Config · XB Field Notes

nginx chooses the first matching regex, not a specificity score

Mon, 27 Dec 2027 00:00:00 +0000

nginx does not assign a general specificity score to every location expression. Ordinary prefixes are selected by matching length, exact locations can finish the search, and competing regex locations are evaluated in declaration order. A regex that looks narrower to a human can lose to a broader expression placed earlier. Mixing these selection rules is a common reason apparently careful routing changes affect unexpected paths.

When it breaks

A general suffix regex for .css can win before a later regex restricted to /assets/. The later expression may look more specific because it names a directory, but nginx does not compare the apparent specificity of those two patterns. If they both match, their order decides which configuration handles the request in the flat structure used here.

Reordering ordinary prefix blocks is a different operation. Moving /assets/ above / does not make it win more strongly; its longer matching prefix already gives it priority when the prefix result applies. A review that treats all location declarations as one first-match list can therefore make ineffective changes while missing the regex order that actually controls the failing route.

A shorter ^~ prefix is also not a permanent shield around an entire subtree. If a longer ordinary prefix is selected, the shorter marked prefix is no longer the candidate that suppresses the regex phase. Adding one seemingly harmless more-detailed prefix can therefore allow a suffix regex to take requests that previously stayed in the marked location.

Check it quickly

Run the script with host Python, Docker, and the pinned nginx image. The recorded environment used nginx 1.28.0 on Linux arm64 with Docker 29.3.1. It builds two temporary configurations, checks each with nginx -t, and issues real requests through host-loopback ports. Each configuration uses only flat locations, and its containers, image tags, and private network are cleaned up:

from contextlib import contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import http.client,json,socket,subprocess,time,uuid

NGINX='nginx@sha256:552e7481ca93ffccd046aa658dbbed22caefbc09c66fa7cd247cbb90b8a5c609'
PYTHON='python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84'
def docker(*args,check=True):
 result=subprocess.run(['docker',*args],capture_output=True,text=True,timeout=120)
 if check:assert result.returncode==0,result.stderr
 return result
def wait(predicate):
 deadline=time.monotonic()+15
 while time.monotonic()<deadline:
 try:
 if predicate():return
 except OSError:pass
 time.sleep(.1)
 raise AssertionError('fixture did not become ready')

@contextmanager
def lab(configuration,files=None,backend=None):
 name='xbcatm-nginx-'+uuid.uuid4().hex[:10];tags=[name+':proxy',name+':backend'];containers=[name+'-proxy',name+'-backend']
 try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'files').mkdir();(root/'nginx.conf').write_text(configuration)
 for path,content in (files or {}).items():
 target=root/'files'/path;target.parent.mkdir(parents=True,exist_ok=True);target.write_text(content)
 docker('network','create',name)
 if backend is not None:
 (root/'backend.py').write_text(backend)
 (root/'backend.Dockerfile').write_text(f'FROM {PYTHON}\nCOPY backend.py /backend.py\nCMD ["python", "/backend.py"]\n')
 docker('build','--network','none','-f',str(root/'backend.Dockerfile'),'-t',tags[1],str(root))
 docker('run','-d','--name',containers[1],'--network',name,'--network-alias','backend',tags[1])
 wait(lambda:docker('exec',containers[1],'python','-c','import socket;s=socket.create_connection(("127.0.0.1",8081),timeout=.5);s.close()',check=False).returncode==0)
 (root/'Dockerfile').write_text(f'FROM {NGINX}\nCOPY nginx.conf /etc/nginx/nginx.conf\nCOPY files /srv\n')
 docker('build','--network','none','-t',tags[0],str(root))
 docker('run','--rm','--network',name,tags[0],'nginx','-t')
 docker('run','-d','--name',containers[0],'--network',name,'-p','127.0.0.1::8080',tags[0])
 details=json.loads(docker('inspect',containers[0]).stdout)[0]
 binding=details['NetworkSettings']['Ports']['8080/tcp'][0];assert binding['HostIp']=='127.0.0.1';port=int(binding['HostPort'])
 def ready():
 connection=socket.create_connection(('127.0.0.1',port),timeout=.5);connection.close();return True
 wait(ready)
 def request(path,method='GET',headers=None,body=None):
 connection=http.client.HTTPConnection('127.0.0.1',port,timeout=5)
 try:
 connection.request(method,path,body=body,headers=headers or {})
 response=connection.getresponse();return response.status,{k.lower():v for k,v in response.getheaders()},response.read()
 finally:connection.close()
 yield containers[0],request
 finally:
 docker('rm','-f',*containers,check=False);docker('image','rm',*tags,check=False);docker('network','rm',name,check=False)

def config(locations,extra=''):
 return 'worker_processes 1;\nerror_log /tmp/error.log notice;\nevents {}\nhttp {\naccess_log off;\n'+extra+'\nserver { listen 8080; root /srv;\n'+locations+'\n}\n}\n'

prefixes=[
 'location / { return 200 "fallback"; }',
 'location /assets/ { return 200 "asset-prefix"; }',
 'location = /assets/exact.css { return 200 "exact"; }',
 'location ^~ /static/ { return 200 "static-prefix"; }',
 'location /static/dynamic/ { return 200 "dynamic-prefix"; }']
regexes=[r'location ~ \.css$ { return 200 "generic-css"; }',r'location ~ ^/assets/ { return 200 "asset-regex"; }']
for reverse,expected in [(False,'generic-css'),(True,'asset-regex')]:
 ordered_prefixes=list(reversed(prefixes)) if reverse else prefixes
 ordered_regexes=list(reversed(regexes)) if reverse else regexes
 locations='\n'.join(ordered_prefixes+ordered_regexes)+'\n'+r'location ~* \.txt$ { return 200 "case-folded-text"; }'
 with lab(config(locations)) as (container,request):
 cases={'/assets/file.css':expected,'/assets/exact.css':'exact','/static/file.css':'static-prefix','/static/dynamic/file.css':'generic-css','/static/dynamic/plain':'dynamic-prefix','/README.TXT':'case-folded-text','/elsewhere.CSS':'fallback','/elsewhere':'fallback'}
 for path,wanted in cases.items():
 status,headers,body=request(path);assert status==200 and body.decode()==wanted,(path,status,body)
print('reversing the matching regex declarations changes the winner; the first matching regex is not necessarily the most specific')
print('exact locations and longest-prefix selection ignore declaration order; a longer ordinary prefix can make a shorter ^~ prefix irrelevant')

The first configuration places the .css regex before the regex beginning with /assets/. Requesting /assets/file.css returns generic-css. The second configuration reverses those regexes, and the identical request returns asset-regex. Nothing in the request became more or less specific; only the order of two simultaneously matching patterns changed.

The script also reverses the ordinary prefix declarations between configurations. Their relevant results remain stable. /static/dynamic/plain continues to use the longer ordinary prefix, and the broad fallback handles an unrelated path. This comparison separates textual rearrangement of prefixes from textual rearrangement of regexes instead of assuming both edits have the same routing effect.

An exact /assets/exact.css location wins in both configurations despite matching both regex patterns. It returns exact. The test therefore includes a route deliberately isolated from regex ordering, rather than presenting the first matching regex as an unconditional rule that overrides every other location type.

The path /static/file.css stays in the ^~ /static/ prefix and returns static-prefix. But /static/dynamic/file.css has a longer ordinary prefix, so the .css regex is considered and returns generic-css. This verifies the selected-prefix qualification on ^~; the modifier belongs to that location, not to an invisible inherited protection on every deeper prefix.

Case modifiers are tested separately. The ~* text-file pattern matches /README.TXT, while the case-sensitive .css pattern does not match /elsewhere.CSS, which reaches the fallback. These are observations for the explicit regexes and Linux environment in the fixture, not a claim that all filesystem paths or every platform use identical case rules.

Make overlaps visible in review

For each regex, identify paths that also match earlier expressions and record which handler is intended to win. Include boundary cases where two patterns overlap, as well as cases where neither matches. A test that exercises only one regex in isolation cannot reveal the priority conflict introduced when another expression is added before it.

Use exact or prefix locations when they naturally describe the route, and keep intentional regex overlaps understandable. A regex is not inherently wrong, but its ordering becomes part of the service contract. Changes to included configuration can alter the effective sequence, so inspect the complete loaded configuration rather than reviewing a file fragment without its surrounding context.

When adding a longer prefix below an existing marked prefix, retest suffix routes through that new path. Do not assume the earlier ^~ still governs the request. Finally, verify downstream behavior such as cache headers, proxying, and access control in the winning block; selecting the expected marker is a routing test, not proof that every policy inside that block is correct.

Sources

nginx core location directive, first matching regex, prefix priority, and case modifiers, checked 2026-09-12.
How nginx processes a request, configuration selection inside the matched server, checked 2026-09-12.
nginx 1.28.0 core implementation, version-specific prefix and regex location-search behavior, checked 2026-09-12.

ConfigMaps separate configuration from the image

Fri, 20 Aug 2027 00:00:00 +0000

A ConfigMap stores non-confidential configuration separately from an image. That lets a release change an environment-specific value without rebuilding the application artifact. The useful boundary is explicit: the image supplies code, while the workload definition identifies which configuration that code should consume. A release is therefore more than an image tag; its configuration reference is part of the behavior being deployed.

Give configuration a reviewable identity

ConfigMap data values are strings, with binaryData available for binary values represented through the API’s encoding. The object is intended for small configuration, with a one-MiB data limit. It is not a general file repository or a secret-protection mechanism. The API can validate object structure without understanding whether a particular application setting is meaningful or safe for the business.

A Pod can consume values through environment references or mounted files. Ordinary Pod references resolve the ConfigMap in that Pod’s namespace. Choose names and required keys deliberately, then validate the application’s interpretation. An accepted Deployment object does not prove that every referenced key exists or that a new container can start successfully with the selected values.

Define units, accepted values, and defaults in the application’s configuration schema. A stored string resembling a boolean or number does not choose its parsing rules. Review those rules with the consumer before promoting a configuration between environments.

Versioned immutable ConfigMaps make release identity easier to inspect. A name such as settings-v2 can be retained alongside settings-v1, with immutable preventing data changes to the existing object. This protection does not prohibit an authorized actor from deleting and recreating a name. Keep object lifecycle permissions and release records aligned with the intended immutability promise.

When it breaks

Editing configuration and replacing processes are different actions. Environment values already injected into a running container are not rewritten by a ConfigMap update. Normal projected files can update eventually, but the application must read the new contents; subPath and previously opened files introduce additional lifetime distinctions. Do not report a configuration rollout merely because the API now shows a new value.

Changing a Deployment’s Pod-template reference to a new ConfigMap is a concrete rollout trigger. Changing the ConfigMap itself does not automatically rewrite that template. Likewise, a checksum annotation is useful only when a tool actually updates it in the Pod template. Kubernetes does not discover arbitrary external configuration changes and generate that checksum on the application’s behalf.

Rollback depends on retained inputs. Repointing a workload to settings-v1 fails if the old object has been deleted, and restoring an image alone cannot restore a changed configuration. Keep needed versions available and check consumers before cleanup. Configuration changes also need business validation; a syntactically valid threshold can still disable a service or change its behavior incorrectly.

Check it quickly

Use a disposable Kubernetes cluster with kubectl access and python:3.11-slim-bookworm available to its nodes. Save this as config-releases.py and run python3 config-releases.py KUBECONFIG_PATH CONTEXT, substituting that cluster’s dedicated configuration path and context name. The test needs permission to create and delete its own namespace. The recorded server version was Kubernetes 1.34.11, with kubectl 1.34.1.

import json
import subprocess
import sys
import time
from uuid import uuid4

assert len(sys.argv) == 3, 'usage: python3 example.py DISPOSABLE_KUBECONFIG CONTEXT'
base = ['kubectl', '--kubeconfig', sys.argv[1], '--context', sys.argv[2], '--request-timeout=30s']
image = 'python:3.11-slim-bookworm'


def k(*args, payload=None, expected=0):
 result = subprocess.run(base + list(args), input=json.dumps(payload) if payload is not None else None,
 capture_output=True, text=True, timeout=150)
 if expected is not None:
 assert result.returncode == expected, result.stderr
 return result


def obj(namespace, kind, name=None, selector=None):
 args = ['get', kind, '-n', namespace, '-o', 'json']
 if name:
 args.append(name)
 if selector:
 args += ['-l', selector]
 return json.loads(k(*args).stdout)


def apply(namespace, data):
 return k('apply', '-n', namespace, '-f', '-', payload=data)


def wait_for(read, ready, seconds=120):
 until = time.monotonic() + seconds
 while time.monotonic() < until:
 value = read()
 if ready(value):
 return value
 time.sleep(0.5)
 raise AssertionError('expected Kubernetes condition did not arrive')


def pod_ready(pod):
 return any(c['type'] == 'Ready' and c['status'] == 'True'
 for c in pod.get('status', {}).get('conditions', []))


def spec(script='import time; time.sleep(600)'):
 return {'automountServiceAccountToken': False, 'terminationGracePeriodSeconds': 1,
 'containers': [{'name': 'app', 'image': image, 'imagePullPolicy': 'IfNotPresent',
 'command': ['python3', '-c', script],
 'resources': {'requests': {'cpu': '10m', 'memory': '24Mi'},
 'limits': {'cpu': '200m', 'memory': '96Mi'}}}]}


def deployment(namespace, name, podspec):
 return apply(namespace, {'apiVersion': 'apps/v1', 'kind': 'Deployment', 'metadata': {'name': name},
 'spec': {'replicas': 1, 'selector': {'matchLabels': {'app': name}},
 'template': {'metadata': {'labels': {'app': name}}, 'spec': podspec}}})


def deployment_pod(namespace, name):
 wait_for(lambda: obj(namespace, 'deployment', name), lambda d:
 d.get('status', {}).get('observedGeneration', 0) >= d['metadata']['generation']
 and d.get('status', {}).get('updatedReplicas') == 1
 and d.get('status', {}).get('availableReplicas') == 1
 and d.get('status', {}).get('replicas') == 1)
 def pods():
 return [p for p in obj(namespace, 'pods', selector='app=' + name)['items']
 if not p['metadata'].get('deletionTimestamp')]
 return wait_for(pods, lambda p: len(p) == 1 and pod_ready(p[0]))[0]

namespace = 'notes-config-' + uuid4().hex[:8]
k('create', 'namespace', namespace)
try:
 for version, mode in [('v1', 'blue'), ('v2', 'green')]:
 apply(namespace, {'apiVersion': 'v1', 'kind': 'ConfigMap',
 'metadata': {'name': 'settings-' + version}, 'immutable': True, 'data': {'mode': mode}})
 podspec = spec()
 podspec['containers'][0]['env'] = [{'name': 'MODE', 'valueFrom':
 {'configMapKeyRef': {'name': 'settings-v1', 'key': 'mode'}}}]
 deployment(namespace, 'web', podspec)
 first = deployment_pod(namespace, 'web')
 def mode(pod):
 return k('exec', '-n', namespace, pod['metadata']['name'], '--', 'python3', '-c',
 'import os; print(os.environ["MODE"])').stdout.strip()
 assert mode(first) == 'blue'
 rejected = k('patch', 'configmap', 'settings-v1', '-n', namespace, '--type=merge',
 '-p', json.dumps({'data': {'mode': 'changed'}}), expected=None)
 assert rejected.returncode != 0 and 'immutable' in rejected.stderr
 assert obj(namespace, 'configmap', 'settings-v1')['data']['mode'] == 'blue'
 def select(version):
 patch = [{'op': 'replace',
 'path': '/spec/template/spec/containers/0/env/0/valueFrom/configMapKeyRef/name',
 'value': 'settings-' + version}]
 k('patch', 'deployment', 'web', '-n', namespace, '--type=json', '-p', json.dumps(patch))
 return deployment_pod(namespace, 'web')
 second = select('v2')
 assert mode(second) == 'green' and second['metadata']['uid'] != first['metadata']['uid']
 third = select('v1')
 assert mode(third) == 'blue' and third['metadata']['uid'] != second['metadata']['uid']
 image_ids = [p['status']['containerStatuses'][0]['imageID'] for p in (first, second, third)]
 assert len(set(image_ids)) == 1
 assert len({p['metadata']['uid'] for p in (first, second, third)}) == 3
 print(json.dumps({'modes': ['blue', 'green', 'blue'], 'distinct_pod_uids': 3,
 'same_image_id': image_ids[0], 'immutable_update_rejected': True,
 'retained_config_rollback_verified': True}))
finally:
 k('delete', 'namespace', namespace, '--wait=true', '--timeout=90s')

The script creates two immutable ConfigMaps and a single-replica Deployment referencing settings-v1. The first Pod reads blue from its environment. Attempting to overwrite that ConfigMap’s data is rejected, and reading the object confirms the original value remains blue. This checks actual server enforcement rather than just the manifest’s immutable field.

Next, a Pod-template patch selects settings-v2. After controller reconciliation and readiness, a different Pod reads green. Selecting the retained first version causes another replacement that reads blue again. The three Pod UIDs are distinct, while all three observed image identities match. All assertions passed, and the temporary namespace was removed.

This verifies configuration selection, replacement, and a retained-input rollback using a simple worker. It does not establish application compatibility, production availability during rollout, or rollback of external side effects. Carry the image, configuration version, workload definition, and observed application result together in the release evidence so each part of the change can be reviewed.

Sources

Kubernetes: ConfigMaps, non-confidential data, consumption and immutability, checked 2026-09-13.
Kubernetes: Deployments, Pod-template changes and rolling replacement, checked 2026-09-13.

EnvironmentFile supplies values when systemd executes a process

Fri, 19 Feb 2027 00:00:00 +0000

An environment file separates deployment values from the unit definition that describes process supervision. systemd reads the configured file before executing a service command and supplies those values in that process’s environment. Editing the file does not rewrite the environment of an already running process. A reload helper is another process, however, and can receive newer file values than the service’s existing main process.

When it breaks

daemon-reload tells the manager to reread unit definitions and rebuild its dependency information. reload requests the service’s configured reload operation, such as ExecReload. Neither command is a universal instruction to replace an existing process environment. A service may implement application-specific configuration reload, but that behavior must come from the application or its reload helper.

An EnvironmentFile path prefixed with a minus sign is optional. If it is missing, systemd ignores that absence without the warning an operator might expect. A typo can therefore silently remove an override. Use optional files only when their absence has a valid meaning; a required deployment input should not disappear behind that prefix.

The file is parsed by systemd, not sourced by a shell. Quoting and escape rules exist, but command substitution and variable expansion are not shell execution. A value containing $HOME remains that text. Files listed later override earlier values, and file assignments override Environment assignments. Inspect precedence rather than assuming the first visible definition wins.

Check it quickly

Run this Python script as an administrator in an isolated Linux environment with systemd as PID 1. It uses only harmless fixture settings and temporary paths. The recorded run used Debian 12 with systemd 252.39. Ensure the example runtime unit name is unused. The worker records only four selected test values, never a general environment dump:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,time

unit='xbcatm-environment-lab.service';unit_path=Path('/run/systemd/system')/unit
assert not unit_path.exists()
def ctl(*args,success=True):
 result=subprocess.run(['systemctl',*args],capture_output=True,text=True,timeout=10)
 assert (result.returncode==0)==success,(args,result.stderr)
 return result.stdout.strip()
def value(key):return ctl('show',unit,'-p',key,'--value')
def wait_for(check):
 deadline=time.monotonic()+5
 while not check():
 assert time.monotonic()<deadline,'state transition timed out'
 time.sleep(0.02)
with TemporaryDirectory(prefix='xbcatm-environment-',dir='/run') as directory:
 root=Path(directory);first=root/'required.env';second=root/'optional.env';worker=root/'worker.py'
 command=f'$(touch {root}/unexpected)'
 initial=f'MODE=first\nLITERAL=$HOME\nQUOTED="two words"\nCOMMAND={command}\n'
 first.write_text(initial);first.chmod(0o600);second.write_text('MODE=second\n')
 worker.write_text("""from pathlib import Path
import json,os,sys,time
root=Path(__file__).parent;name=sys.argv[1]
data={key:os.environ.get(key) for key in ('MODE','LITERAL','QUOTED','COMMAND')}
data['pid']=os.getpid()
tmp=root/(name+'.tmp');tmp.write_text(json.dumps(data));tmp.replace(root/(name+'.json'))
if name=='main': time.sleep(60)
""")
 unit_path.write_text(f'''[Service]
Type=exec
Environment=MODE=unit-default
EnvironmentFile={first}
EnvironmentFile=-{second}
ExecStart=/usr/bin/python3 {worker} main
ExecReload=/usr/bin/python3 {worker} reload
''')
 def read(name):return json.loads((root/(name+'.json')).read_text())
 try:
 subprocess.run(['systemd-analyze','verify',str(unit_path)],check=True)
 ctl('daemon-reload');ctl('start',unit)
 wait_for(lambda:(root/'main.json').exists())
 current=read('main');assert current['MODE']=='second'
 assert current['LITERAL']=='$HOME' and current['QUOTED']=='two words'
 assert current['COMMAND']==command and not (root/'unexpected').exists()
 assert 'MODE=unit-default' in value('Environment')
 print('ordered environment files override unit value; quoting works; shell text stays literal')
 second.write_text('MODE=third\n')
 ctl('daemon-reload');assert value('MainPID')==str(current['pid'])
 live=Path(f'/proc/{current["pid"]}/environ').read_bytes().split(b'\0')
 assert b'MODE=second' in live
 ctl('reload',unit)
 assert read('reload')['MODE']=='third' and read('main')==current
 assert value('MainPID')==str(current['pid'])
 live=Path(f'/proc/{current["pid"]}/environ').read_bytes().split(b'\0')
 assert b'MODE=second' in live
 print('reload helper receives new file value; existing main process retains old environment')
 second.write_text('MODE=fourth\n');ctl('restart',unit)
 wait_for(lambda:read('main')['pid']!=current['pid'])
 assert read('main')['MODE']=='fourth'
 print('restart reads changed environment file without another daemon-reload')
 first.unlink()
 subprocess.run(['systemd-analyze','verify',str(unit_path)],check=True)
 ctl('restart',unit,success=False)
 assert value('ActiveState')=='failed' and value('MainPID')=='0'
 print('missing required environment file prevents start')
 first.write_text(initial);first.chmod(0o600);second.unlink()
 ctl('reset-failed',unit);ctl('start',unit)
 wait_for(lambda:read('main')['MODE']=='first')
 print('missing optional file is ignored; required-file value remains')
 finally:
 ctl('stop',unit)
 if value('ActiveState')=='failed':ctl('reset-failed',unit)
 unit_path.unlink();ctl('daemon-reload')

The main process initially receives MODE=second: the optional second file overrides the required first file, which overrides the unit’s default. The quoted value becomes two words with a space. The variable-looking and command-looking values stay literal, and the file that a shell substitution would have created does not exist.

The manager’s Environment property still contains the unit’s default assignment. It is not a merged report of every value read from environment files. The worker’s selected observations provide the effective values for this fixture; the property identifies configured unit assignments. Confusing those views can lead an operator to diagnose the wrong setting.

After editing the file to a third value, daemon-reload leaves the main PID and its actual /proc environment unchanged. Running the reload helper gives that new helper the third value, while the original main process still contains the second. The code checks the specific harmless entry without printing the rest of the process environment.

The file is edited again to a fourth value, then the service is restarted without another manager reload. The replacement process receives the fourth value. This isolates fresh file reading at process execution from reloading unit definitions. It also shows why a successful reload helper does not alone prove that the main application adopted a replacement setting.

Removing the required file still permits static unit verification but makes the actual restart fail with no main PID. Restoring that file and removing the optional one allows startup with the first file’s value. Static validation, successful file loading, and application adoption are three separate checks.

Keep configuration visibility selective

Use environment files for suitable configuration, with ownership and permissions appropriate to the service. Sensitive values still become process environment values and may be inherited or exposed through diagnostics. The filename being outside version control does not establish a complete secret boundary. Use the platform’s supported credential-delivery mechanism when that better matches the secret’s requirements.

Document whether a change requires a new process, a supported application reload, or both. Change unit definitions through the appropriate override location and reload the manager when those definitions change. Editing only an existing environment file does not require that reload, but the intended consuming process must actually execute or otherwise implement an explicit refresh path.

Validate the resulting behavior or selected non-sensitive configuration, not a wholesale dump of environment variables into incident logs. Check the correct PID or invocation so a stale process observation is not mistaken for the replacement. Preserve enough information to identify which configuration version is active without turning troubleshooting into another disclosure channel.

Sources

systemd 252 execution environment, environment-file parsing, precedence, optional paths, and per-process loading, checked 2026-09-12.
systemd 252 systemctl, service reload versus daemon-reload and restart, checked 2026-09-12.
systemd 252 service commands, ExecStart and ExecReload lifecycle, checked 2026-09-12.