rpm-ostree VS awesome-immutable

I definitely agree that immutability offers considerable value in regards to improving security. But arguably it's insufficient to pull the win over mutable Fedora due to the losses caused by the inability to install the kernel-hardened package and the lack of UKI (Unified Kernel Image) support.

Issue: https://github.com/coreos/rpm-ostree/issues/3944

Oversimplifying might have been the most sensible in this context. However, you might have gone a little bit too far as your description fits only NixOS, Guix and distros that utilize rpm-ostree.

here's the documentation of ostree (the package manager)

Now... this was VERY alarming to say the least, so I went online and did indeed find an issue on GitHub.

And there are still some issues with layering. Some packages that don't behave or follow standards will modify files in /usr/local, which isn't supported, so you simply won't be able to install them on Silverblue. I think it's the same for /opt as well. (https://github.com/coreos/rpm-ostree/issues/233) This means it fundamentally can't do everything Workstation can, which is unfortunate.

ublue is based off of fedora and rpm-ostree, which is what "CoreOS" is today.

What happened was old school CoreOS was A/B partition based: https://github.com/coreos/docs/blob/master/os/sdk-disk-parti...

My memory is hazy but here's how I remember it: After Red Hat acquired CoreOS they rebased the entire thing around rpm-ostree, which is the CoreOS people know today: https://coreos.github.io/rpm-ostree/

At the time there was some anxiety in the community as to what would happen, as there was no direct upgrade path from old CoreOS to new CoreOS. Theoretically if we all believed the kool-aid we were drinking it's just a redeploy, no pets!

Kinvolk came along, forked it, and made Flatcar Linux, which kept the A/B partitioning system, and more crucially, let you just change a config file and all your old CoreOS nodes would just move to Flatcar and then you were good to go. So now if you wanted to stay on the system you were comfortable with you could just use Flatcar. If the composability of rpm-ostree attracted you then new CoreOS have you covered. Red Hat deserves a hat tip here because in their documentation/blog they explicitly mentioned Flatcar as an option for people who wanted to stick with what they know, which I thought was cool and how I discovered it!

Later on Microsoft acquired Kinvolk and and then people raised eyebrows. I have not checked in a while but the folks involved continued to do their thing and run it like a good OSS project, hold public meetings, all that stuff.

I use both and they're both high quality.

Whenever I was looking at using CoreOS, I was somewhat disheartened that automatic reboots weren't built in: https://github.com/coreos/rpm-ostree/issues/2831. Has this changed? I know zincati has maintenance window support, which would also be nice to have.

Doesn't look like it https://github.com/coreos/rpm-ostree/issues/1091

Interesting article!

My takeaways:

>"The current solutions involve packaging entire alternate runtimes in containerized environments. Flatpak, Snap, AppImage, Docker, and Steam: these all provide an app packaging mechanism that replaces most or all of the system’s runtime libraries, and they now all use containerization to accomplish this."

[...]

>"All of these technologies are essentially building

an entire OS on top of another OS

just to avoid the challenges of backwards compatibility."

This is basically using containers to replace all system libraries -- to insure that a downloaded binary app always works.

From this point forward, we'll use the term "API" to represent not just Linux kernel syscalls, but the totality of all library calls (system and otherwise!) used by a given downloaded binary application!

Observation: API (in-)consistency (AKA "Stability") one Linux version to another, one Linux distro to another -- is the real problem!

That's the real cause!

Because everything else, everything else, is effect, not cause!

The containerization, the bloated "everything but the kitchen sink" downloads, are the effect of the problem of API (in-)consistency!

Phrased a simpler way -- there is absolutely NO guarantee of consistency between the libraries, system and otherwise, of any two Linux distros!

So if a binary app is to run on all Linux distros -- then it had better damn well better make sure that the exact specific version of all of the libraries that it needs -- are managed by it, not the host operating system!

Containers and bloated library downloads -- are (unfortunately) currently necessary to provide this!

Related:

"Linux Library Mismatch":

https://www.google.com/search?q=linux+library+mismatch

"DLL Hell" (the MS-Windows equivalent)

https://en.wikipedia.org/wiki/DLL_Hell

Software Engineering: Bertrand Meyer, "Design By Contract":

https://en.wikipedia.org/wiki/Design_by_contract

API Contracts: "What is an API Contract?":

https://www.youtube.com/watch?v=-qM__ozdHCU

Eelcho Dolstra: "The Purely Functional Software Deployment Model":

https://edolstra.github.io/pubs/phd-thesis.pdf#page=11

Image-based Linux distributions and associated tools:

https://github.com/castrojo/awesome-immutable

Spencer Baugh: "Managing Dependencies":

https://catern.com/posts/deps.html

If you're simply in search of other immutable distros, then I would recommend you to look under the "Distributions" section on this page.

The answer to that question is out of scope for what is sensible to write in a comment. Also, because we're mostly still exploring what it is or rather what we'd want it to be. But if you're really interested, then I'd suggest you to dive into this wonderful resource. You don't have to go through everything that's found within. However, I'm sure there's something in there that peaks your interest and you can go from there.

Flatcar uses 2 partitions, A and B, you boot into one and then updates update the one that you're not booted into, when you reboot it it boots into the updated one. It's like Android: https://source.android.com/docs/core/ota/ab

I maintain an awesome-list of immutable resources here with a collection of talks and presentations from the people making the stuff: https://github.com/castrojo/awesome-immutable

However I'm currently focused on desktop stuff since the it's a fairly common pattern in cloud already, I should probably write it up.

Semi-related, a few of us have started a community around composable OCI fedora images, and one of our images is intended to be used as a home server built on CoreOS with ZFS, cockpit, and all the goodies you'd need. It's still fresh and we're looking for help if anyone's interested: https://github.com/ublue-os/ucore (Disclaimer: I helped start this project)

Some interesting links: https://github.com/castrojo/awesome-immutable

Found this page for you. It has lots of resources, including videos and guides, about all things Silverblue and other immutable Linux distros, and their tooling. Enjoy.

Note, I haven't tried these two distros myself, but I am strongly considering moving to such a system at the moment. Here is some reading material in case you're interested: https://github.com/castrojo/awesome-immutable