Stop Rebuilding Images for Every Config Change: Practical systemd-confext for Portable /etc Overlays

If your base OS image is supposed to stay stable, config drift becomes annoying fast.

You tweak a unit drop-in, change a tmpfiles rule, add a sysctl file, or adjust journald settings, and suddenly you are choosing between three awkward options:

rebuild the whole image,

mutate /etc in place and hope you can track it later,

bolt on a one-off config management path just for a small policy change.

systemd-confext gives you another option.

It lets you ship a version-checked, read-only overlay for /etc , then merge or unmerge it at runtime. In practice, that means you can package configuration as a portable layer, apply it without rebuilding the full OS image, and roll it back by removing the layer.

This post is intentionally not about systemd-sysext for /usr . I covered that separately.…