In Ubuntu Server and other systemd-based Linux distributions, systemd-repart.service is an early-boot initialization daemon designed to declaratively grow, format, and populate disk partitions based on configuration files located in /etc/repart.d/. It is primarily used during the first boot of OS images to automatically expand the root partition to fill the available block device, ensuring the OS utilizes the entire disk. While essential for dynamic cloud deployments and OS installers, this service introduces a significant security and stability liability in immutable infrastructure environments, heavily provisioned storage arrays, or systems with strictly defined, cryptographically signed partition tables (like dm-verity or secure boot setups). In these environments, allowing an early-boot daemon the administrative authority to dynamically rewrite the partition table is a massive risk.
This guide explains how to completely disable the systemd-repart service in Ubuntu Server, enforcing an absolute block on automated disk partitioning and ensuring the system’s block device structure remains strictly static.
Stop and Mask the systemd-repart Service
Because systemd-repart operates incredibly early in the boot sequence (often inside the initramfs before the root filesystem is even fully mounted) and is integrated into the sysinit.target, a simple systemctl disable is fundamentally insufficient. To guarantee the init system is physically prevented from executing this partitioning daemon under any circumstances, we must explicitly mask the unit.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Stop the service to clear any active processes (though it generally only runs and exits during early boot):
sudo systemctl stop systemd-repart.service - For absolute certainty, explicitly mask the service unit. This symlinks the unit file to
/dev/null, creating a hard cryptographic block against it being invoked dynamically during the startup sequence:sudo systemctl mask systemd-repart.service - Optional but recommended: If your system utilizes an initramfs, you must update it to ensure the masked state is respected during the earliest phases of boot before the root filesystem pivots:
sudo update-initramfs -u
Verify the Service Lockdown
By masking the service, you guarantee that systemd will completely bypass local automated disk partitioning, securing the storage layout against unauthorized expansion.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-repart.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-repart.service: Unit systemd-repart.service is masked). Furthermore, running systemctl status systemd-repart.service will show the service state as masked, confirming the neutralization of the early-boot partitioning daemon.