systemd merges Rust support for new components — no Cargo, no_std, C linkage only

What was merged

systemd, the init and service manager at the heart of most Linux distributions, can now host components written in Rust. According to a Joho no Todai report republished on dev.to, Christian Brauner — a systemd maintainer who also looks after the Linux kernel's VFS subsystem — merged pull request #44324 into systemd's Git repository. The change spans 54 files and adds 5,144 lines.

The pull request reworks an earlier RFC and implements rules the systemd maintainers agreed at a hackfest in Berlin. At Lennart Poettering's request, the work was split into four pull requests; the one now on the main branch, the second of the four, covers the Rust infrastructure itself.

The terms are deliberately narrow. Rust may be used only for new leaf components — programs at the edge of the stack that nothing else depends on — and there are no plans to port existing C code. Meson stays in place as the build system instead of Cargo, no external crates are introduced, and the Rust code runs without the language's standard library. Only C linkage is permitted, which preserves libsystemd-shared and its dlopen mechanism.

Whether Rust gets compiled in is governed by Meson's -Drust= option, which defaults to auto: support turns on when a suitable toolchain is found, and systemd still builds as a pure C project otherwise.

A custom allocator, not the standard one

systemd goes beyond no_std and skips even the alloc crate. Rust's standard collections such as Vec and Box terminate the process when an allocation fails, which cannot be tolerated in software that runs during boot. systemd therefore implements its own Box and Vec, which return an error instead of aborting. In the pull request description, Brauner says this mirrors the approach the Linux kernel takes.

Another decision shifts a long-standing C convention into the type system. When handling sensitive material such as private keys, C code had to remember to call erase_and_free() before releasing memory; forgetting left secrets sitting in freed memory. systemd's Rust side offers a Vec<u8, Erasing> type, where wiping on deallocation is built into allocator behaviour rather than left to the caller's memory.

Byte-for-byte CLI parity

Rust-written programs are meant to be indistinguishable from their C counterparts from the outside. A test script, test-cli-parity.sh, verifies that --help output, option parsing and --introspect-cli responses match the C versions byte for byte. Bindings to libsystemd-shared are generated at build time with bindgen, using the same headers and flags as the library. The size penalty looks modest so far: stripped test programs built with LTO came out at 32KB in Rust versus 20KB in C.

Distributions must choose

The support requires rustc 1.85 or later, bindgen 0.71.1 or later, and Meson 1.4.0 or later — versions that Debian 13 (Trixie) already ships. Arch and openSUSE's OBS, however, build systemd with --auto-features=enabled without declaring rustc and bindgen as build dependencies, so their builds fail as currently configured. They must either add those dependencies or explicitly set -Drust=disabled.

Only the infrastructure has landed so far. The first practical Rust program, systemd-keyring-setup — a boot-time utility that registers X.509 certificates in the kernel's dm-verity, fs-verity and BPF keyrings — remains pending in pull request #44114. The report expects it to merge soon, and says the merged support will appear in systemd 263.

Why it matters

systemd runs as PID 1 on most Linux distributions, so its language policy is not a niche concern: every distro now has to decide whether to ship a Rust toolchain to build it. The design also sketches a distinctive model for adopting Rust in critical infrastructure — keep the existing build system, take no external dependencies, don't rewrite working C code, and hand-roll memory handling rather than accept abort-on-failure allocation. That philosophy is shared with the Linux kernel, where Rust work such as Android's Binder driver and NVIDIA's Nova driver is moving from experimentation toward practical use, and where Brauner himself develops. With both the kernel and systemd — the two foundations of a Linux boot — now accepting Rust under the same ground rules, the experimental phase of Rust in core system software appears to be closing.