What is the difference between systemctl disable and systemctl mask?

Systemd and its services can be in several states, such as enabled, disabled, failed, running. If you no longer need a particular service to run, then the first step is to stop a service.

systemctl stop nginx.service

But stopping a service is not the same as disabling a service. With that comes a very frequently asked question: what is the difference between a service that is disabled and one that is masked?

Difference disable and mask

When using disable to disabling a service, the underlying symlinks are removed. These symlinks normally activate the service during the boot process. Disabling a service sounds like it is not allowed to run, but it still may be activated if it is a dependency of another service.

Using mask will actually create a symlink pointing to /dev/null. This will making it no longer possible to start the service, until the moment that the unmask subcommand is used.

So the differences between disable and mask is that the latter is the most forceful way of disabling a unit.