Linux Internals

systemd & the
Linux Boot Process

From the moment you press “power on” to a ready login prompt — what actually happens, step by step, and who's in charge of it all.

Sections

6

Read time

20 min

Level

Beginner

What is systemd?

systemd is the manager of everything that runs on your Linux system. The moment you turn on your computer, systemd is the first thing that starts — and it controls starting, stopping, and watching over all programs and services.

💡
Think of it this way...
Your Linux system is a big hotel.

systemd = the Hotel Manager who runs everything
Services (SSH, web server, database) = hotel departments (housekeeping, security, front desk)

When the hotel opens in the morning (boot), the manager turns on electricity, opens the front desk, starts housekeeping, opens room service — in the right order. If a department crashes, the manager restarts it automatically.
💡

Key Takeaway

systemd is Process ID 1 (PID 1) — the first process the kernel starts. Every other process on the system is a child of systemd.

systemctl Commands

systemctl is how you talk to systemd. Think of it as calling the hotel manager on the phone and giving instructions.

sudo systemctl status ssh

Is SSH running? Show current state and recent logs.

sudo systemctl start ssh

Start SSH right now (once, this session).

sudo systemctl stop ssh

Stop SSH right now.

sudo systemctl restart ssh

Stop then start. Apply config changes.

sudo systemctl enable ssh

Start SSH automatically on every boot.

sudo systemctl disable ssh

Don't start automatically on boot.

start vs enable — the critical difference

start

Run it right now. If you reboot, it won't start again automatically.

enable

Run it on every boot. But doesn't start it right now.

💡 Setting up a new service? Do both: sudo systemctl enable ssh && sudo systemctl start ssh

Terminal
▶️

Click the Play button above to start!

Watch the commands execute step by step

Services & Daemons

A service (also called a daemon) is a program that runs in the background, silently waiting for something to do. The d at the end of sshd, mysqld, and nginx stands for daemon.

💡
Think of it this way...
A security guard stands at the door of a building. They don't do anything most of the time — just wait. But the moment someone comes to the door, they spring into action.

sshd = security guard waiting for SSH connections
nginx = waiter waiting for web requests
mysqld = librarian waiting for database queries

Common services you'll work with

ssh / sshdPort 22

Remote terminal access. What lets you connect from your Mac to your server.

nginxPort 80/443

Web server. Serves websites, acts as reverse proxy.

mysql / mysqldPort 3306

MySQL database server. Stores and retrieves structured data.

cron—

Scheduled task runner. Runs jobs at specific times automatically.

Logs with journalctl

systemd records everything that happens on your system. journalctl is how you read those records.

💡
Think of it this way...
journalctl is like checking the hotel's security camera footage — you can see what happened, when, and with which service. The -f flag means you're watching the live feed.
Terminal
▶️

Click the Play button above to start!

Watch the commands execute step by step

🤯

Did You Know?

journalctl stores logs in a binary format, not plain text files. This means it can store more data, query faster, and can't be as easily tampered with as plain text log files.

The Linux Boot Process

From pressing “power on” to seeing a login prompt — here's every step, explained:

🔌

Step 1

BIOS / UEFI — Hardware Check

Built into the hardware itself. Runs before anything else. Does a POST (Power-On Self-Test): is the CPU working? RAM? Storage? Then finds the bootloader and hands control to it.

💾

Step 2

GRUB — The Boot Loader

GRUB finds the Linux kernel on your storage drive and loads it into RAM. If you have multiple OSes, GRUB shows a menu to choose. It's the bridge between hardware-land and Linux-land.

⚡

Step 3

Linux Kernel Loads

Takes control of ALL hardware — CPU, RAM, storage, network card. Sets up memory management, detects devices. Then starts the very first user-space process: systemd.

🏨

Step 4

systemd Starts (PID 1)

The kernel launches systemd as Process ID 1 — the very first process. Every other service, app, or program is started by systemd, making it the ancestor of everything on the system.

📋

Step 5

systemd Reads Service Files

systemd reads config files in /etc/systemd/system/ to know what to start, in what order, and what each service depends on. Like opening the hotel's daily operations binder.

🚀

Step 6

Services Start In Order

Networking first (SSH needs the network). Then firewall rules. Then SSH, databases, web servers. Order matters — systemd handles all the dependencies automatically.

✅

Step 7

Login Prompt Appears

All services running. systemd shows you the login prompt — either on the console directly or SSH is ready and waiting for your connection. Boot complete.

💡

Key Takeaway

The entire boot process — from power-on to ready login prompt — typically takes 3–8 seconds on a modern system. Impressive considering everything that happens.

Service Files

systemd doesn't randomly start things. It reads service files — small config files that describe exactly how to run each service.

Service files live in /etc/systemd/system/ and /lib/systemd/system/. Here's what a typical one looks like:

ssh.service

[Unit]

Description=OpenSSH Server

After=network.target ← start AFTER networking

[Service]

ExecStart=/usr/sbin/sshd -D ← command to run

Restart=on-failure ← restart if it crashes

[Install]

WantedBy=multi-user.target ← start on normal boot

The After=network.target line is how systemd knows SSH must wait for networking to be ready. This is how it figures out the correct startup order automatically.

Key Concepts Flashcards

Click any card to flip and reveal the definition.

What is systemd?

The manager of everything on a Linux system. It's PID 1 — the first process the kernel starts. It controls starting, stopping, and monitoring all services on your system.

What does systemctl do?

systemctl is how you talk to systemd. Think of it as calling the hotel manager. 'start/stop/restart/status/enable/disable' a service.

start vs enable

start = run right now, this session only. enable = run automatically on every boot. Usually do both: 'sudo systemctl enable ssh && sudo systemctl start ssh'

What is a daemon?

A background program silently waiting for work. The 'd' suffix gives it away: sshd, mysqld, nginx. Like a security guard — dormant until someone arrives.

What is journalctl?

systemd's log viewer. View all logs: journalctl. Filter by service: journalctl -u ssh. Live tail: journalctl -u ssh -f. It's systemd's security camera footage.

What is GRUB?

The boot loader. After BIOS checks the hardware, GRUB finds the Linux kernel on disk and loads it into RAM. It's the bridge between hardware-land and Linux-land.

What are service files?

Config files that tell systemd how to run a service — what command to run, when to start it, what it depends on, whether to restart on crash. Stored in /etc/systemd/system/ and /lib/systemd/system/.