In Ubuntu Server, systemd-update-done.service is an initialization unit specifically designed to execute during the boot process if the system detects that an offline system update (or a major OS upgrade) has recently occurred. Its primary function is to update the modification timestamps (mtime and ctime) of the /etc and /var directories. By touching these directories, systemd signals to other services and caching mechanisms that the system configuration has changed, prompting them to invalidate their caches and reload configurations. While useful in generic, dynamic environments where packages are frequently upgraded, this automated timestamp manipulation is entirely unacceptable in strictly managed, immutable architectures. In zero-trust, containerized, or read-only environments, the filesystem state must remain cryptographically static, and automated cache invalidation triggers must be explicitly suppressed.
This guide explains how to completely disable the systemd-update-done service in Ubuntu Server, ensuring absolute suppression of automated filesystem timestamp modifications during the boot sequence.
Warning: Disabling this service means that if you perform a system update, services relying on the /etc or /var timestamps to invalidate their caches may fail to recognize the update, potentially causing configuration desynchronization. Execute this only in specialized, immutable environments where updates are deployed via full image replacement.
Stop and Mask the systemd-update-done Service
To guarantee that this service cannot execute and modify the filesystem metadata, we must disable and explicitly mask the unit file.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - First, stop the active service (though it primarily executes its tasks only during the boot sequence):
sudo systemctl stop systemd-update-done.service - Next, disable the service to remove it from the systemd boot schedule:
sudo systemctl disable systemd-update-done.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard block against it starting under any circumstances:sudo systemctl mask systemd-update-done.service
Verify the Service Lockdown
By masking systemd-update-done.service, you guarantee that systemd will completely ignore the unit, preventing any automated interactions with the filesystem metadata during initialization.
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-update-done.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-update-done.service: Unit systemd-update-done.service is masked). You have successfully neutralized the automated timestamp modifier, hardening your server’s runtime environment and ensuring compliance with strict, immutable infrastructure requirements.