Safe systemd overrides without editing vendor units

A drop-in keeps local policy separate from packaged files. The important part is understanding the merged result and preserving a fast rollback.

Begin with the effective unit

Before changing anything, inspect both the unit and the properties systemd has resolved. This catches an existing drop-in that would otherwise be easy to overlook.

systemctl cat example.service
systemctl show example.service -p FragmentPath -p DropInPaths -p ExecStart

Create the smallest override

Use systemctl edit and change only the directive you intend to own locally. List-valued directives such as ExecStart must be cleared before a replacement is added.

[Service]
ExecStart=
ExecStart=/usr/local/bin/example --config /etc/example/config.yml
Restart=on-failure

Validate before restart

1. Verify the unit when practical.
2. Reload systemd and inspect the merged unit again.
3. Restart, then check status and the current boot journal.

systemctl daemon-reload
systemctl restart example.service
systemctl --no-pager --full status example.service
journalctl -u example.service -b --since "2 minutes ago"

Keep rollback boring

To remove a drop-in created with systemctl edit, use systemctl revert example.service, reload and restart. Record that command before making the change, not during an incident.

← Back to all notes