systemd Socket Activation

Socket activation is a systemd mechanism (inspired by classic inetd) where systemd itself creates and listens on a service's network socket, and starts the actual daemon only when the first connection arrives. The socket is then handed to the daemon via file descriptor passing. A socket-activated service is defined by a pair of units: a `.socket` unit (declaring `ListenStream=`/`ListenDatagram=` addresses) and a matching `.service` unit. Enabling the `.socket` unit — not the `.service` — is what makes the service available. Benefits: rarely-used services consume no resources until needed; boot parallelizes aggressively because clients can connect to the socket before the daemon behind it is fully up (systemd buffers the connection); and a daemon can restart without dropping pending connections. The classic operational trap: **the listening port lives in the socket unit, not in the daemon's own config file.** If a service is socket-activated, editing the daemon's native config (e.g. `Port` in sshd_config) does nothing — systemd still listens where the `.socket` unit says. Ubuntu ships OpenSSH socket-activated by default since 22.10 (see Hardening SSH on Ubuntu). Either override the socket with `systemctl edit ssh.socket`, or disable socket activation entirely (`systemctl disable --now ssh.socket`) so the daemon binds its own port. Inspect socket units with `systemctl list-sockets` and `systemctl cat name.socket`. Background: socket activation was a headline feature of systemd from its 2010 debut (Lennart Poettering and Kay Sievers at Red Hat, introduced in the essay "Rethinking PID 1"), generalizing the on-demand model of inetd and macOS launchd. Ubuntu's stated motivation for switching OpenSSH to it in 22.10 was memory: an idle sshd costs roughly 3 MB, a meaningful saving across fleets of small VMs and LXD containers.