In Ubuntu Server, systemd-remount-fs.service is an early-boot initialization unit tasked with remounting the root filesystem (/) and other API filesystems according to the precise parameters defined in /etc/fstab. During the initial boot phase, the kernel typically mounts the root filesystem as read-only. This service intervenes shortly after, reading the configuration files and remounting the filesystem as read-write (or applying specific flags like noexec or nodev). While standard for conventional servers, this automated remounting behavior is entirely counterproductive—and potentially dangerous—in strictly managed, immutable architectures, live OS environments, or highly specialized containerized workloads where the initial kernel mount state must remain cryptographically static and untampered with by user-space initialization scripts.
This guide explains how to completely disable the systemd-remount-fs service in Ubuntu Server, ensuring absolute suppression of automated filesystem remount operations during the boot sequence.
Warning: Disabling this service means the root filesystem will remain in the state it was mounted by the kernel (usually read-only). If your server relies on a read-write root filesystem for normal operation, disabling this unit will cause critical boot failures and render the system unusable. Execute this only in specialized, immutable environments.
Stop and Mask the systemd-remount-fs Service
To guarantee that this service cannot execute and modify the filesystem mount namespace, we must disable and explicitly mask the unit file.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - First, stop the active service (though it primarily executes its tasks only during the boot sequence):
sudo systemctl stop systemd-remount-fs.service - Next, disable the service to remove it from the systemd boot schedule:
sudo systemctl disable systemd-remount-fs.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard block against it starting under any circumstances:sudo systemctl mask systemd-remount-fs.service
Verify the Service Lockdown
By masking systemd-remount-fs.service, you guarantee that systemd will completely ignore the unit, preventing any automated interactions with the kernel’s mount namespace during initialization.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-remount-fs.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-remount-fs.service: Unit systemd-remount-fs.service is masked). You have successfully neutralized the automated filesystem remounter, hardening your server’s runtime environment and ensuring compliance with strict, immutable infrastructure requirements.