SYSTEMD-IMDS-GENERATOR(8)

💖 systemd-imds-generator(8) 💖

okay bestie, pull up a chair, we're talking about systemd-imds-generator — a generator that turns IMDS (Instance Metadata Service) on at boot for the systems that can actually do it. She's a little systemd system-generator living her best life in /usr/lib/systemd/system-generators/, and she's about to tell you exactly what she does. 🦋

---

✨ SYNOPSIS ✨

/usr/lib/systemd/system-generators/systemd-imds-generator

---

🌸 DESCRIPTION 🌸

So systemd-imds-generator is a generator that enables IMDS (Instance Metadata Service) functionality at boot on systems that support it. That's the vibe. And she does three specific things, no more no less:

• She pulls the systemd-imdsd.socket unit (which activates systemd-imdsd@.service(8)) into the initial transaction. What that gets you: IMDS access for local applications, delivered via Varlink IPC. ✨
• She pulls the systemd-imds-early-network.service unit into the initial transaction, which generates a suitable systemd.network(5) network configuration file. That file is what allows early-boot network access to the IMDS functionality. 🔥
• She pulls the systemd-imds-import.service unit into the initial transaction, which automatically imports various credentials from IMDS into the local system, storing them in /run/credstore/. 💖

By default, whether to pull in these services or not is decided based on hwdb(7) information, which detects various IMDS environments automatically. (She just knows, iykyk.) But — plot twist — this logic may be overridden via systemd.imds=, see below. 👑

systemd-imds-generator implements systemd.generator(7).

---

🎀 KERNEL COMMAND LINE 🎀

She understands the following kernel command line parameters, and yes, you type them in exactly like this:

• systemd.imds= — Takes a boolean argument or the special value "auto", and may be used to enable or disable the IMDS logic. Quick note though, bestie: this controls only whether the relevant services (as listed above) are automatically pulled into the initial transaction — it has no effect if some other unit or the user explicitly activates the relevant units. If this option is not used (or set to "auto"), automatic detection of IMDS is used, see above. ✨

Added in version 261.

• systemd.imds.network= — Takes one of "off", "locked", "unlocked". Controls whether and how to set up networking for IMDS endpoint access. Unless set to "off", early boot networking is enabled, ensuring that the IMDS endpoint can be reached. If set to "locked", direct access to the IMDS endpoint by regular unprivileged processes is disabled via a "prohibit" route, so that any access must be done through systemd-imdsd@.service or its associated tools. If set to "unlocked" (the default), this "prohibit" route is not created, and regular unprivileged processes can directly contact IMDS. 💅

Added in version 261.

• systemd.imds.import= — Takes a boolean argument. If false, the systemd-imds-import.service (see above) is not pulled into the initial transaction, i.e. no credentials are imported from IMDS. Defaults to true in the initrd, and false otherwise. 🫶

Added in version 261.

---

🌈 SEE ALSO 🌈

systemd(1), systemd-imds(1), systemd-imdsd@.service(8), systemd.system-credentials(7)

---

and that's the whole page, bestie, no cap 💀💖 this one's from systemd 262.1, so go forth and let the generator do her thing — she ate, periodt. 🎀✨