sdctl

sdctl is a security-focused ratatui TUI application for managing systemd services on Linux. It prioritizes the principle of least privilege, allowing users to browse services in an unprivileged state and providing an embedded authentication flow for privileged operations.

Features

• Security First: All privileged actions are authenticated using polkit. Never requires sudo.
• Unified Unit Management: Seamlessly browse and control both System (global) and User (session) units from a single interface.
• Enhanced Filtering: Powerful multi-category filters (Type, Scope, Active, Enablement, Load).
• Service Dashboard: Efficiently list and discover units with case-insensitive sorting and high-performance client-side fuzzy search.
• Log Viewer: Integrated journalctl browser with automatic syntax highlighting provided by tailspin, and both line-wise and line-block select modes.
• Unit File Viewer: View unit configurations directly with syntax highlighting. Supports creating drop-in overrides or editing the full unit file via your $EDITOR.
• Vim-style Navigation: Global keyboard shortcuts for intuitive scrolling, paging, and search cursor movement.

Quick filter toggle

Unit file view

Line block select mode in log view

Line select mode in log view

Why another TUI for managing systemd services?

This tool is not the first of its kind. I have been using systemctl-tui and systemd-manager-tui extensively to the point that I forgot how to use systemctl from the command line. However those tools share one major limitation: they require sudo for privileged operations. In today’s supply-chain threat landscape, that is a serious risk because a TUI app depends on many components, and any compromised dependency could become a full-privilege attack vector.

This is why I built sdctl with a completely different security model: the app itself should never be run with sudo, and no action ever asks for blanket root access. When you perform any action that requires escalated privileges, the app opens an embedded polkit flow that authenticates only the specific systemctl action you are trying to perform, using whatever mechanism is available on the system, such as password, fingerprint reader, or smart card. That keeps the privilege boundary explicit and tied to a single operation instead of the whole process.

Keybindings

Global

• q: Quit application
• Esc: Return to unit list / Cancel authentication / Close filter menu
• j / k or Up / Down: Navigate up/down
• gg / G: Jump to top/bottom
• Ctrl+u / Ctrl+d: Scroll half-page up/down
• Ctrl+b / Ctrl+f: Scroll full-page up/down

Unit List

• /: Enter fuzzy search mode
• y / p / a / n / o: Open Type, Scope, Active, Enablement, or Load filter menus
• Ctrl+r: Reset all filters
• s / t / r / R: Start, stop, restart, or reload the selected unit
• e / d / m / u: Enable, disable, mask, or unmask the selected unit
• Enter / l: View journal logs
• f: View unit file
• Y: Copy unit file path

Log Viewer

• /: Enter search mode
• n / N: Jump to next / previous search match
• v: Toggle line select mode
• V: Toggle line block select mode
• Space (select mode): Mark / unmark the current line
• y / Enter (select mode): Copy selected lines to clipboard
• Ctrl+r: Refresh logs
• e: Open the log buffer in $EDITOR

Unit File Viewer

• /: Enter search mode
• n / N: Jump to next / previous search match
• e: Create/Edit drop-in override (override.conf)
• E: Edit full unit file (replaces unit fragment)

Tech Stack

• UI Framework: ratatui
• Asynchronous Runtime: tokio
• D-Bus Communication: zbus
• Privilege Escalation: pkttyagent managed via portable-pty
• Highlighting: tailspin
• Fuzzy Matching: nucleo

Prerequisites

• systemd
• polkit
• (Optional) terminal text editor: nano, vim, emacs, or vi
• (Optional) system clipboard tool: wl-copy (Wayland) or xclip (X11)

Installation

Cargo

cargo install sdctl

AUR (Arch Linux)

# Using your favorite AUR helper, such as yay or paru
yay -S sdctl

Binary

Download the latest pre-compiled binary from the Releases page.

chmod +x sdctl
sudo mv sdctl /usr/local/bin/

From Nix (Flakes)

Run directly:

nix run github:ruiiiijiiiiang/sdctl-top

Contribution

PR's and issues are welcome. AI usage is okay as long as you know what you are doing and the code is maintainable.

License

MIT