11 ms·

What is Silverblue?

303 points by anuragsoni 7y ago

Vogtinator 7y ago
Also look at openSUSE MicroOS, which provides the same core idea (transactional root fs), but with some key advantages like not using rpm-ostree and instead using plain RPMs.
okasaki 7y ago
This seems poorly motivated. > What are the benefits of an immutable OS? > One of the main benefits is security. The base operating system is mounted as read-only, and thus cannot be modified by malicious software. The only way to alter the system is through the rpm-ostree utility. How is this different from the current experience? "Operating system" files already aren't writable by the user. The only way to alter the system is through the "sudo" utility. > Another benefit is robustness. It’s nearly impossible for a regular user to get the OS to the state when it doesn’t boot or doesn’t work properly after accidentally or unintentionally removing some system library. Try to think about these kind of experiences from your past, and imagine how Silverblue could help you there. How often does this happen? I've worked with complete Linux noobies who were "forced" to use Linux in a VM daily and I've never seen this happen.
- Barrin92 7y ago
  >The only way to alter the system is through the "sudo" utility. The sudo utility doesn't really give any guarantees or produces reproducible states. You can mess around with sudo however you like.rpm-ostree transactions are completely reversible. Silverblue is the equivalent of an accountant having a transparent history of your machine states. Sudo is like grabbing a pencil, a rubber, and a spraycan and gowing to town.
- mhxion 7y ago
  > How often does this happen? I've worked with complete Linux noobies who were "forced" to use Linux in a VM daily and I've never seen this happen. Depends on the noob, and just because you never met a situation like that doesn't mean nobody else experiences too (disclosure: it happens all the time) I was somewhat a noob, I tried to edit Ubuntu's Yaru theme and I messed up and deleted the corrupted system files. There was nothing to worry since I already made backups of the original files, the distress came when I realized I accidentally deleted my good backup files (was bad regex). I wasn't really worried at that moment cause I hoped there would be some repository out there, I could just fetch my files. There was none, none of the latest Ubuntu version or any close old version. Turns out distribution packages are so big (sensibly) it's not that simple to deploy a remote master repository. That was my "wtf open source" moment. I still somehow managed to fix it without any stackoverflow or AskUbuntu. Anyway that's just one case top off my head.
- bubblethink 7y ago
  Uggh. This is such juvenile criticism about something that you do not understand. You really need to look at the design of most modern(ish) operating systems in the last few years including Android and ChromeOS which are already mentioned in the article.
  - okasaki 7y ago
    Clearly I don't understand, and neither the article nor you were of any help.
    - bubblethink 7y ago
      If you want to guard against persistent malware, you don't want your system partition to be writable. You also additionally need a chain of trust in the boot process to get to this (trusted and signed) immutable file system. That still leaves the issue of user-downloaded apps/code and how to run them securely in a sandboxed manner. Which Android does reasonably well, but it is perhaps too restrictive for server/general use cases which silverblue is trying to address. About the configuration issue, if configurations are transactional, you get transactional properties. And that would be quite significant. If you hose your system with an apt/yum update, you don't have much recourse unless you also took a filesystem snapshot before it (which you can do with zfs/btrfs/lvm-thin etc. and people shoehorn these things for precisely this reason). They are all different means to approximate the same end which is transactional package management.
      - okasaki 7y ago
        System files aren't writable by normal users in any Linux distribution. System recovery from backups is pretty easy and well understood too, so I'm not sure what benefit this would bring. If you want transactions you can install on btrfs and use apt-btrfs-snapshot to automatically take snapshots. It seems this isn't that well-known though, probably because the problem it solves isn't very serious. As for Android, it's already a frustrating system on phones, something like that on desktops would be total trash.
lugg 7y ago
Flatpaking all the things? I'm not sure why there is this push for Linux to have the "download and double click" install experience of windows / Mac. Convenient to install sure, but as a user its a nightmare to maintain/update. All people on Linux really need is an xdg-open standard for opening a package manager / running an install command.
- saltedshiv 7y ago
  Are flatpaks not all sandboxed? I thought the concept of flatpak and snap was that it offered sandboxing in a way what was never implemented to normal repo packages
  - lugg 7y ago
    Flatpak uses kernel namespaces (like docker) to run software with a bundled set of libraries. From their FAQ: > Flatpak mostly deployed as a convenient library bundling technology early on, with the sandboxing or containerization being phased in over time for most applications. I don't really know if sandboxing is worth it for me. Running everything inside docker cotnaienrs sounds like an absolute nightmare when it comes to troubleshooting. You might think logs and things would be well defined and put in the right place for the OS to pick up, but if things were so well behaved we wouldn't feel the need for sandboxing now would we.
    - curioussavage 7y ago
      I’ve been running many applications as flatpaks for over a year without issue. Troubleshooting is not too bad either imo.
      - lugg 7y ago
        Flatpak should be ok, I think when it's run inside inaccessible containers it won't be. Are the files sandboxed off from the user running in flatpak?
        7y ago
besulzbach 7y ago
> The operating system is delivered in images that are created by utilizing the rpm-ostree project. The main benefits of the system are speed, security, atomic updates and immutability. The article never mentions speed (or performance) again. Is the OS somehow expected to be faster because it is mounted read-only?
- viraptor 7y ago
  No, I wouldn't expect this system to be faster in a meaningful way. Actually maybe a bit slower since fewer libraries will be cached / memory mapped between applications if they carry their own copies.
  - lugg 7y ago
    I'd love to see stats on how many libraries are really shared, I'd imagine it might be less than you hope (other than the big graphical ones)
    - bnegreve 7y ago
      On my laptop: How many libraries are loaded: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | wc -l 15429 How many unique library names: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | sort | uniq | wc -l 872 Top 10 most shared libraries: sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | awk '{count[$0]++}END{for (i in count) print i, count[i]}' | sort -k 2 -n -r | head -n 10 /lib/x86_64-linux-gnu/libc-2.28.so 299 /lib/x86_64-linux-gnu/ld-2.28.so 299 /lib/x86_64-linux-gnu/libdl-2.28.so 262 /lib/x86_64-linux-gnu/libpthread-2.28.so 237 /lib/x86_64-linux-gnu/librt-2.28.so 227 /lib/x86_64-linux-gnu/libuuid.so.1.3.0 205 /lib/x86_64-linux-gnu/libz.so.1.2.11 200 /lib/x86_64-linux-gnu/libpcre.so.3.13.3 186 /lib/x86_64-linux-gnu/libresolv-2.28.so 170 /lib/x86_64-linux-gnu/libgpg-error.so.0.26.1 169 EDIT: add grep r-xp to count code segment only, values in previous edit were overestimated.
      - 7y ago
axaxs 7y ago
As a Linux user from the 90s, I welcome this change. RPM Hell and its Debian equivalent are real and painful things. When disk space was a premium, system dynamic linking made sense. Today, it absolutely does not. rpm-ostree is a bit ugly. Snap has the right idea of doing both system services and apps. Fedora should do the same.
- ghostpepper 7y ago
  While I can appreciate the security advantages of snap packages, I can't help but resent the fact that the output of the mount command is now polluted with dozens of lines unrelated to mounted disks.
  - axaxs 7y ago
    Agreed on that front. That's really my biggest issue with snaps.
  - quicklime 7y ago
    Thank you, it's nice to know that I'm not the only one who thinks this. You could use an alias to hide this: alias df='df -x squashfs' Given that squashfs is a read-only filesystem, I don't know why this isn't done by default. No one needs to worry about how much free space is left on an ro volume. I also go a few steps further and disable udev (-x devtmpfs) and tmpfs (-x tmpfs) as well.
  - dmckeon 7y ago
    Try findmnt(8) like: findmnt --df --types
- KUcxrAVrtI 7y ago
  >system dynamic linking made sense I too look forwards to having to manually updated all security patches for each binary in the system.
  - axaxs 7y ago
    Would you rather each update of said binary be dependent on the author or some volunteer? That's how you get Debian stable.. No thanks.
ww520 7y ago
This is great, especially for atomic update and rollback of the OS. I remember a particular painful instance of OS upgrade. I did the yum update command in the login shell and forgot to do it in a screen session. The login shell got killed after a period of inactivity, in the middle of the OS update. Afterward the OS was beyond repair; couldn't roll back or move forward. Had to reinstall. I wished something like silverblue existed back then.
stewbrew 7y ago
The author takes a long time to explain what problem this is going to solve. Only at the bottom of the page did I get a vague idea.
antpls 7y ago
Basically : the OS is itself a layered read-only "container", on top of which flatpak is the recommended way to install applications. I wish someone built an OS based on k8s as a service and application orchestrator. We wouldn't have to reinvent all the config files, the command line tools and we could reuse knowledge between cluster and single-machine administration. Plus k8s already voluntary abstracted the underlying technologies, so it should be simple to reuse it. We would use the same high-availability concepts than from the cloud, such as stateless service, horizontal scaling of services, etc. We could also reuse Istio and all the standards it is built-on to introspect the system. In other words, a microservice based OS.
- curt15 7y ago
  In some ways the implementation resembles ChromeOS -- you can install Linux tools and applications in a container, while the base OS is immutable and atomically updated via filesystem diffs.
- wmf 7y ago
  Check out k3os and OpenShift/OKD 4.
- gigatexal 7y ago
  No way. I get paid to write YAML hell for k8s at work. I don’t want my desktop to have to work like that. Not all things need to be K8s
- mycall 7y ago
  How fast would Steam games play?
- colechristensen 7y ago
  RancherOS is a bit like your wish.
- jacques_chester 7y ago
  https://kind.sigs.k8s.io/ https://kind.sigs.k8s.io/
- 7y ago
DonHopkins 7y ago
>“Team Silverblue” or “Silverblue” in short doesn’t have any hidden meaning. Don't "Bill Revues", "Evil Rubles", "Rebels I Luv", "Urb Level I", "I'll Sue Verb", "I Blur Elves", "Be Evil Slur", and "I Serve Bull" qualify as hidden meanings? (Not to mention "I Beaver's Mullet", "Brutalism Levee", "Album Televiser", "Ever Liable Smut", "Evil Slum Beater", "Melt Bra, Sue Evil", "Be Real Evil Smut", "Evilest Bar Mule", "Leave Stumblier", or "Blames True Evil"...)
- lone_haxx0r 7y ago
  Well, they're not hidden anymore.
- gnfurlong 7y ago
  Also "Must be real evil"
lifeisstillgood 7y ago
I have been working on a similar idea (well ok the concept of an immutable desktop - the tech is completely different) - https://github.com/mikadosoftware/workstation/tree/master/bin https://github.com/mikadosoftware/workstation/tree/master/bi... The article is completely right about this being the future of user OS's - even my half-broke me-ware above has changed how I think about using my laptop - just knowing exactly what is under me is exactly what I have set is ... reassuring. Being able to know I can try things out and a reboot gets me back to my last known good point is ... well a bit like a video game with savepoints. And there becomes an utter focus on data and non-data. And probably the best advantage is that you ratchet up - every security improvement I think of becomes built in and makes my platform one tiny bit higher SilverBlue is well worth watching - I say they really are into something
- ramblerman 7y ago
  Thanks for summarizing the crucial piece, that this is about an Immutable OS. You have to scroll 2 full pages before the Silverblue news release actually gets to that.
  - deleted 7y ago
    [deleted]
- michaelmrose 7y ago
  Have you looked at nixos or guix?
- pknopf 7y ago
  > Being able to know I can try things out and a reboot gets me back to my last known good point is This is exactly with I do with Darch. https://godarch.com/ https://godarch.com/ It supports Ubuntu/Debian/Arch/VoidLinux. Here are my recipes: https://github.com/pauldotknopf/darch-recipes https://github.com/pauldotknopf/darch-recipes I push my images to Docker Hub, pull them on each of my machines and boot them bare-metal. The same exact bits.
  - 7y ago
sjellis 7y ago
It's worth a moment to give credit to the long defunct Stateless Linux project: https://fedoraproject.org/wiki/StatelessLinux https://fedoraproject.org/wiki/StatelessLinux This was imagined a decade ago, but the technology and the market weren't ready then. I am really excited to see it as an actual product.
- 01100011 7y ago
  I'm guessing there are embedded Linux deployments that went this direction even earlier. Read-only rootfs is generally a good idea if you can swing it. You gain the ability to sign the rootfs which is good for security.
  - azernik 7y ago
    Having worked on embedded systems with (nearly) read-only root filesystems: An even bigger motivator is that flash memory lifetime is more determined by number of writes per block rather than time or reads per block. So to keep your storage both cheap and reliable, it's best to flash it with a single full (compressed) image every time you run a firmware upgrade, and otherwise mount it read-only.
  - pknopf 7y ago
    I work on embedded Linux systems, which inspired me to write Darch with the same technology I was using for my embedded systems. https://godarch.com/ https://godarch.com/ https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick-ride-in-a-virtual-machine/ https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick...
  - fucking_tragedy 7y ago
    Both Linux live CDs and OpenWRT have done this for over a decade with union mounts.
paulcarroty 7y ago
Concept is interested, but read-only rootfs is stupid, really. It's kind of lock-in. Of course, ro - great for security, but if something happens with any critical system component like bootloader - I prefer to able patch/fix it myself and don't wait days/weeks for distmakers. Clear Linux use similar concept, but they allow write access and handle whole fs tree and bundle depends on server side.
- Jasper_ 7y ago
  If you know how, there's an escape hatch. There are basically multiple filesystem trees under the hood (shared with hard links to avoid duplicating file data), and at boot time you'll get one of them. These are known as "OSTree deployments", and they're found in /ostree/deploy, and they're actually mutable, it's just the bind mounts into that location that are mounted RO. Anything in the bootloader configuration is not part of the deployment (from what I remember), and so it's mutable. See the docs here: https://ostree.readthedocs.io/en/latest/manual/deployment/ https://ostree.readthedocs.io/en/latest/manual/deployment/
vander_elst 7y ago
The scope seems to be pretty similar to: https://nixos.org/ https://nixos.org/
- danieldk 7y ago
  But there are also large differences. Silverblue still uses a single namespace for all libraries (unless you count Flatpaks, which can bring their own dependencies), whereas on NixOS you can have many different versions of the same library in parallel. In NixOS, the whole system is defined declaratively, including the system configuration, whereas Silverblue uses a mutable /etc.
  - edwintorok 7y ago
    Also with NixOS you can install a package and start using it immediately, whereas with SilverBlue you first have to reboot the system to use the new package or after installing updates (or use one of the experimental live update features that tend to break booting the system). If you don't change the set of installed packages often, and reboot your system daily to get the updates, then SilverBlue works quite nicely. You can use containers (via podman or docker), and there is a builtin utility "toolbox" that gives you a persistent mutable container.
    - vetinari 7y ago
      In Silverblue, your /usr is really immutable, so when you install package, you are installing it into different tree than the one currently running. Reboot switches to that newly constructed tree.
      - dorfsmay 7y ago
        Is there a dev version of silver Blue where you can install/remove package on the fly, and maybe commit and reboot once you're ready?
        snuxoll 7y ago
aleks_me2 7y ago
Oh no. The benefit of Linux is to be able to build your own Setup (Server,Desktop). Now with this "Solution" the user have more and more a closed System where every change creates a lot unnecessary steps to install another software. I agree that on servers the container runtime makes a lot of sense but not on Desktops where changes happen every day.
- tannhaeuser 7y ago
  I agree, and I whish others could see this as what it is - a push to make everything so overcomplicated and repository-locked in the name of security that you need endless maintenance and a support contract to run even basic software on your PC, thereby taking F/OSS ad absurdum. When in reality we haven't seen significant end-user F/OSS in almost a decade.
  - wwright 7y ago
    On workstations and laptops, no, but I work in enterprise and a _lot_ of Linux appliances out in the wild could benefit from this.
    - aleks_me2 7y ago
      Well the question is will the enterprise Software Vendor like Citrix, IBM, Dell, HP and so on port there Software to this new Package format. Even for today it's difficult to run some SW/HW tools on "Linux" as the vendors support only a small amount of Linux distribution with specific versions.
  - davidmr 7y ago
    What evidence to you have to suggest this extremely uncharitable interpretation of the Fedora project’s aims?
    - aleks_me2 7y ago
      What's the aim of the Fedora project to Silverblue?
robin_reala 7y ago
Sounds similar to what Apple’s doing with Catalina. On https://www.apple.com/macos/catalina-preview/ https://www.apple.com/macos/catalina-preview/ they say: Dedicated system volume. macOS Catalina runs in its own read-only volume, so it’s separate from all other data on your Mac, and nothing can accidentally overwrite your system files. And Gatekeeper ensures that new apps you install have been checked for known security issues before you run them, so you’re always using good software.
- ForHackernews 7y ago
  That sounds like the way Android partitions work.
  - delinka 7y ago
    Linux, the BSDs ...
    - wwright 7y ago
      This is a logical volume at the FS level rather than a proper partition, which has the advantage of sharing space with other volumes/&c.
arendtio 7y ago
How do they do things like security updates (e.g. OpenSSL)? I mean, if the system is immutable, do I have to download an install a completely new image? How often do such updates arrive? And what does immutable even mean in practice? Do I have to start from a CD image or some special boot mode every time I want to install system updates?
- Jasper_ 7y ago
  It's based on a piece of technology called "ostree". Fetching updates means downloading new objects from a remote object store, setting up a hardlink farm in a special location in disk (somewhere like /ostree/deploy), and during early boot, it will switchroot into there. So you can have multiple "filesystem roots" (directories on the same rootfs) and the mechanism can set things up to atomically swap between them, without wasting much file space (anything shared between them is shared, since it's hardlinks). The details can be found in the ostree documentation: https://ostree.readthedocs.io/en/latest/manual/atomic-upgrades/ https://ostree.readthedocs.io/en/latest/manual/atomic-upgrad...
  - Jaruzel 7y ago
    What's to stop malware from modifying the hardlinks and injecting dodgy processes during the next reboot ?
    - Jasper_ 7y ago
      The immutability of the OS is not, alone, meant as an in-depth security measure. Don't run malware as root. If you want a fully trusted boot system, you'll have to use features like Secure Boot to verify that the BIOS and bootloader have not been tampered with. ostree supports signing commits and trees with GPG signatures, and like git, all objects are content-addressed by SHA256 hash, so it is possible to verify that the entire root tree and all objects within it have been signed by some trusted party.
- deleted 7y ago
  [deleted]
amelius 7y ago
> “Team Silverblue” or “Silverblue” in short doesn’t have any hidden meaning. It was chosen after roughly two months when the project, previously known as Atomic Workstation was rebranded. There were over 150 words or word combinations reviewed in the process. In the end Silverblue was chosen because it had an available domain as well as the social network accounts. It personally made me think of "Silverlight".
RickJWagner 7y ago
Oooh, this is poor timing for me. I'm about to get a new laptop for work, I usually use Fedora. Should I gamble on using SilverBlue? I'll have to think long about this one.
- eropple 7y ago
  IMO, no. I run Silverblue on a machine I can afford to have not work at any given time. It's been rough on occasion, especially around stuff like graphics drivers. If you don't have a disposable machine I think this stack is definitely too early in development.
  - RickJWagner 7y ago
    Many thanks for that.
faissaloo 7y ago
So basically we're going back to the DOS model for operating systems? Sounds good to me.
rajaganesh87 7y ago
How is this different from traditional embedded Linux system? Most firmwares have a read-only rootfs.
- detaro 7y ago
  Applying those tools to desktop systems, where users make decisions about what's on the system.
cycomanic 7y ago
How is that fixing the issue of incompatible configuration changes? This is typically the reason why I see boot or start problems, i.e. I have made some changes to some configuration and the format, or some option changed with a package upgrade and I suddenly can't boot into the gui anymore. In contrast I can't remember when I updated a system and something stopped working because 2 libraries were incompatible. To me this is really solving a non-issue.
- curt15 7y ago
  The contents of /etc is rolled back when you boot into the previous deployment.
pknopf 7y ago
I'd like to share a similar project/tool that I developed. Darch. https://godarch.com/ https://godarch.com/ I essentially use Dockerfiles to build my operating systems. I push them to Docker Hub so that each of my machines have access to them. I can boot them bare-metal, read-only, with a tmpfs overlay. I can apt-get install/remove anything, completely break my system, then reboot and everything is fixed! Here are my recipes: https://github.com/pauldotknopf/darch-recipes https://github.com/pauldotknopf/darch-recipes You can easily get it a test-run with a pre-made VM: https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick-ride-in-a-virtual-machine/ https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick... I'd love to hear some feed back. I've been using it personally for the past few years. I wouldn't do it any other way.
andrerm 7y ago
It is the reason I'm slowly moving away from Linux. I've learned Linux, for years I've invested time and money learning everything I could. And it was fun. I even built LFS many times. I know how NOT to break it and how to fix it. And as we have seen with GNOME3, systemd, Wayland etc. RH will deliver and every major distribution will eventually adopt immutable directories and statically linked applications. So, my conclusion after all this years learning and having fun with Linux is that it was a waste of time. I understand the propaganda: it's good for everyone (who don't like dealing with Linux, the OS). And I understand the real reason: distribution developers don't like the tedious work that is compiling, linking and packaging the same software over and over again. But the feeling that I wasted my time. If it's to use a immutable, bloated, reboot-all-the-time OS, I just use any other OS. As I posted here: https://news.ycombinator.com/item?id=20425615 https://news.ycombinator.com/item?id=20425615
leonlag 7y ago
I'm a fedora user and I just gave silverblue a try. The idea itself is great but in it's current state it's basically unusable for me. A lot of application I use are command line based and are simply not available via flatpak. You have to install these via rpm-ostree but that requires a reboot every time you install anything. Moreover many GUI applications that are available in the fedora repos are simply not packaged as flatpaks and either require rpm-ostree and a subsequent reboot or adding a third party repository like flathub. I really don't want to give up fedoras mostly excellent repos to rely on some badly packaged, possibly malicious container. After not being able to find my preffered media player mpv, I settled for VLC from flathub. It installed just fine but video playback was completely broken, VLC installed via rpm-ostree worked. I also don't understand how you are supposed to install patent encumbered codecs for firefox. Usually this is solved by adding the rpmfusion repos but with firefox being installed via a flatpak from the fedora repos, this obviously does not work. I'll probably check this out again in ~2 years and see if it's any better.
- yeahforsureman 7y ago
  For development workflows, command line applications and such, I think you're supposed to go the container route via Toolbox. So you will have dnf etc.

303 points by anuragsoni 7y ago

Also look at openSUSE MicroOS, which provides the same core idea (transactional root fs), but with some key advantages like not using rpm-ostree and instead using plain RPMs.

okasaki 7y ago

This seems poorly motivated. > What are the benefits of an immutable OS? > One of the main benefits is security. The base operating system is mounted as read-only, and thus cannot be modified by malicious software. The only way to alter the system is through the rpm-ostree utility. How is this different from the current experience? "Operating system" files already aren't writable by the user. The only way to alter the system is through the "sudo" utility. > Another benefit is robustness. It’s nearly impossible for a regular user to get the OS to the state when it doesn’t boot or doesn’t work properly after accidentally or unintentionally removing some system library. Try to think about these kind of experiences from your past, and imagine how Silverblue could help you there. How often does this happen? I've worked with complete Linux noobies who were "forced" to use Linux in a VM daily and I've never seen this happen.

Barrin92 7y ago
>The only way to alter the system is through the "sudo" utility. The sudo utility doesn't really give any guarantees or produces reproducible states. You can mess around with sudo however you like.rpm-ostree transactions are completely reversible. Silverblue is the equivalent of an accountant having a transparent history of your machine states. Sudo is like grabbing a pencil, a rubber, and a spraycan and gowing to town.
mhxion 7y ago
> How often does this happen? I've worked with complete Linux noobies who were "forced" to use Linux in a VM daily and I've never seen this happen. Depends on the noob, and just because you never met a situation like that doesn't mean nobody else experiences too (disclosure: it happens all the time) I was somewhat a noob, I tried to edit Ubuntu's Yaru theme and I messed up and deleted the corrupted system files. There was nothing to worry since I already made backups of the original files, the distress came when I realized I accidentally deleted my good backup files (was bad regex). I wasn't really worried at that moment cause I hoped there would be some repository out there, I could just fetch my files. There was none, none of the latest Ubuntu version or any close old version. Turns out distribution packages are so big (sensibly) it's not that simple to deploy a remote master repository. That was my "wtf open source" moment. I still somehow managed to fix it without any stackoverflow or AskUbuntu. Anyway that's just one case top off my head.
bubblethink 7y ago
Uggh. This is such juvenile criticism about something that you do not understand. You really need to look at the design of most modern(ish) operating systems in the last few years including Android and ChromeOS which are already mentioned in the article.
- okasaki 7y ago
  Clearly I don't understand, and neither the article nor you were of any help.
  - bubblethink 7y ago
    If you want to guard against persistent malware, you don't want your system partition to be writable. You also additionally need a chain of trust in the boot process to get to this (trusted and signed) immutable file system. That still leaves the issue of user-downloaded apps/code and how to run them securely in a sandboxed manner. Which Android does reasonably well, but it is perhaps too restrictive for server/general use cases which silverblue is trying to address. About the configuration issue, if configurations are transactional, you get transactional properties. And that would be quite significant. If you hose your system with an apt/yum update, you don't have much recourse unless you also took a filesystem snapshot before it (which you can do with zfs/btrfs/lvm-thin etc. and people shoehorn these things for precisely this reason). They are all different means to approximate the same end which is transactional package management.
    - okasaki 7y ago
      System files aren't writable by normal users in any Linux distribution. System recovery from backups is pretty easy and well understood too, so I'm not sure what benefit this would bring. If you want transactions you can install on btrfs and use apt-btrfs-snapshot to automatically take snapshots. It seems this isn't that well-known though, probably because the problem it solves isn't very serious. As for Android, it's already a frustrating system on phones, something like that on desktops would be total trash.

lugg 7y ago

Flatpaking all the things? I'm not sure why there is this push for Linux to have the "download and double click" install experience of windows / Mac. Convenient to install sure, but as a user its a nightmare to maintain/update. All people on Linux really need is an xdg-open standard for opening a package manager / running an install command.

saltedshiv 7y ago
Are flatpaks not all sandboxed? I thought the concept of flatpak and snap was that it offered sandboxing in a way what was never implemented to normal repo packages
- lugg 7y ago
  Flatpak uses kernel namespaces (like docker) to run software with a bundled set of libraries. From their FAQ: > Flatpak mostly deployed as a convenient library bundling technology early on, with the sandboxing or containerization being phased in over time for most applications. I don't really know if sandboxing is worth it for me. Running everything inside docker cotnaienrs sounds like an absolute nightmare when it comes to troubleshooting. You might think logs and things would be well defined and put in the right place for the OS to pick up, but if things were so well behaved we wouldn't feel the need for sandboxing now would we.
  - curioussavage 7y ago
    I’ve been running many applications as flatpaks for over a year without issue. Troubleshooting is not too bad either imo.
    - lugg 7y ago
      Flatpak should be ok, I think when it's run inside inaccessible containers it won't be. Are the files sandboxed off from the user running in flatpak?
      - 7y ago

besulzbach 7y ago

> The operating system is delivered in images that are created by utilizing the rpm-ostree project. The main benefits of the system are speed, security, atomic updates and immutability. The article never mentions speed (or performance) again. Is the OS somehow expected to be faster because it is mounted read-only?

viraptor 7y ago
No, I wouldn't expect this system to be faster in a meaningful way. Actually maybe a bit slower since fewer libraries will be cached / memory mapped between applications if they carry their own copies.
- lugg 7y ago
  I'd love to see stats on how many libraries are really shared, I'd imagine it might be less than you hope (other than the big graphical ones)
  - bnegreve 7y ago
    On my laptop: How many libraries are loaded: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | wc -l 15429 How many unique library names: $ sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | sort | uniq | wc -l 872 Top 10 most shared libraries: sudo cat /proc/[0-9]*/maps | grep '\.so' | grep 'r-xp' | tr -s ' ' | cut -d ' ' -f 6 | awk '{count[$0]++}END{for (i in count) print i, count[i]}' | sort -k 2 -n -r | head -n 10 /lib/x86_64-linux-gnu/libc-2.28.so 299 /lib/x86_64-linux-gnu/ld-2.28.so 299 /lib/x86_64-linux-gnu/libdl-2.28.so 262 /lib/x86_64-linux-gnu/libpthread-2.28.so 237 /lib/x86_64-linux-gnu/librt-2.28.so 227 /lib/x86_64-linux-gnu/libuuid.so.1.3.0 205 /lib/x86_64-linux-gnu/libz.so.1.2.11 200 /lib/x86_64-linux-gnu/libpcre.so.3.13.3 186 /lib/x86_64-linux-gnu/libresolv-2.28.so 170 /lib/x86_64-linux-gnu/libgpg-error.so.0.26.1 169 EDIT: add grep r-xp to count code segment only, values in previous edit were overestimated.
    - 7y ago

axaxs 7y ago

As a Linux user from the 90s, I welcome this change. RPM Hell and its Debian equivalent are real and painful things. When disk space was a premium, system dynamic linking made sense. Today, it absolutely does not. rpm-ostree is a bit ugly. Snap has the right idea of doing both system services and apps. Fedora should do the same.

ghostpepper 7y ago
While I can appreciate the security advantages of snap packages, I can't help but resent the fact that the output of the mount command is now polluted with dozens of lines unrelated to mounted disks.
- axaxs 7y ago
  Agreed on that front. That's really my biggest issue with snaps.
- quicklime 7y ago
  Thank you, it's nice to know that I'm not the only one who thinks this. You could use an alias to hide this: alias df='df -x squashfs' Given that squashfs is a read-only filesystem, I don't know why this isn't done by default. No one needs to worry about how much free space is left on an ro volume. I also go a few steps further and disable udev (-x devtmpfs) and tmpfs (-x tmpfs) as well.
- dmckeon 7y ago
  Try findmnt(8) like: findmnt --df --types
KUcxrAVrtI 7y ago
>system dynamic linking made sense I too look forwards to having to manually updated all security patches for each binary in the system.
- axaxs 7y ago
  Would you rather each update of said binary be dependent on the author or some volunteer? That's how you get Debian stable.. No thanks.

ww520 7y ago

This is great, especially for atomic update and rollback of the OS. I remember a particular painful instance of OS upgrade. I did the yum update command in the login shell and forgot to do it in a screen session. The login shell got killed after a period of inactivity, in the middle of the OS update. Afterward the OS was beyond repair; couldn't roll back or move forward. Had to reinstall. I wished something like silverblue existed back then.

stewbrew 7y ago

The author takes a long time to explain what problem this is going to solve. Only at the bottom of the page did I get a vague idea.

antpls 7y ago

Basically : the OS is itself a layered read-only "container", on top of which flatpak is the recommended way to install applications. I wish someone built an OS based on k8s as a service and application orchestrator. We wouldn't have to reinvent all the config files, the command line tools and we could reuse knowledge between cluster and single-machine administration. Plus k8s already voluntary abstracted the underlying technologies, so it should be simple to reuse it. We would use the same high-availability concepts than from the cloud, such as stateless service, horizontal scaling of services, etc. We could also reuse Istio and all the standards it is built-on to introspect the system. In other words, a microservice based OS.

curt15 7y ago
In some ways the implementation resembles ChromeOS -- you can install Linux tools and applications in a container, while the base OS is immutable and atomically updated via filesystem diffs.
wmf 7y ago
Check out k3os and OpenShift/OKD 4.
gigatexal 7y ago
No way. I get paid to write YAML hell for k8s at work. I don’t want my desktop to have to work like that. Not all things need to be K8s
mycall 7y ago
How fast would Steam games play?
colechristensen 7y ago
RancherOS is a bit like your wish.
jacques_chester 7y ago
https://kind.sigs.k8s.io/ https://kind.sigs.k8s.io/
7y ago

DonHopkins 7y ago

>“Team Silverblue” or “Silverblue” in short doesn’t have any hidden meaning. Don't "Bill Revues", "Evil Rubles", "Rebels I Luv", "Urb Level I", "I'll Sue Verb", "I Blur Elves", "Be Evil Slur", and "I Serve Bull" qualify as hidden meanings? (Not to mention "I Beaver's Mullet", "Brutalism Levee", "Album Televiser", "Ever Liable Smut", "Evil Slum Beater", "Melt Bra, Sue Evil", "Be Real Evil Smut", "Evilest Bar Mule", "Leave Stumblier", or "Blames True Evil"...)

lone_haxx0r 7y ago
Well, they're not hidden anymore.
gnfurlong 7y ago
Also "Must be real evil"

lifeisstillgood 7y ago

I have been working on a similar idea (well ok the concept of an immutable desktop - the tech is completely different) - https://github.com/mikadosoftware/workstation/tree/master/bin https://github.com/mikadosoftware/workstation/tree/master/bi... The article is completely right about this being the future of user OS's - even my half-broke me-ware above has changed how I think about using my laptop - just knowing exactly what is under me is exactly what I have set is ... reassuring. Being able to know I can try things out and a reboot gets me back to my last known good point is ... well a bit like a video game with savepoints. And there becomes an utter focus on data and non-data. And probably the best advantage is that you ratchet up - every security improvement I think of becomes built in and makes my platform one tiny bit higher SilverBlue is well worth watching - I say they really are into something

ramblerman 7y ago
Thanks for summarizing the crucial piece, that this is about an Immutable OS. You have to scroll 2 full pages before the Silverblue news release actually gets to that.
- deleted 7y ago
  [deleted]
michaelmrose 7y ago
Have you looked at nixos or guix?
pknopf 7y ago
> Being able to know I can try things out and a reboot gets me back to my last known good point is This is exactly with I do with Darch. https://godarch.com/ https://godarch.com/ It supports Ubuntu/Debian/Arch/VoidLinux. Here are my recipes: https://github.com/pauldotknopf/darch-recipes https://github.com/pauldotknopf/darch-recipes I push my images to Docker Hub, pull them on each of my machines and boot them bare-metal. The same exact bits.
- 7y ago

sjellis 7y ago

It's worth a moment to give credit to the long defunct Stateless Linux project: https://fedoraproject.org/wiki/StatelessLinux https://fedoraproject.org/wiki/StatelessLinux This was imagined a decade ago, but the technology and the market weren't ready then. I am really excited to see it as an actual product.

01100011 7y ago
I'm guessing there are embedded Linux deployments that went this direction even earlier. Read-only rootfs is generally a good idea if you can swing it. You gain the ability to sign the rootfs which is good for security.
- azernik 7y ago
  Having worked on embedded systems with (nearly) read-only root filesystems: An even bigger motivator is that flash memory lifetime is more determined by number of writes per block rather than time or reads per block. So to keep your storage both cheap and reliable, it's best to flash it with a single full (compressed) image every time you run a firmware upgrade, and otherwise mount it read-only.
- pknopf 7y ago
  I work on embedded Linux systems, which inspired me to write Darch with the same technology I was using for my embedded systems. https://godarch.com/ https://godarch.com/ https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick-ride-in-a-virtual-machine/ https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick...
- fucking_tragedy 7y ago
  Both Linux live CDs and OpenWRT have done this for over a decade with union mounts.

paulcarroty 7y ago

Concept is interested, but read-only rootfs is stupid, really. It's kind of lock-in. Of course, ro - great for security, but if something happens with any critical system component like bootloader - I prefer to able patch/fix it myself and don't wait days/weeks for distmakers. Clear Linux use similar concept, but they allow write access and handle whole fs tree and bundle depends on server side.

Jasper_ 7y ago
If you know how, there's an escape hatch. There are basically multiple filesystem trees under the hood (shared with hard links to avoid duplicating file data), and at boot time you'll get one of them. These are known as "OSTree deployments", and they're found in /ostree/deploy, and they're actually mutable, it's just the bind mounts into that location that are mounted RO. Anything in the bootloader configuration is not part of the deployment (from what I remember), and so it's mutable. See the docs here: https://ostree.readthedocs.io/en/latest/manual/deployment/ https://ostree.readthedocs.io/en/latest/manual/deployment/

vander_elst 7y ago

The scope seems to be pretty similar to: https://nixos.org/ https://nixos.org/

danieldk 7y ago
But there are also large differences. Silverblue still uses a single namespace for all libraries (unless you count Flatpaks, which can bring their own dependencies), whereas on NixOS you can have many different versions of the same library in parallel. In NixOS, the whole system is defined declaratively, including the system configuration, whereas Silverblue uses a mutable /etc.
- edwintorok 7y ago
  Also with NixOS you can install a package and start using it immediately, whereas with SilverBlue you first have to reboot the system to use the new package or after installing updates (or use one of the experimental live update features that tend to break booting the system). If you don't change the set of installed packages often, and reboot your system daily to get the updates, then SilverBlue works quite nicely. You can use containers (via podman or docker), and there is a builtin utility "toolbox" that gives you a persistent mutable container.
  - vetinari 7y ago
    In Silverblue, your /usr is really immutable, so when you install package, you are installing it into different tree than the one currently running. Reboot switches to that newly constructed tree.
    - dorfsmay 7y ago
      Is there a dev version of silver Blue where you can install/remove package on the fly, and maybe commit and reboot once you're ready?
      - snuxoll 7y ago

aleks_me2 7y ago

Oh no. The benefit of Linux is to be able to build your own Setup (Server,Desktop). Now with this "Solution" the user have more and more a closed System where every change creates a lot unnecessary steps to install another software. I agree that on servers the container runtime makes a lot of sense but not on Desktops where changes happen every day.

tannhaeuser 7y ago
I agree, and I whish others could see this as what it is - a push to make everything so overcomplicated and repository-locked in the name of security that you need endless maintenance and a support contract to run even basic software on your PC, thereby taking F/OSS ad absurdum. When in reality we haven't seen significant end-user F/OSS in almost a decade.
- wwright 7y ago
  On workstations and laptops, no, but I work in enterprise and a _lot_ of Linux appliances out in the wild could benefit from this.
  - aleks_me2 7y ago
    Well the question is will the enterprise Software Vendor like Citrix, IBM, Dell, HP and so on port there Software to this new Package format. Even for today it's difficult to run some SW/HW tools on "Linux" as the vendors support only a small amount of Linux distribution with specific versions.
- davidmr 7y ago
  What evidence to you have to suggest this extremely uncharitable interpretation of the Fedora project’s aims?
  - aleks_me2 7y ago
    What's the aim of the Fedora project to Silverblue?

robin_reala 7y ago

Sounds similar to what Apple’s doing with Catalina. On https://www.apple.com/macos/catalina-preview/ https://www.apple.com/macos/catalina-preview/ they say: Dedicated system volume. macOS Catalina runs in its own read-only volume, so it’s separate from all other data on your Mac, and nothing can accidentally overwrite your system files. And Gatekeeper ensures that new apps you install have been checked for known security issues before you run them, so you’re always using good software.

ForHackernews 7y ago
That sounds like the way Android partitions work.
- delinka 7y ago
  Linux, the BSDs ...
  - wwright 7y ago
    This is a logical volume at the FS level rather than a proper partition, which has the advantage of sharing space with other volumes/&c.

arendtio 7y ago

How do they do things like security updates (e.g. OpenSSL)? I mean, if the system is immutable, do I have to download an install a completely new image? How often do such updates arrive? And what does immutable even mean in practice? Do I have to start from a CD image or some special boot mode every time I want to install system updates?

Jasper_ 7y ago
It's based on a piece of technology called "ostree". Fetching updates means downloading new objects from a remote object store, setting up a hardlink farm in a special location in disk (somewhere like /ostree/deploy), and during early boot, it will switchroot into there. So you can have multiple "filesystem roots" (directories on the same rootfs) and the mechanism can set things up to atomically swap between them, without wasting much file space (anything shared between them is shared, since it's hardlinks). The details can be found in the ostree documentation: https://ostree.readthedocs.io/en/latest/manual/atomic-upgrades/ https://ostree.readthedocs.io/en/latest/manual/atomic-upgrad...
- Jaruzel 7y ago
  What's to stop malware from modifying the hardlinks and injecting dodgy processes during the next reboot ?
  - Jasper_ 7y ago
    The immutability of the OS is not, alone, meant as an in-depth security measure. Don't run malware as root. If you want a fully trusted boot system, you'll have to use features like Secure Boot to verify that the BIOS and bootloader have not been tampered with. ostree supports signing commits and trees with GPG signatures, and like git, all objects are content-addressed by SHA256 hash, so it is possible to verify that the entire root tree and all objects within it have been signed by some trusted party.
deleted 7y ago
[deleted]

amelius 7y ago

> “Team Silverblue” or “Silverblue” in short doesn’t have any hidden meaning. It was chosen after roughly two months when the project, previously known as Atomic Workstation was rebranded. There were over 150 words or word combinations reviewed in the process. In the end Silverblue was chosen because it had an available domain as well as the social network accounts. It personally made me think of "Silverlight".

RickJWagner 7y ago

Oooh, this is poor timing for me. I'm about to get a new laptop for work, I usually use Fedora. Should I gamble on using SilverBlue? I'll have to think long about this one.

eropple 7y ago
IMO, no. I run Silverblue on a machine I can afford to have not work at any given time. It's been rough on occasion, especially around stuff like graphics drivers. If you don't have a disposable machine I think this stack is definitely too early in development.
- RickJWagner 7y ago
  Many thanks for that.

faissaloo 7y ago

So basically we're going back to the DOS model for operating systems? Sounds good to me.

rajaganesh87 7y ago

How is this different from traditional embedded Linux system? Most firmwares have a read-only rootfs.

detaro 7y ago
Applying those tools to desktop systems, where users make decisions about what's on the system.

cycomanic 7y ago

How is that fixing the issue of incompatible configuration changes? This is typically the reason why I see boot or start problems, i.e. I have made some changes to some configuration and the format, or some option changed with a package upgrade and I suddenly can't boot into the gui anymore. In contrast I can't remember when I updated a system and something stopped working because 2 libraries were incompatible. To me this is really solving a non-issue.

curt15 7y ago
The contents of /etc is rolled back when you boot into the previous deployment.

pknopf 7y ago

I'd like to share a similar project/tool that I developed. Darch. https://godarch.com/ https://godarch.com/ I essentially use Dockerfiles to build my operating systems. I push them to Docker Hub so that each of my machines have access to them. I can boot them bare-metal, read-only, with a tmpfs overlay. I can apt-get install/remove anything, completely break my system, then reboot and everything is fixed! Here are my recipes: https://github.com/pauldotknopf/darch-recipes https://github.com/pauldotknopf/darch-recipes You can easily get it a test-run with a pre-made VM: https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick-ride-in-a-virtual-machine/ https://pknopf.com/post/2018-11-09-give-ubuntu-darch-a-quick... I'd love to hear some feed back. I've been using it personally for the past few years. I wouldn't do it any other way.

andrerm 7y ago

It is the reason I'm slowly moving away from Linux. I've learned Linux, for years I've invested time and money learning everything I could. And it was fun. I even built LFS many times. I know how NOT to break it and how to fix it. And as we have seen with GNOME3, systemd, Wayland etc. RH will deliver and every major distribution will eventually adopt immutable directories and statically linked applications. So, my conclusion after all this years learning and having fun with Linux is that it was a waste of time. I understand the propaganda: it's good for everyone (who don't like dealing with Linux, the OS). And I understand the real reason: distribution developers don't like the tedious work that is compiling, linking and packaging the same software over and over again. But the feeling that I wasted my time. If it's to use a immutable, bloated, reboot-all-the-time OS, I just use any other OS. As I posted here: https://news.ycombinator.com/item?id=20425615 https://news.ycombinator.com/item?id=20425615

leonlag 7y ago

I'm a fedora user and I just gave silverblue a try. The idea itself is great but in it's current state it's basically unusable for me. A lot of application I use are command line based and are simply not available via flatpak. You have to install these via rpm-ostree but that requires a reboot every time you install anything. Moreover many GUI applications that are available in the fedora repos are simply not packaged as flatpaks and either require rpm-ostree and a subsequent reboot or adding a third party repository like flathub. I really don't want to give up fedoras mostly excellent repos to rely on some badly packaged, possibly malicious container. After not being able to find my preffered media player mpv, I settled for VLC from flathub. It installed just fine but video playback was completely broken, VLC installed via rpm-ostree worked. I also don't understand how you are supposed to install patent encumbered codecs for firefox. Usually this is solved by adding the rpmfusion repos but with firefox being installed via a flatpak from the fedora repos, this obviously does not work. I'll probably check this out again in ~2 years and see if it's any better.

yeahforsureman 7y ago
For development workflows, command line applications and such, I think you're supposed to go the container route via Toolbox. So you will have dnf etc.