AArch64 systemd service startup and kernel module loading order

Answer

For an AArch64 systemd unit that relies on networking primitives (veth, bridge, ip_tables, nf_conntrack, etc.), you must declare the required kernel modules explicitly. Systemd does not automatically modprobe modules before ExecStart unless the module is already loaded by another service or present in the initramfs. Relying on implicit loading can cause unpredictable failures on boards with minimal kernel configurations.

Why Implicit Loading Is Unreliable

• Many AArch64 kernels ship without optional networking modules compiled as built‑in or as loadable modules.
• Board‑specific Device Tree blobs may exclude modules needed for container networking.
• Initramfs images on some distributions omit these modules to keep the early boot image small.
• systemd only loads a module if it appears as a dependency of a unit that has already started.

When to Declare Dependencies

1. Container networking services (e.g., docker.service, systemd-networkd, cni‑plugins) that create veth pairs or bridges.
2. Firewall or packet‑filter services that need ip_tables or nf_conntrack.
3. Any service that performs ip link add type veth or brctl addbr during startup.

How to Declare the Dependencies

Add an ExecStartPre line that runs modprobe for each required module, or use the RequiresMountsFor style with a modprobe@.service template. Example unit snippet:

[Unit]
Description=Container network starter
After=network.target

[Service]
Type=oneshot
ExecStartPre=/sbin/modprobe veth
ExecStartPre=/sbin/modprobe bridge
ExecStartPre=/sbin/modprobe nf_conntrack
ExecStart=/usr/bin/your‑network‑setup
RemainAfterExit=yes

Alternatively, create a dedicated service for module loading:

[Unit]
Description=Load networking modules
[Service]
Type=oneshot
ExecStart=/sbin/modprobe veth
ExecStart=/sbin/modprobe bridge
ExecStart=/sbin/modprobe nf_conntrack
RemainAfterExit=yes

Then add Requires=network‑modules.service to the unit that needs them.

Kernel Configuration Checks

Verify that the kernel build exposes the modules you need:

grep CONFIG_BRIDGE /boot/config-$(uname -r)
# Expected output: CONFIG_BRIDGE=m or CONFIG_BRIDGE=y

If the option is n, rebuild the kernel or install a package that includes the module.

Verification Steps After Deployment

1. journalctl -u <your‑service> --since=now – look for “modprobe: FATAL: Module … not found” messages.
2. lsmod | grep -E 'veth|bridge|nf_conntrack' – confirm modules are loaded.
3. Run a quick network test: ip link add test type veth peer name test-peer – should succeed without root‑kit errors.

Missing Diagnostic Detail

To fine‑tune the ExecStartPre list, please confirm which specific networking features your service uses (e.g., bridge creation, packet filtering). This will help determine the exact module set required.