature of the Verity root hash if available. If enabled
463 (which is the default), the signature of suitable disk images is validated
464 against any of the certificates in `/etc/verity.d/*.crt` (and similar
465 directories in `/usr/lib/`, `/run`, …) or passed to the kernel for validation
466 against its built-in certificates.
468 * `$SYSTEMD_DISSECT_VERITY_TIMEOUT_SEC=sec` — takes a timespan, which controls
469 the timeout waiting for the image to be configured. Defaults to 100 msec.
471 * `$SYSTEMD_DISSECT_FILE_SYSTEMS=` — takes a colon-separated list of file
472 systems that may be mounted for automatically dissected disk images. If not
473 specified defaults to something like: `ext4:btrfs:xfs:vfat:erofs:squashfs`
475 * `$SYSTEMD_LOOP_DIRECT_IO` – takes a boolean, which controls whether to enable
476 `LO_FLAGS_DIRECT_IO` (i.e. direct IO + asynchronous IO) on loopback block
477 devices when opening them. Defaults to on, set this to "0" to disable this
480 `systemd-cryptsetup`:
482 * `$SYSTEMD_CRYPTSETUP_USE_TOKEN_MODULE` – takes a boolean, which controls
483 whether to use the libcryptsetup "token" plugin module logic even when
484 activating via FIDO2, PKCS#11, TPM2, i.e. mechanisms natively supported by
485 `systemd-cryptsetup`. Defaults to enabled.
487 * `$SYSTEMD_CRYPTSETUP_TOKEN_PATH` – takes a path to a directory in the file
488 system. If specified overrides where libcryptsetup will look for token
489 modules (.so). This is useful for debugging token modules: set this
490 environment variable to the build directory and you are set. This variable
491 is only supported when systemd is compiled in developer mode.
493 Various tools that read passwords from the TTY, such as `systemd-cryptenroll`
496 * `$PASSWORD` — takes a string: the literal password to use. If this
497 environment variable is set it is used as password instead of prompting the
498 user interactively. This exists primarily for debugging and testing
499 purposes. Do not use this for production code paths, since environment
500 variables are typically inherited down the process tree without restrictions
501 and should thus not be used for secrets.
503 * `$NEWPASSWORD` — similar to `$PASSWORD` above, but is used when both a
504 current and a future password are required, for example if the password is to
505 be changed. In that case `$PASSWORD` shall carry the current (i.e. old)
506 password and `$NEWPASSWORD` the new.
510 * `$SYSTEMD_HOME_ROOT` – defines an absolute path where to look for home
511 directories/images. When unspecified defaults to `/home/`. This is useful for
512 debugging purposes in order to run a secondary `systemd-homed` instance that
513 operates on a different directory where home directories/images are placed.
515 * `$SYSTEMD_HOME_RECORD_DIR` – defines an absolute path where to look for
516 fixated home records kept on the host. When unspecified defaults to
517 `/var/lib/systemd/home/`. Similar to `$SYSTEMD_HOME_ROOT` this is useful for
518 debugging purposes, in order to run a secondary `systemd-homed` instance that
519 operates on a record database entirely separate from the host's.
521 * `$SYSTEMD_HOME_DEBUG_SUFFIX` – takes a short string that is suffixed to
522 `systemd-homed`'s D-Bus and Varlink service names/sockets. This is also
523 understood by `homectl`. This too is useful for running an additional copy of
524 `systemd-homed` that doesn't interfere with the host's main one.
526 * `$SYSTEMD_HOMEWORK_PATH` – configures the path to the `systemd-homework`
527 binary to invoke. If not specified defaults to
528 `/usr/lib/systemd/systemd-homework`.
530 Combining these four environment variables is pretty useful when
531 debugging/developing `systemd-homed`:
533 SYSTEMD_HOME_DEBUG_SUFFIX=foo \
534 SYSTEMD_HOMEWORK_PATH=/home/lennart/projects/systemd/build/systemd-homework \
535 SYSTEMD_HOME_ROOT=/home.foo/ \
536 SYSTEMD_HOME_RECORD_DIR=/var/lib/systemd/home.foo/ \
537 /home/lennart/projects/systemd/build/systemd-homed
540 * `$SYSTEMD_HOME_MOUNT_OPTIONS_BTRFS`, `$SYSTEMD_HOME_MOUNT_OPTIONS_EXT4`,
541 `$SYSTEMD_HOME_MOUNT_OPTIONS_XFS` – configure the default mount options to
542 use for LUKS home directories, overriding the built-in default mount
543 options. There's one variable for each of the supported file systems for the
544 LUKS home directory backend.
546 * `$SYSTEMD_HOME_MKFS_OPTIONS_BTRFS`, `$SYSTEMD_HOME_MKFS_OPTIONS_EXT4`,
547 `$SYSTEMD_HOME_MKFS_OPTIONS_XFS` – configure additional arguments to use for
548 `mkfs` when formatting LUKS home directories. There's one variable for each
549 of the supported file systems for the LUKS home directory backend.
553 * `$KERNEL_INSTALL_BYPASS` – If set to "1", execution of kernel-install is skipped
554 when kernel-install is invoked. This can be useful if kernel-install is invoked
555 unconditionally as a child process by another tool, such as package managers
556 running kernel-install in a postinstall script.
558 `systemd-journald`, `journalctl`:
560 * `$SYSTEMD_JOURNAL_COMPACT` – Takes a boolean. If enabled, journal files are written
561 in a more compact format that reduces the amount of disk space required by the
562 journal. Note that journal files in compact mode are limited to 4G to allow use of
563 32-bit offsets. Enabled by default.
565 * `$SYSTEMD_JOURNAL_COMPRESS` – Takes a boolean, or one of the compression
566 algorithms "XZ", "LZ4", and "ZSTD". If enabled, the default compression
567 algorithm set at compile time will be used when opening a new journal file.
568 If disabled, the journal file compression will be disabled. Note that the
569 compression mode of existing journal files are not changed. To make the
570 specified algorithm takes an effect immediately, you need to explicitly run
571 `journalctl --rotate`.
573 * `$SYSTEMD_CATALOG` – path to the compiled catalog database file to use for
574 `journalctl -x`, `journalctl --update-catalog`, `journalctl --list-catalog`
577 * `$SYSTEMD_CATALOG_SOURCES` – path to the catalog database input source
578 directory to use for `journalctl --update-catalog`.
580 `systemd-pcrextend`, `systemd-cryptsetup`:
582 * `$SYSTEMD_FORCE_MEASURE=1` — If set, force measuring of resources (which are
583 marked for measurement) even if not booted on a kernel equipped with
584 systemd-stub. Normally, requested measurement of resources is conditionalized
585 on kernels that have booted with `systemd-stub`. With this environment
586 variable the test for that my be bypassed, for testing purposes.
590 * `$SYSTEMD_REPART_MKFS_OPTIONS_<FSTYPE>` – configure additional arguments to use for
591 `mkfs` when formatting partition file systems. There's one variable for each
592 of the supported file systems.
594 * `$SYSTEMD_REPART_OVERRIDE_FSTYPE` – if set the value will override the file
595 system type specified in Format= lines in partition definition files.
597 `systemd-nspawn`, `systemd-networkd`:
599 * `$SYSTEMD_FIREWALL_BACKEND` – takes a string, either `iptables` or
600 `nftables`. Selects the firewall backend to use. If not specified tries to
601 use `nftables` and falls back to `iptables` if that's not available.
605 * `$SYSTEMD_NVME_MODEL`, `$SYSTEMD_NVME_FIRMWARE`, `$SYSTEMD_NVME_SERIAL`,
606 `$SYSTEMD_NVME_UUID` – these take a model string, firmware version string,
607 serial number string, and UUID formatted as string. If specified these
608 override the defaults exposed on the NVME subsystem and namespace, which are
609 derived from the underlying block device and system identity. Do not set the
610 latter two via the environment variable unless `systemd-storagetm` is invoked
611 to expose a single device only, since those identifiers better should be kept
614 Tools using the Varlink protocol (such as `varlinkctl`) or sd-bus (such as
617 * `$SYSTEMD_SSH` – the ssh binary to invoke when the `ssh:` transport is
618 used. May be a filename (which is searched for in `$PATH`) or absolute path.