2.0 -//Pentabarf//Schedule//EN PUBLISH E8V7HN@@cfp.all-systems-go.io -E8V7HN Opening Session of All Systems Go! 2026 en en 20260930T092500 20260930T093000 0.00500

Opening Session of All Systems Go! 2026

PUBLIC CONFIRMED Lightning talk https://cfp.all-systems-go.io/all-systems-go-2026/talk/E8V7HN/ Loft PUBLISH NLRDPH@@cfp.all-systems-go.io -NLRDPH Provisioning and Deployment Mechanisms in systemd en en 20260930T093000 20260930T101000 0.04000

Provisioning and Deployment Mechanisms in systemd

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/NLRDPH/ Loft Lennart Poettering PUBLISH BBJYFH@@cfp.all-systems-go.io -BBJYFH Modernising Updates and Provisioning with sysupdate en en 20260930T101500 20260930T104000 0.02500

Modernising Updates and Provisioning with sysupdate

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/BBJYFH/ Loft Aleksa Sarai PUBLISH SD3X9L@@cfp.all-systems-go.io -SD3X9L Proposal for TPM2+FIDO2 enrollment in systemd en en 20260930T104500 20260930T111000 0.02500

Proposal for TPM2+FIDO2 enrollment in systemd

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/SD3X9L/ Loft Alberto Planas Dominguez PUBLISH BTLLGC@@cfp.all-systems-go.io -BTLLGC systemd: state of the project en en 20260930T112500 20260930T115000 0.02500

systemd: state of the project

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/BTLLGC/ Loft Luca Boccassi Zbigniew Jędrzejewski-Szmek PUBLISH RN9E3E@@cfp.all-systems-go.io -RN9E3E systemd: round table en en 20260930T115500 20260930T122000 0.02500

systemd: round table

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/RN9E3E/ Loft Luca Boccassi Zbigniew Jędrzejewski-Szmek Yu Watanabe Lennart Poettering Mike Yuan Daan De Meyer PUBLISH QDB7AL@@cfp.all-systems-go.io -QDB7AL Measured Boot in NixOS & Other systemd Updates en en 20260930T122500 20260930T125000 0.02500

Measured Boot in NixOS & Other systemd Updates

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/QDB7AL/ Loft Niklas Sturm PUBLISH SBUXXA@@cfp.all-systems-go.io -SBUXXA A unified OS installer in systemd en en 20260930T142000 20260930T150000 0.04000

A unified OS installer in systemd

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/SBUXXA/ Loft Julian Sparber PUBLISH XU9CJR@@cfp.all-systems-go.io -XU9CJR single-file containers with statically linked systemd en en 20260930T150500 20260930T153000 0.02500

single-file containers with statically linked systemd

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/XU9CJR/ Loft Zbigniew Jędrzejewski-Szmek PUBLISH BWWVCN@@cfp.all-systems-go.io -BWWVCN systemd & OCI en en 20260930T153500 20260930T160000 0.02500

systemd & OCI

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/BWWVCN/ Loft Lennart Poettering PUBLISH N93KWW@@cfp.all-systems-go.io -N93KWW Modernizing local storage management for systemd services en en 20260930T161500 20260930T165500 0.04000

Modernizing local storage management for systemd services

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/N93KWW/ Loft Andres Beltran PUBLISH RMC879@@cfp.all-systems-go.io -RMC879 An update on systemd-sysext/confext en en 20260930T170000 20260930T170500 0.00500

An update on systemd-sysext/confext

systemd-sysext/confext: https://www.freedesktop.org/software/systemd/man/devel/systemd-sysext.html bootctl: https://www.freedesktop.org/software/systemd/man/devel/bootctl.html PUBLIC CONFIRMED Lightning talk https://cfp.all-systems-go.io/all-systems-go-2026/talk/RMC879/ Loft Kai Lüke PUBLISH K9GPKV@@cfp.all-systems-go.io -K9GPKV Couple Services, Not the Host: Portable Services and Capsules en en 20260930T170500 20260930T171000 0.00500

Couple Services, Not the Host: Portable Services and Capsules

PUBLIC CONFIRMED Lightning talk https://cfp.all-systems-go.io/all-systems-go-2026/talk/K9GPKV/ Loft Rodrigo Campos Catelin PUBLISH XHJX3N@@cfp.all-systems-go.io -XHJX3N From fsync to Block I/O: Tracing Storage with eBPF en en 20260930T171000 20260930T171500 0.00500

From fsync to Block I/O: Tracing Storage with eBPF

Follow a single write from syscall to block layer with eBPF, measuring honest per-layer latency at each handoff and attributing storage stalls to the service that caused them. PUBLIC CONFIRMED Lightning talk https://cfp.all-systems-go.io/all-systems-go-2026/talk/XHJX3N/ Loft Kritik Sachdeva PUBLISH TL3KGN@@cfp.all-systems-go.io -TL3KGN Rethinking systemd-homed's Key Hierarchy en en 20260930T171500 20260930T172000 0.00500

Rethinking systemd-homed's Key Hierarchy

PUBLIC CONFIRMED Lightning talk https://cfp.all-systems-go.io/all-systems-go-2026/talk/TL3KGN/ Loft Dhanuka Warusadura PUBLISH VLBXZ8@@cfp.all-systems-go.io -VLBXZ8 The state of systemd sandboxing in Debian en en 20260930T172000 20260930T172500 0.00500

The state of systemd sandboxing in Debian

PUBLIC CONFIRMED Lightning talk https://cfp.all-systems-go.io/all-systems-go-2026/talk/VLBXZ8/ Loft Marco d'Itri PUBLISH 8XRBTA@@cfp.all-systems-go.io -8XRBTA attezt: device attestation, PKCS11 and ACME en en 20260930T101500 20260930T104000 0.02500

attezt: device attestation, PKCS11 and ACME

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/8XRBTA/ Galerie Morten Linderud PUBLISH WUH9WS@@cfp.all-systems-go.io -WUH9WS Micromize: Enforcing Container Semantics with eBPF LSM en en 20260930T104500 20260930T111000 0.02500

Micromize: Enforcing Container Semantics with eBPF LSM

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/WUH9WS/ Galerie Dor Serero PUBLISH VLKVKW@@cfp.all-systems-go.io -VLKVKW Image Based Modular Deployment for Large Teams in Embedded Systems en en 20260930T112500 20260930T115000 0.02500

Image Based Modular Deployment for Large Teams in Embedded Systems

The talk will cover: * Applying image based Linux principles at the application module level, not just the OS * Packaging modules as (mostly) reproducible, read only ext4 images with deterministic tooling * How image based module packaging enables per-module automated testing: deploying test harnesses as modules themselves, composing versioned module sets for deterministic integration testing, and unlocking independent CI/CD pipelines per team * Why deb/rpm, Flatpak, and AppImage each fail for independently deployable A/B modules * Delta-based OTA delivery that exploits immutable images for chunk-level diffing * systemd transient services as a module lifecycle manager: all the benefits of systemd, none of the rootfs side effects * Per-module sandboxing, cgroup isolation, and gRPC-only IPC * Lessons from production: independently updating 40+ modules without device reboot PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/VLKVKW/ Galerie Corin Rypkema Mike Sandige Gopal Paudel PUBLISH HNUWBK@@cfp.all-systems-go.io -HNUWBK Moonforge: Making Yocto Easy To Assemble en en 20260930T115500 20260930T122000 0.02500

Moonforge: Making Yocto Easy To Assemble

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/HNUWBK/ Galerie Emmanuele Bassi Martín Abente Lahaye PUBLISH R8XMRT@@cfp.all-systems-go.io -R8XMRT Do Users Actually Want a Trusted, Immutable OS? Lessons from the Industry en en 20260930T122500 20260930T125000 0.02500

Do Users Actually Want a Trusted, Immutable OS? Lessons from the Industry

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/R8XMRT/ Galerie Katie Miller PUBLISH E7MHZJ@@cfp.all-systems-go.io -E7MHZJ Containers without a new runtime: sdme on systemd-nspawn en en 20260930T142000 20260930T150000 0.04000

Containers without a new runtime: sdme on systemd-nspawn

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/E7MHZJ/ Galerie Alexandre Fiori PUBLISH PXBVLE@@cfp.all-systems-go.io -PXBVLE Forget "podman generate systemd": How Quadlet Really Works en en 20260930T150500 20260930T153000 0.02500

Forget "podman generate systemd": How Quadlet Really Works

Quadlet isn't magic—it's a systemd generator. Watch a three-line .container file expand into a full service unit, and learn to dump, debug, and reason about what really gets generated. PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/PXBVLE/ Galerie Kritik Sachdeva PUBLISH KJNYQ8@@cfp.all-systems-go.io -KJNYQ8 Immutable, Fully-Confined Debian Server Images, Even on a Raspberry Pi 3 en en 20260930T153500 20260930T160000 0.02500

Immutable, Fully-Confined Debian Server Images, Even on a Raspberry Pi 3

This talk walks through a prototype: a minimal, hardened Debian server built with `mkosi` and `apparmor.d`. It composes three layers of systemd and Debian tooling that are well understood alone but rarely combined, each reinforcing the others: - **Image-based OS:** `mkosi` magic. - **Whole-system MAC:** AppArmor policies that confine every process on the system. It also brings: - Multi-layered policy loading, fixing the AppArmor load-time issues that hurt small devices. - Immutable security policies. - Compatibility with systemd sysext/confext. - **Immutable `/etc`:** assembled from signed `systemd-confext` images, closing immutability's usual escape hatch. The same image targets both an x86-64 server and a Raspberry Pi 3 (UEFI), and that contrast is where it gets interesting. The two share a single build but diverge on attacker model and security guarantees: what an embedded device with no Secure Boot can promise versus a server, and where the implementation has to bend. We walk those differences, the limitations, and what would have to land upstream to make this kind of image easier. PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/KJNYQ8/ Galerie Alexandre Pujol PUBLISH BEDGKF@@cfp.all-systems-go.io -BEDGKF Make Debian Immutable with mkosi and Nix en en 20260930T161500 20260930T165500 0.04000

Make Debian Immutable with mkosi and Nix

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/BEDGKF/ Galerie Frank Vasquez PUBLISH RZ3PUB@@cfp.all-systems-go.io -RZ3PUB An API for systemd Machines en en 20261001T100000 20261001T104000 0.04000

An API for systemd Machines

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/RZ3PUB/ Loft Lennart Poettering PUBLISH 3RTJNA@@cfp.all-systems-go.io -3RTJNA Native OS enrollment for the Linux userspace: A proposal for open APIs and protocols en en 20261001T104500 20261001T111000 0.02500

Native OS enrollment for the Linux userspace: A proposal for open APIs and protocols

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/3RTJNA/ Loft Ryan Lahfa (@raitobezarius) PUBLISH J8GNND@@cfp.all-systems-go.io -J8GNND Seamless Upgrades with KHO, LUO, and systemd en en 20261001T112500 20261001T120500 0.04000

Seamless Upgrades with KHO, LUO, and systemd

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/J8GNND/ Loft Mike Rapoport PUBLISH XFZKN8@@cfp.all-systems-go.io -XFZKN8 systemd: reducing impact of servicing interruptions on restart/reboot en en 20261001T121000 20261001T123500 0.02500

systemd: reducing impact of servicing interruptions on restart/reboot

systemd v260 and v261 added two features which aim to let service owners minimize downtime. Firstly, when services use dm-verity images, profiling data showed that the largest bottleneck by far was loading the new images, which used to happen after the running service had already stopped during a unit restart. Since v260, when very specific conditions are met, this bottleneck has been removed from the critical path. Secondly, a common issue causing slowdowns for services is having to serialize and deserialize large amount of state from slow disks after a reboot due to an OS update. Since v261, systemd supports the kernel's Live Update Orchestration, and uses it to persist the content of the FD Store across a kexec reboot. Services can use a memfd for their runtime state, hand it over the systemd when they are stopped/restarted, and they will get it back and can mmap it and use it straight away on restart. With LUO support, services can rely on this even across a kexec, removing the need to use serialize and deserialize state to disk. This talk will explore both features, explaining how they work and how they can be used. PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/XFZKN8/ Loft Luca Boccassi PUBLISH ER3SSR@@cfp.all-systems-go.io -ER3SSR Building IncusOS en en 20261001T140500 20261001T144500 0.04000

Building IncusOS

[Incus](https://linuxcontainers.org/incus/) is a modern container and virtual machine manager with native support for both system and application containers as well as virtual machines. It's designed to behave just like a private cloud, but one that you can run on your laptop or Raspberry Pi as well as on clusters of hundreds or thousands of servers. It's got support for a wide variety of local and remote storage options as well as both software defined and traditional networking. It has built-in clustering allowing for hundreds of servers to act as one with a consistent API and distributed database providing high availability and automated recovery. Incus is widely available through packages in most Linux distributions with IncusOS providing another method of deployment particularly targeted to those who don't want to have to manage yet another Linux system or those who want to perform large scale deployments with known identical systems. IncusOS can be deployed and managed at scale through [Operations Center](https://github.com/futurfusion/operations-center), allowing for hundreds of clusters to be deployed, updated and tracked in one place. Incus, IncusOS, Operations Center and generally everything related to Incus is Open Source and released under the Apache 2.0 license. PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/ER3SSR/ Loft Stéphane Graber PUBLISH WDRTYW@@cfp.all-systems-go.io -WDRTYW Bridging the (varlink) gap en en 20261001T145000 20261001T151500 0.02500

Bridging the (varlink) gap

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/WDRTYW/ Loft Michael Vogt PUBLISH FKWEC8@@cfp.all-systems-go.io -FKWEC8 Varlink observability en en 20261001T152000 20261001T154500 0.02500

Varlink observability

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/FKWEC8/ Loft Sebastian Wick PUBLISH CG9K7H@@cfp.all-systems-go.io -CG9K7H Making NoNewPrivs the default en en 20261001T160000 20261001T162500 0.02500

Making NoNewPrivs the default

Running systems with “NoNewPrivs” by default is already possible without issues for many use cases, but there are still some cases where it doesn't work. As followup to last year's presentation “Accessing shadow records via varlink” this session provides an up-to-date status report on the progress made and the issues that remain. PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/CG9K7H/ Loft Thorsten Kukuk PUBLISH J9TM7X@@cfp.all-systems-go.io -J9TM7X Managing the new mount api en en 20261001T163000 20261001T165500 0.02500

Managing the new mount api

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/J9TM7X/ Loft Christian Brauner PUBLISH 8SCGQC@@cfp.all-systems-go.io -8SCGQC Don't mount this! en en 20261001T170000 20261001T172500 0.02500

Don't mount this!

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/8SCGQC/ Loft Christian Brauner PUBLISH G8MFDJ@@cfp.all-systems-go.io -G8MFDJ Closing session of All Systems Go! 2026 en en 20261001T172500 20261001T173000 0.00500

Closing session of All Systems Go! 2026

PUBLIC CONFIRMED Lightning talk https://cfp.all-systems-go.io/all-systems-go-2026/talk/G8MFDJ/ Loft PUBLISH VXGVJF@@cfp.all-systems-go.io -VXGVJF KDE Linux Under the Hood en en 20261001T104500 20261001T111000 0.02500

KDE Linux Under the Hood

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/VXGVJF/ Galerie Harald Sitter PUBLISH VNXPQS@@cfp.all-systems-go.io -VNXPQS Running mutable OS images on Confidential VMs: is there any hope? en en 20261001T112500 20261001T120500 0.04000

Running mutable OS images on Confidential VMs: is there any hope?

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/VNXPQS/ Galerie Vitaly Kuznetsov Simran Paul Singh PUBLISH TKKLMZ@@cfp.all-systems-go.io -TKKLMZ Disk encryption using attestation for Confidential VMs en en 20261001T121000 20261001T123500 0.02500

Disk encryption using attestation for Confidential VMs

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/TKKLMZ/ Galerie Matias Vara Larsen PUBLISH DUNFF9@@cfp.all-systems-go.io -DUNFF9 Building image-based operating system images with BuildStream and mkosi en en 20261001T140500 20261001T144500 0.04000

Building image-based operating system images with BuildStream and mkosi

PUBLIC CONFIRMED 35 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/DUNFF9/ Galerie Abderrahim Kitouni PUBLISH E7L8GD@@cfp.all-systems-go.io -E7L8GD Delivering the OS via OCI images: Btrfs snapshots, delta updates and 3-way merges en en 20261001T145000 20261001T151500 0.02500

Delivering the OS via OCI images: Btrfs snapshots, delta updates and 3-way merges

The transition to image-based, immutable Linux systems fundamentally changes OS management, but it also introduces complex network and storage challenges that are often abstracted away. This session explores the architecture and technical workflows required to provision and upgrade an OS using OCI images, advanced compression, and copy-on-write filesystems. The foundation of this approach relies on mapping OCI images directly to btrfs snapshots. OCI image layers are pulled, unpacked, and directly applied as immutable btrfs snapshots, forming the read-only root volume of the system while maintaining distinct writable areas for persistent state. To eliminate the network bottleneck of pulling full OCI layers for minor patches, we will detail efficient delta updates with zstd-chunked OCI images. The OS agent identifies and downloads only the specific files that have changed between the current running image and the target image. We will explain the mechanics of using HTTP range requests to extract these payloads and write them directly into the target btrfs snapshot on the fly, drastically reducing update times and bandwidth consumption without requiring full local extraction. Finally, an immutable OS still requires localized configuration (e.g., in /etc), creating a challenge when the base OS image is updated. We will explore how to solve this using a 3-way merge strategy. In particular we will see how snapper is utilized to navigate btrfs snapshot trees and isolate the precise differences between the original base image, the user's localized state, and the incoming update. Having a clear picture of the differences in multiple directions allows us to define an algorithmic approach to safely merging these three states. PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/E7L8GD/ Galerie David Cassany Dirk Müller PUBLISH WSNAQL@@cfp.all-systems-go.io -WSNAQL OSPool and thin volumes: Storage for Image-based systems en en 20261001T152000 20261001T154500 0.02500

OSPool and thin volumes: Storage for Image-based systems

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/WSNAQL/ Galerie Ada Magicat PUBLISH YSR3PP@@cfp.all-systems-go.io -YSR3PP Hold My Beer, I'm Building 100 Images at Once en en 20261001T160000 20261001T162500 0.02500

Hold My Beer, I'm Building 100 Images at Once

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/YSR3PP/ Galerie Daan De Meyer PUBLISH R7BEEK@@cfp.all-systems-go.io -R7BEEK Ten Years Building Container Networking: Lessons Learned and What the Future Might Look Like en en 20261001T163000 20261001T165500 0.02500

Ten Years Building Container Networking: Lessons Learned and What the Future Might Look Like

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/R7BEEK/ Galerie Martynas Pumputis PUBLISH TTFUPB@@cfp.all-systems-go.io -TTFUPB Kmod — teaching old dog new tricks en en 20261001T170000 20261001T172500 0.02500

Kmod — teaching old dog new tricks

PUBLIC CONFIRMED 20 min talk + 5 min Q&A https://cfp.all-systems-go.io/all-systems-go-2026/talk/TTFUPB/ Galerie Emil Velikov