DEV Community

Cover image for Stopping a Linux Service Isn't Always Enough. systemd Masking Explained
Rijul Rajesh
Rijul Rajesh

Posted on

Stopping a Linux Service Isn't Always Enough. systemd Masking Explained

#linux

Hello, I'm Rijul, and I'm building LiveReview — a blast-radius aware AI code review built for your business-critical systems. Star us to help devs discover the project, give it a try, and share your feedback to help improve the product.

In this article, we explore a specific feature of systemd, which is called masking.

If you haven't heard about systemd, it's basically a system and service manager in Linux.

It is responsible for doing things like:

  • Starting services when you turn on the system
  • Stopping services
  • Restarting services, etc.

And systemctl is the command you use to interact with systemd.

Mask in systemd

For more context, we start a service via:

systemctl start service
Enter fullscreen mode Exit fullscreen mode

Now we have this command:

sudo systemctl mask service
Enter fullscreen mode Exit fullscreen mode

Now, if we try to start this particular service, systemd will refuse.

It can give errors like:

Failed to start nginx.service:
Unit nginx.service is masked.
Enter fullscreen mode Exit fullscreen mode

Where mask is useful

Now, on immediately seeing the mask command, it may not be immediately clear what its use is.

Let me explain one situation.

Suppose you have a server where you absolutely don't want Nginx to be running.

In this case, you can try stopping it via:

sudo systemctl stop nginx
Enter fullscreen mode Exit fullscreen mode

But some other script or process somehow starts it again.

This is a problem.

So you want to prevent it from ever being started.

In such cases, mask becomes useful.

All you have to do is:

sudo systemctl mask nginx
Enter fullscreen mode Exit fullscreen mode

What happens when it's masked?

When you mask a service, this is what happens:

sudo systemctl mask nginx
Enter fullscreen mode Exit fullscreen mode

systemd makes a symlink for Nginx. Think of it as a link:

/etc/systemd/system/nginx.service
        ↓
     /dev/null
Enter fullscreen mode Exit fullscreen mode

So systemd looks for:

nginx.service
Enter fullscreen mode Exit fullscreen mode

and finds:

/etc/systemd/system/nginx.service -> /dev/null
Enter fullscreen mode Exit fullscreen mode

systemd interprets that as:

This unit is masked. Don't start it.

Wrapping up

mask is just one of many other commands we use.

Here is an illustration of where mask and unmask fit within the broader range:

So that's about it for this article. See you in the next one.


Your team's attention is limited, and the deluge of AI-generated code is making it harder to keep production stable while also shipping at high velocity.

I'm building LiveReview, a blast-radius aware AI code review built for your business-critical systems.

Instead of presenting every diff with equal emphasis, LiveReview scores each change by blast radius — how far its impact reaches through your call graph — so you can focus attention where it actually matters.

Spend code review effort where business risk is highest — not spread evenly across every diff.

Try LiveReview on your codebase:

LiveReview Banner

Top comments (0)