Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What is Silverblue?

fedoramagazine.org

Post reply on HN
Print view View original

81–90 of 140 posts

Re: What is Silverblue?

#81

Post by e2le »

axaxs wrote: post #18
KUcxrAVrtI wrote: post #16

Earlier quoted context omitted.

>system dynamic linking made sense I too look forwards to having to manually updated all security patches for each binary in the system.

Would you rather each update of said binary be dependent on the author or some volunteer? That's how you get Debian stable.. No thanks.

I prefer the quality control that something like Debian stable provides, developers aren't always interested in packaging their application the right way or are just ignorant of how to package their application for one of many distros all with their own package format and tools.

Re: What is Silverblue?

#82

Post by 0815test »

aleks_me2 wrote: post #61

Oh no. The benefit of Linux is to be able to build your own Setup (Server,Desktop). Now with this "Solution" the user have more and more a closed System where every change creates a lot unnecessary steps to install another software. I agree that on servers the container runtime makes a lot of sense but not on Desktops where changes happen every day.

You'll always be able to roll your own. What this is about is like running a live distro w/ "persistence", except from your own hard drive instead of external media. With comparable benefits and drawbacks, I assume - in fact some of the drawbacks of live distros could be avoided, since you could have an "initial setup" (adding users, hardware detection, basic config etc.) the results of which are persisted.

Re: What is Silverblue?

#83

Post by ForHackernews »

robin_reala wrote: post #77

Sounds similar to what Apple’s doing with Catalina. On https://www.apple.com/macos/catalina-preview/ they say: Dedicated system volume. macOS Catalina runs in its own read-only volume, so it’s separate from all other data on your Mac, and nothing can accidentally overwrite your system files. And Gatekeeper ensures that new apps you install have been checked for known security issues before you run them, so you’re alw…

That sounds like the way Android partitions work.

Re: What is Silverblue?

#84

Post by wwright »

tannhaeuser wrote: post #74
aleks_me2 wrote: post #61

Oh no. The benefit of Linux is to be able to build your own Setup (Server,Desktop). Now with this "Solution" the user have more and more a closed System where every change creates a lot unnecessary steps to install another software. I agree that on servers the container runtime makes a lot of sense but not on Desktops where changes happen every day.

I agree, and I whish others could see this as what it is - a push to make everything so overcomplicated and repository-locked in the name of security that you need endless maintenance and a support contract to run even basic software on your PC, thereby taking F/OSS ad absurdum . When in reality we haven't seen significant end-user F/OSS in almost a decade.

On workstations and laptops, no, but I work in enterprise and a _lot_ of Linux appliances out in the wild could benefit from this.

Re: What is Silverblue?

#85

Post by pas »

saagarjha wrote: post #67
barrkel wrote: post #48

Earlier quoted context omitted.

Even when the processes are loading the libraries from different paths, in different filesystems, in different containers? How does it page in data on demand if the first container that loaded the library is killed and its filesystem unloaded? It's not easy to share libraries across containers, unless they can be built to share a base layer in a stacked union filesystem approach.

Why can’t the linker deduplicate libraries as they’re loaded?

kernel samepage merging already exists

Re: What is Silverblue?

#86

Post by wwright »

michaelmrose wrote: post #35
wmf wrote: post #25

Earlier quoted context omitted.

The brave new OSTree/Flatpak world needs build systems that know how to do security updates. There's a lot of work in this area in the Dockerverse; maybe it will cross over.

What happens is that half of your security updates never happen because it depends on individual app providers who have no skin in the game to do so this is unfixable unless apps that are insecure aren't installable.

Before Silverblue, Red Hat and Fedora maintain a list of custom build scripts for all packages that apply patches and security updates.

After Silverblue, when they run in Flatpaks, they can still maintain build scripts that achieve the same thing.

The distribution itself can even maintain a common base image for all flatpaks in the official repos, retaining all of the code sharing of existing systems, but with the benefit of a more robust and modular solution when they need to make exceptions. End users will also be able to more reliably use applications that are not supported by the distribution proper.

Re: What is Silverblue?

#87

Post by davidmr »

tannhaeuser wrote: post #74
aleks_me2 wrote: post #61

Oh no. The benefit of Linux is to be able to build your own Setup (Server,Desktop). Now with this "Solution" the user have more and more a closed System where every change creates a lot unnecessary steps to install another software. I agree that on servers the container runtime makes a lot of sense but not on Desktops where changes happen every day.

I agree, and I whish others could see this as what it is - a push to make everything so overcomplicated and repository-locked in the name of security that you need endless maintenance and a support contract to run even basic software on your PC, thereby taking F/OSS ad absurdum . When in reality we haven't seen significant end-user F/OSS in almost a decade.

What evidence to you have to suggest this extremely uncharitable interpretation of the Fedora project’s aims?

Re: What is Silverblue?

#88

Post by Jasper_ »

arendtio wrote: post #79

How do they do things like security updates (e.g. OpenSSL)? I mean, if the system is immutable, do I have to download an install a completely new image? How often do such updates arrive? And what does immutable even mean in practice? Do I have to start from a CD image or some special boot mode every time I want to install system updates?

It's based on a piece of technology called "ostree". Fetching updates means downloading new objects from a remote object store, setting up a hardlink farm in a special location in disk (somewhere like /ostree/deploy), and during early boot, it will switchroot into there. So you can have multiple "filesystem roots" (directories on the same rootfs) and the mechanism can set things up to atomically swap between them, without wasting much file space (anything shared between them is shared, since it's hardlinks).

The details can be found in the ostree documentation: https://ostree.readthedocs.io/en/latest/manual/atomic-upgrad...

Re: What is Silverblue?

#89

Post by Jasper_ »

paulcarroty wrote: post #50

Concept is interested, but read-only rootfs is stupid, really. It's kind of lock-in. Of course, ro - great for security, but if something happens with any critical system component like bootloader - I prefer to able patch/fix it myself and don't wait days/weeks for distmakers. Clear Linux use similar concept, but they allow write access and handle whole fs tree and bundle depends on server side.

If you know how, there's an escape hatch.

There are basically multiple filesystem trees under the hood (shared with hard links to avoid duplicating file data), and at boot time you'll get one of them. These are known as "OSTree deployments", and they're found in /ostree/deploy, and they're actually mutable, it's just the bind mounts into that location that are mounted RO.

Anything in the bootloader configuration is not part of the deployment (from what I remember), and so it's mutable.

See the docs here: https://ostree.readthedocs.io/en/latest/manual/deployment/

Re: What is Silverblue?

#90

Post by [deleted] »

arendtio wrote: post #79

How do they do things like security updates (e.g. OpenSSL)? I mean, if the system is immutable, do I have to download an install a completely new image? How often do such updates arrive? And what does immutable even mean in practice? Do I have to start from a CD image or some special boot mode every time I want to install system updates?

[deleted]
Post reply on HN