Your country

Tools that support it use your country for local currency, number formats, units and paper size. Your choice is saved only in this browser.

Type a name or a two-letter code. Use the up and down arrow keys to move through the countries, Enter to choose one and Escape to close.

systemd Service and Timer File Generator

A commented .service and .timer, cron converted to OnCalendar, and units explained.

Free preview, no sign-upIncluded in your pass Pro tool Pro pass: ₹179 for 30 days No upload Works offline Developer

Try before you buy.

  • Free preview: the first lines of the unit files and install commands (up to 20), every count, and the first findings, run times and explained settings (up to 10).
  • Locked until you unlock it: download and copy.
  • Unlock: Pro pass, ₹179 for 30 days, a one-time payment that never renews.

Ways to unlock shows how to get the full result.

See passes (opens in a new tab)

Printing this result is locked in the free preview.

Service

The file is called name.service.

An absolute path, or a program name that systemd finds in /usr/local/bin, /usr/bin or their sbin folders, then its arguments.

exec: a long-running program, and the start fails if it cannot run; simple: started as soon as it is forked.

On failure: after a crash, an error exit or a timeout. On abnormal exit: after a crash or a timeout only.

Environment
Start and dependencies
Logging
Schedule (a timer instead of cron)

minute hour day-of-month month day-of-week, or @daily, @weekly…

Hardening
  • The service and its children can never gain privileges through setuid or setgid programs or file capabilities — systemd calls it the simplest and most effective way to stop privilege escalation.

    Can break: Services that call sudo, su or other setuid helpers.

  • The service gets its own /tmp and /var/tmp, removed when it stops, so other programs cannot read or plant its temporary files.

    Can break: Sharing files with other programs through /tmp.

  • /usr, the boot loader directories and /etc are read-only for the service (strict: the whole file system, except the paths you allow).

    Can break: A service that writes into /etc or /usr (rare; with strict, any path not listed in ReadWritePaths= or a StateDirectory=).

  • The service sees only pseudo devices such as /dev/null and /dev/random, no disks, memory or ports.

    Can break: Access to hardware: serial ports, GPUs, USB devices.

  • Kernel settings under /proc/sys and /sys are read-only.

    Can break: Services that change kernel settings at run time.

  • The service cannot load or unload kernel modules.

    Can break: Services that need extra kernel modules or special file systems.

  • The service cannot read or write the kernel log buffer.

    Can break: Log collectors that read the kernel log.

  • The control-group hierarchy in /sys/fs/cgroup is read-only.

    Can break: Container runtimes and resource managers.

  • The service cannot change the system or hardware clock.

    Can break: Time synchronisation daemons.

  • The service cannot change the host name.

    Can break: Programs that set the host name.

  • The service cannot create setuid or setgid files.

    Can break: Installers that create setuid programs.

  • The service cannot use realtime scheduling, which could lock up the machine.

    Can break: Audio servers and other realtime programs.

  • The service cannot create Linux namespaces.

    Can break: Sandboxes, container tools and browsers that create namespaces.

  • Locks the execution domain (personality), whose rarely used emulations have had security holes.

    Can break: Almost nothing.

  • Only native system calls are allowed, closing the 32-bit compatibility interfaces on 64-bit systems.

    Can break: 32-bit programs on a 64-bit system.

  • /home, /root and /run/user are empty and inaccessible for the service.

    Can break: A service whose files or working directory are under /home (use ProtectHome=read-only, or move it to /srv or /opt).

  • Only Unix, IPv4 and IPv6 sockets can be opened.

    Can break: Programs that use netlink (network management), Bluetooth or packet sockets.

  • Allows only the system calls a typical service needs (the @system-service group); any other kills the process.

    Can break: Programs that use unusual system calls; check the journal for SECCOMP events.

  • Drops every Linux capability, even for root.

    Can break: Listening on ports below 1024 (add CAP_NET_BIND_SERVICE), changing file ownership and other privileged operations.

  • Processes of other users are hidden in /proc.

    Can break: Monitoring tools that inspect other processes.

  • /proc shows only process information, not the kernel interfaces.

    Can break: Programs that read /proc/meminfo, /proc/cpuinfo or similar.

  • Files the service creates are readable only by its user.

    Can break: Files that other users or services must read.

  • Memory cannot be writable and executable at the same time, which makes code injection harder.

    Can break: Every program with a JIT compiler: Node.js, Java, .NET, PHP with JIT, LuaJIT — leave it off for them.

Next steps Done. What next?

All developer tools

About the systemd Service and Timer File Generator

Fill in how your app or script runs — the command, working directory, user and group, restart policy, environment and environment file, the network dependency and where the logs go — and get a systemd .service file with a comment on every choice, ready for /etc/systemd/system/ (or ~/.config/systemd/user/ for a user service).

To replace a cron job, paste its schedule: the page writes a .timer unit, converts the cron expression to OnCalendar= (two lines when cron’s “either day” rule needs it), and lists the next run times, checked against what cron itself would do. You can also write a calendar event yourself — Mon..Fri *-*-* 07:30, *-*~01 for the last day of the month — and see its normalized form, as systemd-analyze calendar prints it.

Hardening settings are explained one by one — what NoNewPrivileges=, ProtectSystem=, PrivateTmp= and the others protect, and what each can break — with a recommended set and a strict one. The install commands (daemon-reload, enable --now, journalctl -u) are listed for copying. Paste an existing unit to have every setting explained and checked: relative paths, shell syntax in ExecStart=, a missing Wants=network-online.target, settings in the wrong section and deprecated ones.

Without a pass the result is a free preview: the first lines of the files and commands, every count and the first findings. Everything, the copies and the downloads unlock with a Pro pass.

How to use it

  1. Under Create a unit, give the service a name and the command that starts it. Choose Load example for a web app or a nightly backup to start from a filled-in form.
  2. Set the user, the working directory, the restart policy, the environment and the logging. Tick Needs the network for a program that connects to anything when it starts.
  3. For a job on a schedule, open Schedule: paste a cron expression such as 30 2 * * 1-5, or write an OnCalendar= event, and check the next run times.
  4. Pick a hardening set or tick the settings one by one; the explanation under each says what it protects and what it can break.
  5. With a pass, or once this result is unlocked, copy or download the .service and .timer files and copy the install commands; the preview shows their first lines. To check a unit you already have, use Explain a unit.

Examples

A cron job as a timer
Input
30 2 * * 1-5   (02:30 on weekdays)
Result
OnCalendar=Mon..Fri *-*-* 02:30:00
Persistent=true
AccuracySec=1s

Persistent=true runs a job missed while the machine was off; without AccuracySec= a timer may elapse up to a minute late.

Cron’s “either day” rule
Input
0 12 1 * 1   (noon on the 1st and on every Monday)
Result
OnCalendar=Mon *-*-* 12:00:00
OnCalendar=*-*-01 12:00:00

A calendar event needs the weekday and the date to match together, so the schedule takes two lines.

Shell syntax in ExecStart
Input
ExecStart=./worker.sh | tee /var/log/worker.log
Result
ExecStart=/bin/sh -c "/opt/worker/worker.sh | tee /var/log/worker.log"

systemd runs the program directly: a pipe is passed as an argument, and the command must start with an absolute path or a bare program name.

Where the rules come from

The settings and their explanations follow the freedesktop.org manual pages: systemd.service(5), systemd.unit(5), systemd.exec(5), systemd.timer(5) and systemd.time(7). The calendar-event parser reproduces the normalized forms of the systemd.time(7) table, and cron conversions were checked against an independent cron implementation, run after run. Run systemd-analyze verify on the file before you rely on it.

Why network-online.target

network.target is reached once networking is being set up, not when it works. A program that must reach a database or an API when it starts should order itself after network-online.target and pull it in — After= alone only orders, Wants= makes systemd actually wait for the network (systemd.special(7)).

Limitations

  • The files are written from the form; the page does not run systemd. Check them with systemd-analyze verify and systemd-analyze security.
  • Next run times assume the server’s clock is in the time zone you choose (UTC by default). A time that a daylight-saving change skips does not elapse that day, as in systemd (cron runs such a job right after the change); for the hour that repeats when the clocks go back, the page shows the first run only.
  • Explaining a unit covers the common [Unit], [Service], [Install] and [Timer] settings; others are listed without an explanation.

Privacy

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.

Frequently asked questions

What do I get without a pass?

Without a pass, systemd Service and Timer File Generator shows the first lines of the unit files and install commands (up to 20), every count, and the first findings, run times and explained settings (up to 10). Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.

Should the service run as root?

Rarely. Create a system user (sudo useradd --system --no-create-home myapp) and set User= and Group=, or use DynamicUser=yes for a service that keeps its data in StateDirectory=. A service that must listen on a port below 1024 can use AmbientCapabilities=CAP_NET_BIND_SERVICE instead of root.

What is the difference between Type=simple and Type=exec?

With simple, systemd counts the service as started as soon as it forks the process, so a wrong path still looks like a successful start. With exec, the start only succeeds once the program has actually been executed, which makes mistakes show up in systemctl start.

Do I still need cron?

Timers can replace cron jobs: they log to the journal, can catch up on runs missed while the machine was off (Persistent=true), run with the hardening of the service, and systemctl list-timers shows when they elapse next.

Is anything uploaded?

No. The files are written in your browser, and units you paste to explain stay there.

Quick answers and tool search

Type to search tools or to get a quick answer, for example 18% of 2500. Use the up and down arrow keys to move through the results, Enter to choose, and Escape to close.