So basically we're going back to the DOS model for operating systems? Sounds good to me.
What is Silverblue?
101–110 of 140 posts
Re: What is Silverblue?
#102Sounds similar to what Apple’s doing with Catalina. On https://www.apple.com/macos/catalina-preview/ they say: Dedicated system volume. macOS Catalina runs in its own read-only volume, so it’s separate from all other data on your Mac, and nothing can accidentally overwrite your system files. And Gatekeeper ensures that new apps you install have been checked for known security issues before you run them, so you’re alw…
That sounds like the way Android partitions work.
Linux, the BSDs ...
Re: What is Silverblue?
#103Earlier quoted context omitted.
Also with NixOS you can install a package and start using it immediately, whereas with SilverBlue you first have to reboot the system to use the new package or after installing updates (or use one of the experimental live update features that tend to break booting the system). If you don't change the set of installed packages often, and reboot your system daily to get the updates, then SilverBlue works quite nicely.…
In Silverblue, your /usr is really immutable, so when you install package, you are installing it into different tree than the one currently running. Reboot switches to that newly constructed tree.
Is there a dev version of silver Blue where you can install/remove package on the fly, and maybe commit and reboot once you're ready?
Re: What is Silverblue?
#104The scope seems to be pretty similar to: https://nixos.org/
or Ubuntu Core https://ubuntu.com/core
Re: What is Silverblue?
#105Basically : the OS is itself a layered read-only "container", on top of which flatpak is the recommended way to install applications. I wish someone built an OS based on k8s as a service and application orchestrator. We wouldn't have to reinvent all the config files, the command line tools and we could reuse knowledge between cluster and single-machine administration. Plus k8s already voluntary abstracted the underly…
I think that idea isn't really viable until we have a serious microkernel contender. We'll see how hurd goes, but personally, I'd put more stock in fuscia. A microkernel with a massive comlamy behind it (which employs much of the best software engineers there are and fully intends to bring it to market) is a seriously cool thought. Maybe we'll see debian 11/fuscia some time (though arch will still be better).
Re: What is Silverblue?
#106As a Linux user from the 90s, I welcome this change. RPM Hell and its Debian equivalent are real and painful things. When disk space was a premium, system dynamic linking made sense. Today, it absolutely does not. rpm-ostree is a bit ugly. Snap has the right idea of doing both system services and apps. Fedora should do the same.
While I can appreciate the security advantages of snap packages, I can't help but resent the fact that the output of the mount command is now polluted with dozens of lines unrelated to mounted disks.
Try findmnt(8) like:
findmnt --df --typesRe: What is Silverblue?
#107Earlier quoted context omitted.
It's based on a piece of technology called "ostree". Fetching updates means downloading new objects from a remote object store, setting up a hardlink farm in a special location in disk (somewhere like /ostree/deploy), and during early boot, it will switchroot into there. So you can have multiple "filesystem roots" (directories on the same rootfs) and the mechanism can set things up to atomically swap between them, wi…
What's to stop malware from modifying the hardlinks and injecting dodgy processes during the next reboot ?
The immutability of the OS is not, alone, meant as an in-depth security measure. Don't run malware as root. If you want a fully trusted boot system, you'll have to use features like Secure Boot to verify that the BIOS and bootloader have not been tampered with.
ostree supports signing commits and trees with GPG signatures, and like git, all objects are content-addressed by SHA256 hash, so it is possible to verify that the entire root tree and all objects within it have been signed by some trusted party.
Re: What is Silverblue?
#108Re: What is Silverblue?
#109Earlier quoted context omitted.
In Silverblue, your /usr is really immutable, so when you install package, you are installing it into different tree than the one currently running. Reboot switches to that newly constructed tree.
Is there a dev version of silver Blue where you can install/remove package on the fly, and maybe commit and reboot once you're ready?
`ostree admin unlock` will make the current image writable.
Re: What is Silverblue?
#110How is this different from traditional embedded Linux system? Most firmwares have a read-only rootfs.