We Surveyed 4,112 Daemon Wranglers: The 2026 Stack Report Is In, and cron Refuses to Leave the House

Last month we asked Daemons Discuss readers one question: what's actually running on your production Linux boxes right now? Not what's in the vendor deck. Not what the conference talks promise. What's running.

4,112 of you responded, and the results read less like a clean technology migration and more like an archaeological dig with live ammunition.

The Old Guard Still Holds the Hill

Let's start with the legends. sshd runs on 98.7% of respondent machines, which is either reassuring or terrifying depending on how you feel about one binary being load-bearing for civilization. cron sits at 94.2%, and honestly, we're not surprised. Kubernetes schedulers have come and cron has stayed, like a landlord who's outlived four property management companies.

The full legacy holdout list:

• cron — 94.2%. Will outlive us all. Possibly already has.
• rsyslog/syslog-ng — 81.5%. journald was supposed to kill it. It did not.
• ntpd/chrony — 88.9%. Time waits for no one, but it does wait for chrony.
• Postfix — 63.4%. Every retirement announcement is followed by a new internal mail relay. Every single one.
• named (BIND) — 41.8%. The bet is that half of you are lying and it's actually 60.

One respondent from a Fortune 500 in Atlanta wrote in: "We have a BIND server that has been migrated four times. Nobody has ever restarted it. It may be load-bearing for the East Coast."

The Newcomers Are Eating Well

Now the part of the report that gets vendors excited. eBPF agents showed up on 71.3% of boxes, up from roughly half last year — and here's the war story angle: half of you discovered your eBPF agent the hard way, via a kernel panic during a routine deploy. As one reader from Seattle put it, "I didn't install observability. Observability installed a personality into my kernel."

Container sidecars are on 76.8% of respondents' hosts, and the sidecar count per pod has become a genuine source of workplace humor. Our data shows the median pod now ships with 3.2 sidecars, which means the average container is mostly chaperones.

Other notable climbers:

• systemd-resolved — 69.1%, still generating complaint mail at a rate we can only describe as renewable
• WireGuard — 58.4%, quietly making VPN war stories boring, which we resent
• Cilium/Envoy proxies — 44.7%, usually discovered by reading someone else's infrastructure

The Death Watch That Never Ends

Every year we list the daemons readers think are dying. Every year the data disagrees. rsyslog was declared dead in our 2023 survey. It gained share in 2026, mostly because "someone has to catch the output of the containers" remains the hardest problem in computing.

The most-cited "we're actively migrating off this" daemon? Postfix, at 22% of respondents. The percentage of those migrations actually completed by press time? We ran the number. It's 4%. We've seen this movie. The mail relay always wins.

Methodology, Disclaimers, and One Apology

Survey ran three weeks, self-selected respondents, skew heavily toward on-call engineers who answered between the hours of 1 and 4 a.m. local time, which may explain the tone of several free-text responses. We cleaned up most of them. Not all. One of you knows which one.

See you next year, when we find out whether cron finally left the house. (It won't.)