How to Completely Disable the ‘systemd-machined’ Service in Ubuntu Server

In Ubuntu Server environments, systemd-machined.service is a systemd daemon that provides an API for registering and tracking virtual machines and lightweight containers (such as those managed by systemd-nspawn or LXC/LXD). It integrates these isolated environments into the host’s systemd ecosystem, allowing tools like machinectl to interact with them seamlessly. However, if your Ubuntu Server is functioning strictly as a bare-metal application host (e.g., a dedicated database server or a monolithic web host) and you are not utilizing any form of virtualization or containerization, this daemon is completely unnecessary. Disabling it reduces the system’s attack surface and eliminates a background process that consumes a small amount of memory.

This guide explains how to completely disable the systemd-machined.service in Ubuntu Server, ensuring the system no longer tracks or manages virtual machine contexts.

Stop and Mask the systemd-machined Service

Because systemd services often rely on socket activation or D-Bus activation, we must disable the service unit and explicitly mask it to prevent any other dependent process from attempting to wake it up.

1. Log into your Ubuntu Server via SSH using an account with sudo privileges.
2. First, stop the service immediately if it is currently running:

   sudo systemctl stop systemd-machined.service

3. Next, disable it to prevent it from starting automatically on boot:

   sudo systemctl disable systemd-machined.service

4. Finally, to guarantee that systemd completely ignores the unit and prevents activation via D-Bus or other administrative tools (like machinectl), mask it entirely:

   sudo systemctl mask systemd-machined.service

Verify the Service Lockdown

By masking the service, you have instructed systemd to symlink the unit file to /dev/null, effectively removing the machine registration capability from the operating system stack.

To verify the lockdown is successful, run the following command to check the status of the service:

systemctl status systemd-machined.service

The output will clearly state that the service is masked. Additionally, if you attempt to execute machinectl list, the command will fail and return an error stating “Could not connect to machine manager” (or similar), confirming that the daemon is completely dead and the API is no longer accessible on the host.