3 ms·

> One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Maybe t

> One of the targeted user-groups is clearly people who travel a lot and are on various untrusted networks often (airports, coffee shops, hotels, etc). Maybe that's clear to you. > With that said - immutable is clearly the future for all operating systems, not just Linux Distros. Kind of a side issue. However... > Ever updated your windows machine and got a BSOD? We all have... immutable means that is very unlikely to happen (because everyone uses the same base OS image), and if it did, rolling back is as easy as rebooting the system. ... until you actually want to use it, at which point you're installing software in some kind of user account or application area, and you get to reexperience all the same problems and reinvent the solutions. Except with an extra layer of complexity to separate the "base image" from whatever you're actually trying to use the computer for. > This is why complete "base image" testing is impossible with traditional OS'... everyone's is different. Everyone's actual applications and needs are different.

Alupis 3y ago
For everyday usage, like surfing the internet, word processing, emails, gaming, etc - these are all non-issues. Sandboxed app environments are easily accomplished today in various ways on Linux and other immutable OS (there's more than you think, including popular mobile operating systems). The base image never needs to change for any application to be installed and used. Layering is not even a requirement for almost all software to work as expected on an immutable system. Development is still weird on immutable OS's - since developers do weird things. Currently the solution is pet containers, which are more of a PITA than not, but it does work fine. With that said, modern development environments should not be sprawled all across your system anyway - that's bad for so many reasons. Regardless, if you would prefer to layer on top of the base os, then you still get the overwhelming majority of immutable benefits. Immutable is the future...
- getwiththeprog 3y ago
  Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use. Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Linux is a feature, because every OS ever created has holes and flaws and lacks features. It is a nice idea that we could all be on the same system that works flawlessly, but it is not an achievable reality. So while immutable may be the future, it will always be in the future.
  - Alupis 3y ago
    Immutable does not mean "no updates". Immutable means you and I both are running the same base image, given we are running the same version of base image. As of right now, the system I type this on is updating to "Fedora Kinoite 39.20231215.1". Every single person who has done this same update will be running exactly the same base image, ie. our root filesystems will be identical. Further, the root filesystem was built in a "repeatable/reproducible" way, which means you could go so far as to verify the base image by building it yourself and get an identical output. This means that base image (read: root filesystem) can be thoroughly tested before it's released. There is no "config drift" with the root filesystem, no drivers/software modifying things in strange ways that might cause unexpected behavior, etc. In OS-Tree based distributions, you can layer on top of the base image, which creates a new runtime image. Layers can modify the runtime root filesystem, but not the base image's root filesystem! If something breaks, it's as simple as disabling that layer and rebooting, or rolling-back to the previous version. This means in practice it's nearly impossible to actually break your system. You can kind of think of it like "git for operating systems", complete with "git revert" abilities... The preferred way to install software is via some sort of runtime sandbox, such as Flatpack or similar. This does not modify the root filesystem in any way, and therefore cannot cause an issue at that level. There are additional benefits to running sandboxed applications without access to the root filesystem, such as increased security, but that's a side effect. The main goal is system stability. I can update entire versions of the OS (say, Fedora 38 -> 39, which I did recently) without any worries my system will be unbootable afterwards. It's not a possibility, barring any hardware issues. Immutable OS' are a great concept, and will be the future for all "normal" computer users. Many consumer-facing OS' are already immutable, even if they don't advertise as such. These include Android and iOS, ChromeOS and more (with some varying degrees of immutability). These systems are also the least likely to need a wipe/reset once-in-a-while - something Windows users have grown accustomed to.
  - TheCoelacanth 3y ago
    Immutable = no updates is just a complete misunderstanding of what an immutable OS is. In fact, it's the exact opposite. It makes it much easier and safer to update because you can immediately roll back to a working version if something breaks.

Alupis 3y ago

For everyday usage, like surfing the internet, word processing, emails, gaming, etc - these are all non-issues. Sandboxed app environments are easily accomplished today in various ways on Linux and other immutable OS (there's more than you think, including popular mobile operating systems). The base image never needs to change for any application to be installed and used. Layering is not even a requirement for almost all software to work as expected on an immutable system. Development is still weird on immutable OS's - since developers do weird things. Currently the solution is pet containers, which are more of a PITA than not, but it does work fine. With that said, modern development environments should not be sprawled all across your system anyway - that's bad for so many reasons. Regardless, if you would prefer to layer on top of the base os, then you still get the overwhelming majority of immutable benefits. Immutable is the future...

getwiththeprog 3y ago
Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use. Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Linux is a feature, because every OS ever created has holes and flaws and lacks features. It is a nice idea that we could all be on the same system that works flawlessly, but it is not an achievable reality. So while immutable may be the future, it will always be in the future.
- Alupis 3y ago
  Immutable does not mean "no updates". Immutable means you and I both are running the same base image, given we are running the same version of base image. As of right now, the system I type this on is updating to "Fedora Kinoite 39.20231215.1". Every single person who has done this same update will be running exactly the same base image, ie. our root filesystems will be identical. Further, the root filesystem was built in a "repeatable/reproducible" way, which means you could go so far as to verify the base image by building it yourself and get an identical output. This means that base image (read: root filesystem) can be thoroughly tested before it's released. There is no "config drift" with the root filesystem, no drivers/software modifying things in strange ways that might cause unexpected behavior, etc. In OS-Tree based distributions, you can layer on top of the base image, which creates a new runtime image. Layers can modify the runtime root filesystem, but not the base image's root filesystem! If something breaks, it's as simple as disabling that layer and rebooting, or rolling-back to the previous version. This means in practice it's nearly impossible to actually break your system. You can kind of think of it like "git for operating systems", complete with "git revert" abilities... The preferred way to install software is via some sort of runtime sandbox, such as Flatpack or similar. This does not modify the root filesystem in any way, and therefore cannot cause an issue at that level. There are additional benefits to running sandboxed applications without access to the root filesystem, such as increased security, but that's a side effect. The main goal is system stability. I can update entire versions of the OS (say, Fedora 38 -> 39, which I did recently) without any worries my system will be unbootable afterwards. It's not a possibility, barring any hardware issues. Immutable OS' are a great concept, and will be the future for all "normal" computer users. Many consumer-facing OS' are already immutable, even if they don't advertise as such. These include Android and iOS, ChromeOS and more (with some varying degrees of immutability). These systems are also the least likely to need a wipe/reset once-in-a-while - something Windows users have grown accustomed to.
- TheCoelacanth 3y ago
  Immutable = no updates is just a complete misunderstanding of what an immutable OS is. In fact, it's the exact opposite. It makes it much easier and safer to update because you can immediately roll back to a working version if something breaks.