OSS + ELC EU 2026

Designing immutable filesystems is becoming the default for embedded Linux development: they're more secure, easier to reason about, and resilient to field drift. But they make a once-easy thing surprisingly awkward: a one-line fix to a single script means shipping a whole new rootfs and rebooting the device.
systemd-sysext addresses half this problem by merging extension images onto /usr/ at runtime, with integrity enforced via dm-verity. But sysext is the activation mechanism only — it says nothing about how those signed images reach a fleet of devices in the first place.
This talk walks through a working proof-of-concept that closes the gap: a verity-signed sysext image, delivered over the air through a standard OTA framework, merged live onto a read-only Ubuntu rootfs, with health checks and automatic rollback on failure — all without a single reboot.
This talk covers the architecture end to end, the non-obvious operational gotchas, and an honest accounting of what this approach does and doesn't replace.