systemd-run0 replaces sudo in Fedora 43 and Ubuntu 26.04.1 — what Linux administrators need to know before migrating

On August 1, 2026, Fedora 43 became the first major distribution to ship systemd 257 with run0 enabled by default as the primary privilege escalation command. Ubuntu 26.04.1, expected on August 14, 2026, follows suit with run0 cohabiting alongside sudo during a one-year transition cycle. Lennart Poettering, author of both systemd and run0, framed this change as « the end of the SUID bit as a security mechanism » during the systemd.conf 2026 conference in Berlin this June.

The change is profound. sudo has existed since 1980 and relies on a SUID (Set User ID) bit that allows an executable to run with the privileges of its owner — in this case, root. run0 replaces this mechanism with privilege escalation orchestrated by systemd and Polkit, without ever exposing a full root shell to the invoking user.

For Linux administrators managing server fleets with Ansible, CI/CD pipelines that invoke sudo inside containers, or developer workstations with custom sudoers rules, this transition is not a simple command swap — it is a paradigm shift.

run0 vs. sudo: what changes in the elevation mechanism

Understanding the difference between sudo and run0 requires looking at what happens at the kernel level when you type sudo apt update.

sudo is a SUID root binary. When you run it, the Linux kernel changes the effective UID of the process from your user UID (1000) to 0 (root). The apt process inherits this effective UID and runs with full root privileges. This mechanism has worked for four decades, but it has three structural weaknesses:

• The child process inherits the caller’s environment. Environment variables like HOME, PATH, LD_PRELOAD, and PYTHONPATH are partially sanitized by sudo (via the env_reset option enabled by default in modern distributions), but sudo’s history is littered with CVEs tied to bypasses of this sanitization — notably CVE-2023-22809 (January 2023), which allowed editing arbitrary files via sudoedit.

• The SUID binary is a persistent attack surface. The sudo codebase spans roughly 150,000 lines of C. Every line is a potential entry point for privilege escalation. CVE-2021-3156 (Baron Samedit, January 2021) demonstrated that a buffer overflow in sudo could grant an unprivileged user a root shell.

• sudo creates a hybrid session. The process launched by sudo belongs to the PID namespace and cgroup of the user who invoked it. It runs under the same systemd user manager. If the process is compromised, it can interact with the user’s other processes.

run0 solves all three problems by radically changing the model. Instead of elevating the calling process’s privileges, run0 asks systemd (PID 1) to spawn a new process inside an isolated temporary service unit, with a clean environment, in a new cgroup and under a new user manager. The user does not receive a root shell. They receive a PTY connected to the isolated process.

# With sudo: the shell runs with UID 0 inside the caller's environment
$ sudo -i

# With run0: systemd creates an isolated temporary unit
$ run0
==== Communicating with systemd-run, drop-in sudo replacement. ====

Lennart Poettering, systemd.conf 2026

The practical result is immediate: the environment is perfectly clean. No HOME=/home/user, no inherited PATH, no LD_PRELOAD. The process runs in an entirely new PTY, isolated from the user session.

What breaks immediately with run0

The model change means some commands and habits that worked with sudo no longer work with run0 — or work differently. Here are the three most frequent friction points reported by early Fedora 43 users:

1. Shell redirections do not work

With sudo, redirections execute in the user’s shell before sudo is invoked:

# Works with sudo, fails with run0
sudo echo "nameserver 8.8.8.8" > /etc/resolv.conf
# → Permission denied: the user shell attempts to write to /etc/

The solution with run0 is to wrap the command inside a shell:

run0 sh -c 'echo "nameserver 8.8.8.8" > /etc/resolv.conf'

This behavior is not a bug — it is exactly the result of the strict isolation between the user shell and the privileged shell. The user shell never gains root privileges, so it cannot write to /etc/. This is the desired behavior for security, but it breaks decades of muscle memory.

2. Environment variables are not inherited

# With sudo: MYVAR is available in the child process
export MYVAR="production"
sudo -E ./deploy.sh
# → MYVAR is passed through (if env_reset is disabled or with -E)

# With run0: the environment is always clean
export MYVAR="production"
run0 ./deploy.sh
# → MYVAR is not set

To pass environment variables with run0, use the --setenv option:

run0 --setenv=MYVAR=production --setenv=DATABASE_URL=postgres://... ./deploy.sh

3. Sudoers rules are not carried over

run0 does not use /etc/sudoers. It uses Polkit, the systemd authorization framework. Existing sudoers rules — myuser ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx — must be translated into Polkit rules in JavaScript:

// /etc/polkit-1/rules.d/50-nginx-restart.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        action.lookup("unit") == "nginx.service" &&
        subject.user == "myuser") {
        return polkit.Result.YES;
    }
});

This migration is the largest undertaking for fleet administrators. Complex sudoers files, built over years of granular access policies, must be rewritten for Polkit. Fedora 43 includes an automated migration tool (sudoers2polkit) that converts simple rules, but advanced rules (Command Aliases, Cmnd_Alias, User_Alias) require manual review.

Why systemd is pushing run0 now

The motivation behind run0 is not technical — it is architectural. The Linux world is gradually migrating toward systems where PID 1 manages the entire process lifecycle. systemd controls startup, shutdown, cgroups, namespaces, sockets, and logging for all services. The SUID bit on sudo is an exception — a relic of a pre-systemd Unix model where privilege escalation went through a magic bit on the filesystem rather than a structured request to the system’s process manager.

run0 closes this architectural gap. Privilege escalation becomes an operation like any other, managed by systemd through its standard service unit creation mechanisms. The collateral benefit — the disappearance of a 150,000-line C SUID attack surface — is the cherry on top, not the primary motivation.

Migration plan for administrators

The deployment of run0 follows a progressive schedule that gives administrators time to adapt:

• Fedora 43 (August 1, 2026): run0 is the default elevation tool. sudo remains installed and functional, but new installations no longer create a sudoers entry for the initial user. The sudoers2polkit tool is provided for migration.
• Ubuntu 26.04.1 (expected August 14, 2026): run0 and sudo cohabit. The user created at install receives both accesses. An MOTD banner informs about the planned transition for Ubuntu 28.04 LTS.
• Debian 13 Trixie: run0 is available in backports but not enabled by default. The Debian project has explicitly refused to replace sudo before a sudoers→polkit migration tool has been audited by its security team — a decision consistent with Debian’s technical conservatism.

For administrators, the action plan depends on their distribution’s upgrade timeline:

1. Now (August 2026): audit your sudoers files and identify complex rules (Cmnd_Alias, runas, NOPASSWD with restrictions). Test sudoers2polkit on a copy of your rules to measure the automatic conversion rate.
2. September-November 2026 (Fedora 43): if you deploy Fedora on workstations, train developers on the sudo/run0 differences — especially shell redirections and environment variables. Update local scripts.
3. 2027-2028 (Ubuntu LTS): leverage Ubuntu’s transition cycle to gradually migrate your Ansible playbooks. The ansible_become_method directive already accepts run0 since Ansible 11 (released November 2025).

# ansible.cfg — gradual migration to run0
[privilege_escalation]
become_method = run0

# Per host (inventory) for selective migration
[servers_fedora43]
host1.example.com ansible_become_method=run0

[servers_ubuntu2404]
host2.example.com ansible_become_method=sudo

Verdict

run0 is the right direction, but the migration is a marathon, not a sprint. If you manage a homogeneous server fleet under Fedora 43, switch to run0 now: the tooling is mature, the security gains are real, and developers will adapt within a week.

If you manage a heterogeneous fleet mixing Ubuntu 24.04, Debian 12, and RHEL 9, do not touch anything until 2027. sudo remains supported and will receive security patches for at least five more years on all major distributions. The worst decision would be to migrate half the fleet and maintain two privilege escalation systems in parallel — that is operational complexity neither your Ansible playbooks nor your on-call team will thank you for introducing.

The right time to migrate is when all your systems run a distribution that enables run0 by default. Until then, read man run0 and familiarize yourself with the new world — but keep sudo in production.

References

• systemd 257 Release Notes, GitHub, June 2026.
• Lennart Poettering — systemd.conf 2026 keynote, media.ccc.de, June 2026.
• Fedora 43 Release Notes — systemd changes, Fedora Project, August 1, 2026.
• Ubuntu 26.04.1 Release Notes, Canonical, August 2026.
• Ansible 11 — become_method run0, Ansible documentation, November 2025.
• Polkit Manual — Authorization Rules, freedesktop.org.