OEM STACKIT: mask systemd-timesyncd

[robinschneider]

Mask systemd-timesyncd for OEM STACKIT

chronyd and systemd-timesyncd have race conditions, depending on the disk speed it can either chronyd or systemd-timesyncd that is running on the servers. After a reboot it is sytemd-timesyncd.
This is not intended, chronyd should always run on the servers.

I will create backport PRs once this is merged.

How to use

Create a VM using this guide https://www.flatcar.org/docs/latest/deploy/cloud/stackit/ or as part of STACKIT Kubernetes Engine 😉

Testing done

I have checked if systemd-timesynd was correctly masked

core@flatcar ~ $ systemctl status systemd-timesyncd
○ systemd-timesyncd.service
     Loaded: masked (Reason: Unit systemd-timesyncd.service is masked.)
     Active: inactive (dead)
core@flatcar ~ $ systemctl status chronyd
● chronyd.service - NTP client/server
     Loaded: loaded (/usr/lib/systemd/system/chronyd.service; disabled; preset: disabled)
    Drop-In: /usr/lib/systemd/system/chronyd.service.d
             └─00gentoo.conf
     Active: active (running) since Tue 2026-10-13 08:40:22 UTC; 6min ago
 Invocation: 505534efd66c4450b0084d1fd74a781a
       Docs: man:chronyd(8)
             man:chrony.conf(5)
   Main PID: 1395 (chronyd)
      Tasks: 1 (limit: 127661)
     Memory: 1.2M (peak: 4.7M)
        CPU: 137ms
     CGroup: /system.slice/chronyd.service
             └─1395 /usr/sbin/chronyd -n -u ntp -F 2

Oct 13 08:40:22 flatcar systemd[1]: Starting chronyd.service - NTP client/server...
Oct 13 08:40:22 flatcar chronyd[1395]: chronyd version 4.8 starting (+CMDMON +REFCLOCK +RTC +PRIVDROP +SCFILTER -SIGND +NTS +SECHASH +IPV6 -DEBUG)
Oct 13 08:40:22 flatcar chronyd[1395]: Loaded seccomp filter (level 2)
Oct 13 08:40:22 flatcar systemd[1]: Started chronyd.service - NTP client/server.
Oct 13 08:40:46 flatcar chronyd[1395]: Selected source PHC0
Oct 13 08:40:46 flatcar chronyd[1395]: System clock wrong by 1.042531 seconds
Oct 13 08:40:47 flatcar chronyd[1395]: System clock was stepped by 1.042531 seconds

@dergeberl has tested it extensively with all performance classes, including reboots.

• Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
• Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

/cc @dergeberl

[Copilot]

🟡 Changes recommended

The required user-facing bug-fix changelog entry is missing.

1 open finding

• Add required changelog entry for time synchronization behavior change · New

What changed in this PR

Masks systemd-timesyncd in STACKIT OEM images so chronyd runs reliably.

Changes:

• Adds an OEM filesystem-mangling script.
• Replaces the timesyncd unit with a /dev/null symlink.

File	Description
oem-stackit/​files/​manglefs.sh	Masks timesyncd in the STACKIT system extension.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The focused change follows the existing OEM sysext mechanism and matches the documented testing.

0 open findings

1 resolved since last review

• Add required changelog entry for time synchronization behavior change

🧠 Review effort: Balanced

[robinschneider]

The issue should also be present in the OEM Azure image, it is done the same way.

[t-lo]

LGTM, thanks for the fix. CC @chewi for the Azure OEM.