systemd Restart=always considered harmful (sometimes)

Restart=always feels safe until the config file is broken and the unit crashes thirty times a second for a week without anyone noticing — except the disk filling up with logs.

[Service]
Restart=on-failure
RestartSec=5s
StartLimitIntervalSec=300
StartLimitBurst=5

With a start limit in place, a genuinely broken service trips into a failed state instead of flapping forever, and my monitoring notices that. Fail loudly, not noisily.

Tags: systemd, ops