systemd welcomes its first Rust programs, without Cargo and without rewriting C
On October 24, 2026, systemd merged into its Git tree the support for writing systemd programs in Rust, a building block that will unlock the systemd-keyring-setup utility. The goal is not to port the existing C code but to let leaf components benefit from Rust’s memory safety, at a cost of a few kilobytes per binary.
October 24, 2026. systemd merges into its Git tree the infrastructure that makes it possible to write systemd programs in Rust as an alternative to C. October 24, 2026, the same day. The first component to use it, systemd-keyring-setup, is still awaiting its own merge, now unblocked by this foundation. October 24, 2026, again. The maintainers make clear they will not port the existing C code. The headline: systemd’s core stays in C, but peripheral components can now be born in Rust — no Cargo, built by Meson, and restricted to a C linkage.
For a Linux administrator who watches systemd boot nearly every distribution on earth, this is a quiet but symbolic shift: the world’s most widely deployed init stack begins moving toward a language designed to eliminate an entire class of memory bugs.
What was merged, exactly
The core change is narrow. It enables writing systemd programs — the leaf components such as utilities and individual services — in Rust, but not yet the core code: the systemd library and central pieces remain in C, pending the resolution of several Rust-specific blockers. The split is deliberate: leaf components are self-contained executables with a narrow interface, so a memory-safe rewrite there is cheap to review and easy to roll back, whereas the core library is shared by everything and any regression there would ripple across the entire boot.
The constraints the maintainers set are explicit. systemd’s Rust builds with Meson, without Cargo, and mandates a C-only linkage: new code integrates with the rest of the ecosystem through the usual C boundary, without dragging the Cargo build ecosystem into the project’s toolchain.
The first component written under this new framework is systemd-keyring-setup, a utility that provisions keyrings and enrolls X.509 certificates into the kernel’s dm-verity, fs-verity, and BPF keyrings during boot, then disposes of them afterward. Its code has not merged yet, but the maintainers describe it as imminent: originally it was a single large commit, later split into the Rust enablement, systemd-keyring-setup, and the surrounding preparations.
The support is optional, controlled by the Meson option -Drust=, which defaults to auto. A target of systemd 263, the version currently in preparation, will enable it transparently whenever a Rust compiler is present.
Why Rust in systemd, and why now
The motivation is not cosmetic. The Linux kernel has accepted Rust since version 6.1, and the push for memory safety has taken root across system infrastructure: a significant share of exploited flaws in low-level software still stems from memory-management errors in C. systemd is a critical choke point — it starts services, mounts filesystems, and manages sockets — and every bug there is paid for at full price.
systemd’s own context points the same way. Version 262, released shortly before, introduced an AI/LLM canary meant to flag unreviewed code contributions, plus LUO integration: the project is trying to keep quality in check as more code is produced with assistant help. Letting Rust into leaf components is another answer to the same problem — shrink the bug surface at the source rather than detect it after the fact. The two moves are complementary: the canary catches dubious code that already exists, while Rust prevents an entire class of mistakes from being written in the first place — over time, fewer of systemd’s critical bugs should be memory-safety issues at all.
The maintainers are explicit about what they will not do: no porting of existing C code to Rust. The new language will serve new code, where a rewrite carries no regression risk, not a retrospective migration of the millions of lines already in production.
This move rests on solid numbers. Microsoft and Google have for years attributed roughly 70% of their security flaws to memory-safety errors in languages like C and C++, and both vendors publicly push toward languages that eliminate those bug classes at the root. The Linux kernel opened the path by accepting Rust in version 6.1, and systemd — the first user-space process on nearly every distribution — is the logical next step: it starts services, mounts filesystems, and now provisions integrity-verification keyrings.
The cost: a few kilobytes, and accepted limits
The transition is not free, but it is measured. Rust components come out slightly larger than their C twins: in testing, one test program weighed 32 KB against 20 KB for its C equivalent. For system binaries packed into an initramfs, that difference matters; it remains marginal at the scale of a full system.
The limits are accepted and documented. The core of systemd — the central library and shared code — does not yet accept Rust, and the maintainers list blockers to clear before that step is considered. The mandatory C linkage also means systemd’s Rust code will not, for now, benefit from the richer idioms a native integration would allow.
What is already in place is enough to open the path: the merged Rust infrastructure lets any future leaf component be written in a memory-safe language without changing the project’s build tooling.
Choosing systemd-keyring-setup as the first component is deliberate: it handles X.509 certificates and kernel keyrings in the first seconds of boot, a place where a memory leak or buffer corruption is paid for with a system that fails to start or exposed secrets. Deploying Rust there first means hardening the point where failure is most expensive.
What this changes for administrators
In the short term, nothing breaks. The Rust support is off unless -Drust= is explicitly enabled, and no stable release requires it yet. Distributions that build systemd 263 with a Rust compiler present will enable it automatically through the auto default, but with no visible change at runtime: a Rust binary behaves like a C binary once it is running.
What changes is the trajectory. Every new component written in Rust — starting with systemd-keyring-setup — shrinks the memory-bug surface of an executable that runs early, often before logging and confinement mechanisms are fully up. For an administrator, that is a reason to follow the systemd 263 release notes closely, in particular the list of migrated components and the state of the -Drust= option in their distribution’s package.
For distribution maintainers, the practical question is packaging. Because the Rust support is optional and driven by a Meson flag rather than Cargo, it does not force packagers to introduce the Cargo registry into their build pipelines — a meaningful concession to the people who actually ship the packages. That is why the option defaults to auto: it activates only when a Rust toolchain is already present, and stays invisible otherwise.
Verdict
The move is cautious and the direction is right. If you maintain a distribution or build systemd yourself, leave -Drust= on auto: the binary overhead is minimal and the value will materialize component by component. If you simply operate systems, there is nothing to do today — but note that systemd 263 marks the start of a period in which the init stack gradually absorbs Rust code. The wider lesson: memory safety reaches infrastructure through the leaves, not through a rewrite of the core — and it is precisely because that method is slow that it has a chance to succeed.