ostree VS ublue

Ansible makes mutable changes to the OS, task by task.

Nix is immutable. A new change is made entirely new, and only after the build is successful, all packages are "symlinked" to the current system.

Fedora Silverblue is based on ostree [1]. It works similarly like git, but on your root tree. But it requires you to reboot the whole system for the changes to take effect. Since Nix is just symlinked packages, you don't need to reboot the system.

More detailed explanation here [2].

[1]: https://github.com/ostreedev/ostree

[2]: https://dataswamp.org/~solene/2023-07-12-intro-to-immutable-...

This one is for the ostree bug currently ongoing: https://github.com/ostreedev/ostree/issues/2900

This sounds related to the ostree bug.

I definitely agree that immutability offers considerable value in regards to improving security. But arguably it's insufficient to pull the win over mutable Fedora due to the losses caused by the inability to install the kernel-hardened package and the lack of UKI (Unified Kernel Image) support.

Other hardening guides mention a Unified Kernel Image as another measure to further improve security. Unfortunately, once more, this is (currently) not supported on Fedora Silverblue. I haven't seen it being done on openSUSE Aeon either. Though, once again, I'd love to be corrected!

The fedora crew is working on it through ostree though, so both fedora Silverblue and flatpak will be getting it (as well as true immutability) in the future: https://github.com/ostreedev/ostree/issues/2867

Aside from what has already been mentioned, Unified Kernel Image isn't supported (yet).

I myself use Fedora Silverblue with a https://ublue.it/ -based custom image, and I use home-manager for shell configuration. Sure, my GNOME layout isn't declarative, but basically everything else is. Pair that with one of the best NVIDIA driver experiences and the strong feeling of stability, it's better than most other Linuxes rn.

Take a look at ublue.it

This is a fundamental misunderstanding of immutable systems. You still have full control over what’s on your computer, you just don’t exercise that control by making irreversible changes to your core system while it’s running. You can use e.g. rpm-ostree, or even better, build a custom image with exactly the changes you want that updates and ships directly to your computer whenever you want it to.

Have you considered the Sericea(Sway) immutable Fedora spin at ublue.it?

Have you considered the nvidia images at ublue.it? They make silverblue and nvidia easy.

Try the ublue images, they have one for deepin. It’s a variant on fedoras immutable silverblue image, you could either use their iso on http://ublue.it or install silverblue and rebase to the deepin image via:

ublue.it

This is indeed a blind spot. Thanks for pointing that out! Silverblue -to my knowledge- doesn't do a lot to address this. Though, 3rd-party tools like Home Manager and the suite of applications developed by the folks over at uBlue might be able to limit this to a minimum. Though I'm not sure if it surpasses NixOS in this regard; for the uninitiated. Though, to my knowledge, this requires special attention and depends on the specifics of the NixOS system in question.

This hasn't been for nought as even openSUSE's Aeon (and all their immutable offerings) ship Distrobox instead. Vanilla OS also ships Distrobox instead of Toolbx. Heck, even the folks over on uBlue\1]) always mention Toolbx with Distrobox and vice versa. And it wouldn't surprise me if most of them prefer to use Distrobox instead.