Migrating SysV Init Scripts to systemd Units with AI

Read the generated unit — note Restart=no, RemainAfterExit=yes and KillMode=process. The wrapper never restarts a crashed daemon and can report active (exited) while nothing is running. A native unit fixes all three.

Check what is actually running — ps -o user,group,ni,pid,ppid,cmd -C legacy-app records the real user, nice value and arguments today. That is the behaviour the new unit has to reproduce, whatever the script claims.

Catch rc.local too — commands in /etc/rc.local run via rc-local.service on many distributions. They deserve the same treatment, one unit per job.

Also check the cron side — some init-era services were kept alive by an @reboot crontab entry or a watchdog cron job. crontab -l -u app for each service account finds them.

The help text decides Type= — the single most important choice is whether the daemon can stay in the foreground. Without its flags the model guesses, and it usually guesses forking because that is what the script did.

The behaviour table is the review — it forces the model to account for every line of the script. A missing row is how you find the chown or umask it silently dropped.

Name the systemd version — directives keep arriving. Type=exec needs systemd 240, and RHEL 7 still ships 219. A model that does not know the target will use whatever it saw most often.

Scrub before pasting — defaults files often hold tokens and passwords. Use a local model or redact them first.

ExecStartPre runs as app — so mkdir under /run fails with permission denied. RuntimeDirectory= replaces it entirely.

Type=forking without PIDFile= — systemd has to guess which process is the main one. Combined with bash -c, the guess can land on the wrong PID, and then stop, reload and restart act on the wrong process.

bash -c hides everything — the file limit and working directory no longer appear in systemctl show, and a typo in the chain only shows up at runtime.

network.target is not "network up" — it only orders against the network management stack starting. A daemon that binds to a specific address or connects out at startup needs network-online.target.

Missing dash on EnvironmentFile — the script tolerated a missing defaults file with [ -r ... ]. Without the leading - the unit refuses to start when the file is absent.

Same name shadows the script — when /etc/systemd/system/legacy-app.service exists, the generator skips /etc/init.d/legacy-app. Keeping the name means dependants and monitoring keep working.

Retire the script properly — on Debian and Ubuntu, update-rc.d -f legacy-app remove; on RHEL-family systems, chkconfig --del legacy-app. Then move the script out of /etc/init.d rather than deleting it, until the unit has survived a reboot.

KillMode changed — the generated unit used KillMode=process. The native default, control-group, also kills child processes on stop. That is usually what you want, but check for workers that were meant to outlive a restart.

Reboot once — ordering problems only show up at boot, when the network and mounts are not ready yet. A restart on a running system proves nothing about After=.

ProtectSystem=strict — makes the whole filesystem read-only for the service except /dev, /proc, /sys, the paths you list in ReadWritePaths=, and directories created with StateDirectory= or LogsDirectory=. It is the directive that finds every undocumented write.

PrivateTmp=yes — gives the service its own /tmp. It breaks daemons that exchange files with other processes through /tmp, which init-era software does more often than you would hope.

Treat the exposure score as a guide — systemd-analyze security rates exposure from 0 to 10. Getting a legacy daemon from about 9 to the 4-6 range is realistic; chasing lower usually means fighting the software.

Generate the skeleton — for new services and timers, our systemd generator produces a clean starting unit, and the server hardening checklist covers the rest of the host.