systemd-sysext Extension Image Management Prompt
Design and troubleshoot systemd-sysext system extension images so tools overlay onto an immutable or read-only base OS at runtime without modifying the underlying image.
- Target user
- Linux administrators running immutable or image-based OSes who need to layer extra tooling
- Difficulty
- Advanced
- Tools
- Claude, ChatGPT
The prompt
You are a senior Linux systems engineer who builds systemd-sysext and confext extension images for immutable OSes and understands the overlayfs merge, extension-release matching, and the sysext.service lifecycle. I will provide: - The base OS (image-based/immutable or normal), its ID and VERSION_ID from os-release - What I want to layer (debug tools, an agent, /etc config) and whether it must survive reboot - Any errors from `systemd-sysext status`, `merge`, or "no matching extension" messages Your job: 1. **Choose sysext vs confext** — decide whether the payload belongs in a /usr+/opt sysext or an /etc confext, and explain the merge targets for each. 2. **Build the image layout** — define the directory/raw image structure including the mandatory `usr/lib/extension-release.d/extension-release.<name>` (or etc/ for confext) and the ID/VERSION_ID/SYSEXT_LEVEL matching fields. 3. **Match against the host** — explain how extension-release ID and VERSION_ID/SYSEXT_LEVEL must match os-release, and why a mismatch causes silent skip. 4. **Package the image** — show building a squashfs or directory extension under /var/lib/extensions and signing/verity options if used. 5. **Activate and persist** — run `systemd-sysext merge`/`refresh`, enable systemd-sysext.service for boot, and confirm the overlay appears in /usr or /etc. 6. **Debug** — map "no matching extension", stale merge, or missing files to the extension-release field, the merge order, or an immutable-mount conflict. Output as: a sysext-vs-confext decision, the image directory layout with the extension-release contents, the build commands, the merge/enable sequence, and a troubleshooting table. Caution that sysext overlays are read-only merges that disappear on unmerge; warn against using them for data that must persist as writable state.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Related prompts
-
Runtime Capability & Ambient Set Audit (getpcaps) Prompt
Audit what Linux capabilities a running process actually holds across its permitted/effective/inheritable/ambient/bounding sets, and decide whether a service is over-privileged or whether a 'permission denied' is a missing capability.
-
systemd Encrypted Credentials (systemd-creds) Design Prompt
Replace plaintext secrets in environment variables and EnvironmentFile= with TPM-backed or host-bound encrypted credentials delivered to units via systemd-creds and LoadCredentialEncrypted=.
-
systemd-nspawn and machinectl Container Management Prompt
Build, network, and lifecycle-manage lightweight OS containers with systemd-nspawn and machinectl for test environments without pulling in a full container runtime.
-
Hostname and machine-id Clone Fix Prompt
Detect and repair duplicate /etc/machine-id, D-Bus IDs, and hostname collisions on VMs cloned from a template that cause DHCP lease, journald, and SSH host-key conflicts.
More Linux Admins prompts & error guides
Browse every Linux Admins prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.