Make a systemd service start on demand via socket activation (Accept=no, sd_listen_fds)

Documented steps

1. Create the socket unit /etc/systemd/system/myapp.socket: [Unit] Description=myapp socket [Socket] ListenStream=127.0.0.1:8080 [Install] WantedBy=sockets.target ListenStream forms: a bare number = IPv6 port, `1.2.3.4:80` = IPv4, `[::1]:80` = IPv6, `/run/myapp.sock` = AF_UNIX path, `@name` = abstract socket.
2. By default (Accept=no) the socket activates the service with the same stem: myapp.service. One service instance receives the listening socket itself.
3. In myapp.service, do NOT bind the port yourself; accept the fd from systemd. The protocol: env LISTEN_PID must equal your PID, LISTEN_FDS gives the count, fds start at 3 (SD_LISTEN_FDS_START), LISTEN_FDNAMES optionally names them. Libraries: sd_listen_fds(3) in C, sd-listen crates for Rust, systemd.daemon for Python, `activation` packages for Go/Node.
4. Many servers support this natively: pass the socket in config (e.g. gunicorn detects LISTEN_FDS; nginx does not — use a proxy or native binding).
5. Enable only the socket: `systemctl enable --now myapp.socket`. The service stays inactive until the first connection; systemd queues connections during service startup, so no requests are lost.
6. Test: `curl 127.0.0.1:8080` then `systemctl status myapp.service` shows it was activated. `systemctl stop myapp.service` leaves the socket listening; the next connection re-activates — this gives zero-downtime restarts and crash resilience.
7. Add a matching StopWhenUnneeded or idle-exit logic in the app if you want scale-to-zero; systemd itself does not stop the service on idle.