3 ms·

Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact

Even hardware layer is not truly immutable, but lets say that it is. Having another immutable layer (ie secureblue) on top means less flexibility to interact with the hardware layer, and the requirement of putting another layer under the immutable software layer (eg the sanboxed OS one actually wants to use. Why do we not just go to an OS baked into hardware? Because we value updates. The rolling bug-wall that is Linux is a feature, because every OS ever created has holes and flaws and lacks features. It is a nice idea that we could all be on the same system that works flawlessly, but it is not an achievable reality. So while immutable may be the future, it will always be in the future.

Alupis 3y ago
Immutable does not mean "no updates". Immutable means you and I both are running the same base image, given we are running the same version of base image. As of right now, the system I type this on is updating to "Fedora Kinoite 39.20231215.1". Every single person who has done this same update will be running exactly the same base image, ie. our root filesystems will be identical. Further, the root filesystem was built in a "repeatable/reproducible" way, which means you could go so far as to verify the base image by building it yourself and get an identical output. This means that base image (read: root filesystem) can be thoroughly tested before it's released. There is no "config drift" with the root filesystem, no drivers/software modifying things in strange ways that might cause unexpected behavior, etc. In OS-Tree based distributions, you can layer on top of the base image, which creates a new runtime image. Layers can modify the runtime root filesystem, but not the base image's root filesystem! If something breaks, it's as simple as disabling that layer and rebooting, or rolling-back to the previous version. This means in practice it's nearly impossible to actually break your system. You can kind of think of it like "git for operating systems", complete with "git revert" abilities... The preferred way to install software is via some sort of runtime sandbox, such as Flatpack or similar. This does not modify the root filesystem in any way, and therefore cannot cause an issue at that level. There are additional benefits to running sandboxed applications without access to the root filesystem, such as increased security, but that's a side effect. The main goal is system stability. I can update entire versions of the OS (say, Fedora 38 -> 39, which I did recently) without any worries my system will be unbootable afterwards. It's not a possibility, barring any hardware issues. Immutable OS' are a great concept, and will be the future for all "normal" computer users. Many consumer-facing OS' are already immutable, even if they don't advertise as such. These include Android and iOS, ChromeOS and more (with some varying degrees of immutability). These systems are also the least likely to need a wipe/reset once-in-a-while - something Windows users have grown accustomed to.
TheCoelacanth 3y ago
Immutable = no updates is just a complete misunderstanding of what an immutable OS is. In fact, it's the exact opposite. It makes it much easier and safer to update because you can immediately roll back to a working version if something breaks.

Alupis 3y ago

Immutable does not mean "no updates". Immutable means you and I both are running the same base image, given we are running the same version of base image. As of right now, the system I type this on is updating to "Fedora Kinoite 39.20231215.1". Every single person who has done this same update will be running exactly the same base image, ie. our root filesystems will be identical. Further, the root filesystem was built in a "repeatable/reproducible" way, which means you could go so far as to verify the base image by building it yourself and get an identical output. This means that base image (read: root filesystem) can be thoroughly tested before it's released. There is no "config drift" with the root filesystem, no drivers/software modifying things in strange ways that might cause unexpected behavior, etc. In OS-Tree based distributions, you can layer on top of the base image, which creates a new runtime image. Layers can modify the runtime root filesystem, but not the base image's root filesystem! If something breaks, it's as simple as disabling that layer and rebooting, or rolling-back to the previous version. This means in practice it's nearly impossible to actually break your system. You can kind of think of it like "git for operating systems", complete with "git revert" abilities... The preferred way to install software is via some sort of runtime sandbox, such as Flatpack or similar. This does not modify the root filesystem in any way, and therefore cannot cause an issue at that level. There are additional benefits to running sandboxed applications without access to the root filesystem, such as increased security, but that's a side effect. The main goal is system stability. I can update entire versions of the OS (say, Fedora 38 -> 39, which I did recently) without any worries my system will be unbootable afterwards. It's not a possibility, barring any hardware issues. Immutable OS' are a great concept, and will be the future for all "normal" computer users. Many consumer-facing OS' are already immutable, even if they don't advertise as such. These include Android and iOS, ChromeOS and more (with some varying degrees of immutability). These systems are also the least likely to need a wipe/reset once-in-a-while - something Windows users have grown accustomed to.

TheCoelacanth 3y ago

Immutable = no updates is just a complete misunderstanding of what an immutable OS is. In fact, it's the exact opposite. It makes it much easier and safer to update because you can immediately roll back to a working version if something breaks.