systemd rescue.target and emergency.target: entering them and getting back to normal

Goal

Boot into rescue or emergency mode to fix a system that fails to reach its normal target, then return to normal operation.

Prerequisites

Console access to add a kernel parameter at the boot menu. The root password: both shells run sulogin, which asks for it, and if the root account is locked (the Ubuntu default) the shell is refused unless sulogin runs with --force — plan for that before an outage, or use a rescue medium.

Steps

1. Know the difference, per systemd.special(7): rescue.target "pulls in the base system (including system mounts) and spawns a rescue shell" — most services are not started, but filesystems are mounted and basic infrastructure is up. emergency.target "starts an emergency shell on the main console" and "does not pull in other services or mounts" — it is the most minimal way to get a shell, comparable to init=/bin/sh but with a working service manager. systemd also enters it on its own when a required filesystem fails its check or cannot be mounted.
2. At the boot loader menu, edit the kernel command line for one boot and append systemd.unit=rescue.target or systemd.unit=emergency.target (the aliases single/1 select rescue mode, emergency selects emergency mode). This is a one-time change; nothing is written to disk.
3. Note that the root filesystem's mount state in emergency mode depends on how it was reached: it may already be read-only (for example if it booted with ro and failed before the stage that remounts it) or read-write if the transition happened after normal mounts were established. Check with mount | grep ' / ' before writing anything, and remount explicitly if needed: mount -o remount,rw /.
4. Do the repair (edit a broken /etc/fstab line, fix a service that fails at boot, correct an /etc/default/grub mistake). A forgotten root password cannot be reset this way, because entering needs it; on dracut-based systems rd.break instead stops in the initramfs before switching root, with the real root at /sysroot read-only: mount -o remount,rw /sysroot, chroot /sysroot, passwd root, and on SELinux systems touch /.autorelabel before leaving, or the next boot can reject logins.
5. Return to normal by rebooting (systemctl reboot, without the systemd.unit= parameter this time) or, from rescue mode without rebooting, systemctl default (also spelled systemctl isolate default.target) to bring up the rest of the system in the current session.
6. Verify: systemctl get-default reports the configured default target, and systemctl list-units --failed should be empty (or contain only expected entries) after returning to it.

Expected result

The system reaches a working single-user or emergency shell even when the normal boot cannot complete, and returns cleanly to default.target once the fix is in place.

Limits and test basis

Both targets are reached the same way (systemd.unit=); confusing which one you asked for is a common mistake — rescue gives you mounted filesystems and basic services, emergency does not. A systemd.unit= change at the boot menu never persists past that one boot; a persistent change belongs in the boot loader configuration, not here.