this post was submitted on 05 Jul 2024
65 points (94.5% liked)

Linux

48044 readers
770 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
65
Immutable distros recommindation? (lemmy.ml)
submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/[email protected]
59 comments fedilink hide all child comments
 

I was thinking about going immutable for a long time and now I'm choosing a distro to hop to.
My question is: what are good immutable distros other than Fedora Silverblue spins, UBlue family and NixOS?
Maybe someone uses/used any? What is/was your experience with it?

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 3 points 4 months ago* (last edited 4 months ago) (1 children)

Currently, the only projects I'd refer to as (remotely) GA are ChimeraOS, Endless OS, Fedora Atomic, Guix System, NixOS and their derivatives. The rest is, unfortunately, simply not there yet. The closest to these would be openSUSE Aeon. But, if you'd like FDE on your device, then you'd have to forego it for now. Currently, I would advice against relying on any other projects; including Arkane Linux, AshOS, blendOS, carbonOS, MocaccinoOS, Nitrux, openSUSE Kalpa, rlxos and Vanilla OS. Unless, you're fine dealing with whatever random and fringe issues you may have to face.

As for the previously mentioned GA 'immutable' distros, you don't like to pursue Fedora Atomic, NixOS and their derivatives for IMO fair reasons. ChimeraOS is primarily an OOTB console experience distro (aka couch gaming) that happens to be 'immutable'. Therefore, bending it (to become your distro for general use) will definitely be an involved process. But, it's possible. Likewise, Endless OS is somewhat locked down (beyond what you'd expect from your average 'immutable' distro) and has to be bend (at least slightly) in order for it to be more suitable as a daily driver.

This leaves us with Guix System. IMO, if you want to pursue this right now, then Guix System is simply the only remaining way of going forward. It's fit to suit whatever needs you'd have and offers access to official documentation that's at least a decade ahead of the one found for NixOS. However, don't expect this to be entirely painless; 'immutable' distros require (in general) a bit more know-how compared to traditional distros. And within the 'immutable distros', Guix System and NixOS are uniquely positioned for how 'powerful' they feel compare to (literally) any other distro. But, with great power comes great responsibility. Hence, you should definitely know your shit.

Finally, if FDE is not a hard requirement for you and if you can live with GNOME and if don't have qualms against containerizing everything and if you don't intend to tinker, then you might also consider openSUSE Aeon.

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago) (1 children)

Back when I was looking to switch distributions a year ago and it came to the choice between NixOS and Guix System, the latter unfortunately lost due to lack of features I considered essential for me. These were availability of proprietary packages (notably Steam, though I guess this could be rectified with a flatpak version or something), and no support for secure boot, which was the prime reason to switch in the first place, as I wanted to enable passwordless FDE unlock on boot for my machines (at least for the desktop, this should be secure because of fTPM).

Secure Boot is a bit of a more involved process with Lanzaboote, it's not just another "enable = true;", but at least after initial setup it just keeps on working.

I recently spun up another server for various uses, one being backups using restic. According to https://packages.guix.gnu.org/search/?query=restic, it's at 0.9.6 in their repos. NixPKGs has 0.16.5. 0.9.6 turns 5 years old this year.

The other services (yes, they are sketchy, but all GPL) aren't even in Guix at all. Yes, that's a network effect, but if switching the distribution forces me write half of it myself (exaggerating here) it's not suited for my case. The Nix ecosystem has issues but at least it enables me to build the system I want. Guix unfortunately is just another GNU project that's more focused on ideals than practical reality, which, given GNU's nature, is completely understandable and justified. But probably also the main reason for why in the real world, Nix is dominant in its niche while Guix System is a footnote.

[–] [email protected] 1 points 4 months ago (1 children)

Hi, I'm @[email protected] with another username.

I agree with your post. While, Guix System looks the best on paper (after Fedora Atomic and NixOS), it truly requires a lot of expertise from its user. So, if OP is not interested in learning Guix System and/or the Guile Scheme language for the sake of running their OS, then they should look for something else. Because, as you've noted, they might have no choice but to contribute by packaging some of the software they need for themselves.

Regarding Secure Boot, that's definitely a problem. However, not all distros support it OOTB. I might have dismissed it earlier because I consider FDE to be more important than Secure Boot. But I'm aware that this is not on technical merits.

IMO one should not dare to touch any 'immutable' distros besides Fedora Atomic and/or NixOS unless they know exactly what they're getting into and why they prefer it over Fedora Atomic and/or NixOS.

[–] [email protected] 1 points 4 months ago (1 children)

Regarding Secure Boot, that's definitely a problem. However, not all distros support it OOTB. I might have dismissed it earlier because I consider FDE to be more important than Secure Boot. But I'm aware that this is not on technical merits.

I'd consider FDE more important as well (apart from some fringe use cases). But it doesn't cover all possible attacks, as unlikely as some of them are. However, together they create a solution that is both convenient and sufficiently secure, as long as you can't just intercept the keys on the hardware.

FDE protects the confidentiality of your data in offline attacks, Secure Boot protects integrity and authenticity of binaries started by UEFI. These complement, they don't compete.

[–] [email protected] 1 points 4 months ago

After rereading my text, I came to the conclusion that I might have given of the impression that FDE and Secure Boot indeed compete with eachother. Which, as you've excellently noted, is not the case. Thank you for ensuring that others don't misunderstand this!

[–] [email protected] 10 points 4 months ago (2 children)

I’ve been using Opensuse Aeon just over a year and it’s done great.

Tumbleweed user for the last 5 years, and dealt with a few issues over that time. The usually infrequent update break that comes with rolling release. And the Opensuse ‘Patterns’ started, which I loathe and it’s a disaster to try to disable them every install.

Aeon hasn’t had any of those issues. It’s been very much a “turn it on and get to work”.

I’ve generally had less issues with Aeon than Tumbleweed - like certain flatpaks not crashing.

But downsides as I see them:

I’m not a gnome guy. It’s fine though, I don’t hate it. But some people can’t stand it.

I had a bit of trouble running wine. Something about the default security policy. There’s a known workaround.

[–] [email protected] 3 points 4 months ago (1 children)

If you don't like gnome have you checked kalpa?

[–] [email protected] 3 points 4 months ago

Kalpa needs to attract more developers to keep up with Aeon’s pace. I understand it is usable as a daily driver, but it’s not just a one to one mirror of Aeon with Plasma on top.

https://sfalken.tech/posts/2024-06-08-how-do-aeon-and-kalpa-relate/

Richard Brown is all in on Aeon along with whatever contributors are helping him. Stephen Falken appears to have no one helping him work on Kalpa unfortunately. I disagree with Richard’s stance that Kalpa shouldn’t exist, but I do wish there were some capable people able to help that project.

I don’t mind using Gnome anyway, it actually does solve some networking issues that I’ve always had with Plasma. (Dolphin not handling it well whilst Gnome Files has no issues)

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago)

Fedora Atomic is greag. uBlue is better ootb, but most of it can be simply achieved by layering some packages (rpm-fusion, enable auto updates through /etc/rpm-ostreed.conf).

NixOS is a whole nother beast and I'd only recommend it if you use standalone compositors (labwc, hyprland, sway, wayfire, river, ...), or want a declarative system.

Edit: Just read your comment about not liking Fedora. In that case I'd recommend OpenSUSE Tumbleweed. Other immutable distros are smaller and I don't have any experience with them. (IMO with atomic distros the distro doesn't matter much because apps are installed through flatpak or distrobox anyway.(

[–] [email protected] 1 points 4 months ago (1 children)

Fedora Silverblue, but OK, well, maybe openSUSE Aeon also.

[–] [email protected] 1 points 4 months ago (1 children)

I had rhe idea fedora atomic was so reliable, ,but I just updated a system and it broke... Reminded me of my manjaro times😑

[–] [email protected] 1 points 4 months ago (1 children)

How did it break, and what doesn't work any more?

I've been using Fedora Atomic on at least one device for years now, without any major issues (I.e. device no booting or updating. Upgrades do require some manual intervention).

[–] [email protected] 1 points 4 months ago (1 children)

I upgraded with rpm-ostree upgrade and then it doesnt boot. Some error with the kernel. Im sorry I dont have the info where I am, as it is not my computer. Good thing is I can still boot old image, its on grub.

[–] [email protected] 3 points 4 months ago

Opensuse Micro

[–] [email protected] 11 points 4 months ago (1 children)

Here's a resource I've been keeping in my back pocket for when I dive in:

https://github.com/castrojo/awesome-immutable

[–] [email protected] 1 points 4 months ago

Amazing, thank you!

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago)

Secureblue, GnomeOS (if you like updating daily), VanillaOS, AOSP, SteamOS, blendOS, and many more.

[–] [email protected] 3 points 4 months ago

There's also the Wayblue family of Wayland distros, based on Ublue.

It's hard to say for certain whether a distro will work for your hardware, even the Nvidia-specific images can have bugs related to the Nvidia drivers or their interaction with compositors.

I've used NixOS for a year.

I also tried Fedora Sway Atomic for a week or so. It mostly worked well, but I eventually found that it's really hard to use Nix for development on a graphics application, because linking with the system Vulkan drivers is near impossible. The loader used by Nix's glibc will ignore FHS locations. That seems to rule out a lot of the benefits of using Nix.

So I gave up on using Nix + Fedora as a failed experiment and went back to NixOS.

My wish list for Nix, Wayland, and Sway is pretty long. I kinda wish I had the time to make a new distro.

[–] [email protected] 15 points 4 months ago (2 children)

Please don't hurt me but what's an "immutable" distro?

[–] [email protected] 22 points 4 months ago (1 children)

It's a distro that makes all but a few system directories immutable. This means you can't just install whatever you want in the same way you would install in a traditional Linux system.

This comes with some benefits:

  • Malicious and buggy software can't permanently fuck up your installation. Even root can't edit those directories.
  • Each system update replaces only the system layer, but you can rollback to the previous one if something breaks.
  • You can rebase to other images (like going from Fedora Kinoite to UBlue Aurora) with a simple command, and you don't need to reinstall anything or worry about backing up your /home directory.
  • Most software is installed via flatpaks or appimages, keeping a layer of separation between your system and your applications.
  • Distroboxes/Podman containers can handle a lot of additional software while keeping it safely containerized.
  • The system is generally reproducible, so the core of what you have is the core of what everybody else has.

Some drawbacks:

  • You can't install whatever you want however you want. There are some hard limitations on where files are allowed to go, and installing certain software that interacts with the kernel can be tricky (I'm currently trying to figure out the best way to install my VPN provider's client).
  • There's a definite learning curve to working with containers. It's not always as simple as "create container, install thing."
  • There's a definite learning curve to retraining yourself to think in layers/containers.

Some examples of modern immutable distros are:

  • Fedora Silverblue
  • Fedora Kinoite
  • Universal Blue Aurora
  • Universal Blue Bluefin
  • Universal Blue Bazzite
  • NixOS
  • BlendOS
[–] [email protected] 3 points 4 months ago

Thank you for the detailed explanation!

[–] [email protected] 5 points 4 months ago (1 children)

As I understand it, it's read-only, so the updates you get are basically replacing your current ones but keeping your apps (like flatpaks) installed.

[–] [email protected] 3 points 4 months ago (1 children)

Gotcha, thank you!

[–] [email protected] 7 points 4 months ago (1 children)

I think about it like this:

Layer 2b: ->> User applications (flatpak, nixpkgs, etc.)

Layer 2a: ->> User data (mutable, persistent no matter what your system layer is)

Layer 1: -> System (immutable/read-only/updated "atomically" meaning all at once) 

Layer 0: Hardware

Or, alternately, it's what macos has been doing with absolutely no fanfare for several versions now. That's not a knock, btw. It's an illustration that it can be completely transparent in use, though it may require some habit changes on linux.

[–] [email protected] 1 points 4 months ago

I see, that makes sense. Thank you!

[–] [email protected] 5 points 4 months ago* (last edited 4 months ago)

Highly recommend Guix, been using it as my daily driver for years now.

System Crafters has a really nice series on getting it setup the way you want it. I think it's fixed a lot of stuff that is a little wonky with Nix -- proper separation of config-time things and build-time things with g-exps, no putzing with bash scripts, grafting so you can reuse builds even when dependencies get updated, and just general good documentation and hackable culture with a pretty active IRC. They've recently added support for also managing your dotfiles the same way you do packages and system config (Guix Home). They've also pushed the boundaries of bootstrappability/reproducible builds so far that bitcoin-core is now building on Guix for security.

The system is pretty well thought through, and has saved me a few times where I would've bricked my machine on a mutable distro -- now, I can just boot to a previous version of the system from the bootloader whenever my lastest changes are messed up.

[–] [email protected] 2 points 4 months ago (1 children)

There is blendOS which is an arch based immutable distro similar to Vanilla OS with different DE options

[–] [email protected] 6 points 4 months ago

Except the installer requires one specific repo mirror to be up, which can't be customized, which has been down for weeks and the dev isn't very interested in providing any fix or workaround so a lot of people literally can't install it.

It's a bad suggestion, it's a beta product not fit for end user consumption yet.

[–] [email protected] 6 points 4 months ago (1 children)

GNU Guix is the only other one I know about besides the ones you listed.

[–] [email protected] 5 points 4 months ago (3 children)

Guix is interesting, but I need to use proprietary Nvidia drivers to play games and it goes against Guix nature.

[–] [email protected] 1 points 4 months ago

While true, there is the nonguix repository that packages both the proprietary Nvidia driver and Steam. Otherwise, you're probably better off going back to regular distributions based on the others that you've ruled out thus far.

[–] [email protected] 4 points 4 months ago

@JustMarkov @OneRedFox it’s against GNU recommendations, but the nature of open source is about modifications, adaptations, improvements and sharing… and so there is the non-gnu channel.

[–] [email protected] 1 points 4 months ago* (last edited 4 months ago)

There's the non guix channel which can be added very easily to guix! :)

[–] [email protected] 17 points 4 months ago* (last edited 4 months ago) (1 children)

I'm surprised to hear you don't like Fedora. I recently tried Kinoite and I wish I'd discovered it sooner. I've never had a Linux distro that felt so detail-oriented and complete. I'd be curious to hear your reasoning!

[–] [email protected] 8 points 4 months ago* (last edited 4 months ago) (1 children)

It's complicated and I have a few reasons.

  1. Last time I used it, Fedora's updates were too unstable. I twice got updates breaking my system setup. For example, with openSUSE it happened only once (recent broken Mesa update). Also openSUSE updates surprisingly feel more stable than Fedora ones.
  2. I don't like Red Hat. Even though I understand that open-source projects are complex and I should separate developers from their software, that doesn't change my opinion on Red Hat.
  3. This problem stems from the previous ones. Using Fedora I feel like a beta-tester for future Red Hat projects and especially RHEL.

Keep in mind, that I last used Fedora on versions 37–38 and things might have changed since.

[–] [email protected] 4 points 4 months ago (1 children)

OP, I don't intend to convince you otherwise. I merely intend to share my own takes on this. So, without further a due.

  1. Last time I used it, Fedora's updates were too unstable. I twice got updates breaking my system setup.

So, first of all, you seem to think that Fedora's updates are equally "unstable" compared to those found on Fedora Atomic. But this is simply categorically wrong due to Fedora Atomic being (as it's name applies) an atomic distro. And hence has far superior updates (in terms of 'stability').

Secondly, I recall this period quite vividly, and I actually agree with you that Fedora's handling was a mess. And, unfortunately, this mess also affected Fedora Atomic. Thankfully, uBlue's team ensured that the issues were not felt on any of its images. So, even if, at times, issues spill over to Fedora Atomic, users of uBlue images will not have to face those. Heck, history has recorded that the uBlue images have consistently prevented those issues to spill over to its images. Thus, while this may (perhaps rightfully so) make one question if they should use Fedora Atomic or not; this, however, does not represent the situation over at uBlue images. Hence, one could rely on those without fearing issues related to 'stability'.

  1. I don't like Red Hat. Even though I understand that open-source projects are complex and I should separate decelopers from their software, that doesn't change my opinion on Red Hat.

Fair. What makes you hate Red Hat? I know often cited reasons for why people hate Red Hat. But what are your reasons*?

  1. This problem stems from the previous ones. Using Fedora I feel like a beta-tester for future Red Hat projects and especially RHEL.

Is this specifically a problem because you hate Red Hat? Because, quite frankly, the same somewhat applies to openSUSE and SLE. But this doesn't seem to bother you.

Keep in mind, that I last used Fedora on versions 37–38 and things might have changed since.

Excellent point. Since that 'double trouble', it has been relatively stable. However, I wouldn't be surprised if Fedora would act similarly if a new issue arises.

[–] [email protected] 2 points 4 months ago

With atomic, unstable updates aren't a problem. You can just run back to previous.

Atomic distros are so cool like that.

load more comments
view more: next ›