I’m considering trying out an immutable distro after using Tumbleweed for the last 6 years.
The two major options for me seem to be Fedora Kinoite or uBlue Aurora-dx
My understanding is that universal-blue is a downstream of Fedora Atomic
So, the points in favor of Kinoite is sticking closer to upstream, however it seems like I would need to layer quite a few packages. My understanding is that this is discouraged in an rpm-ostree setup, particularly due to update time and possible mismatches with RPMFusion
uBlue Aurora-dx seems to include a lot of the additional support I’d need - ROCm, distrobox, virt-manager, libratbag, media codecs, etc. however I’m unclear how mature the project is and whether it will be updated in a timely manner long term
I’m curious what the community thinks between the two as a viable option
Distrobox updates automatically on Bluefin and Bazzite.
In this case we disagree with Fedora, Atomic Fedora should not have Firefox in image. It does not matter to us what they do, we explicitly remove it.
If you like the way Fedora builds their Firefox RPM, that’s all the more reason for you to use a fedora distrobox.
Irrelevant. Not everybody does. Some people pin an old image due to a bug and sit on a far older image. If you had it your way, they’d be using a week or month old build of Firefox – that’s unacceptable.
Good. I can promise you if that gets fixed and I have a way to continue to prevent it, I will.
This is an issue for Mozilla. They are happy enough with the state of the Flatpak to not only verify it, but list it on their website. Unless you’ve got a CVE for the Flatpak version of Firefox I don’t see any point in even engaging with this argument.
True, forgot that you use topgrade
There are many relevant issues and it is not a clear choice.
Yeah and nobody knows about user namespaces or seccomp filters. This is about at least 2 user groups and one is not necessarily more important than another.
It is again not a clear choice.
* in your opinionated images, I hope.
You start to sound like a GrapheneOS dev. It makes no sense to prevent users from reinstalling removed packages.
Which btw also include the Fedora Flathub repository.
We no longer touch the repos as Fedora is now in agreement with using Flathub.
It’s for user security. I have no interest in debating this decision, my reasons are outlined.
As said, this has pros and cons. I will try the Distrobox method though.
You also didnt answer to the security issue of removing an entire sandboxing layer, or to the point about not being able to upgrade Distroboxes.
Do you solve the second problem by building a
latestdistrobox container following the uBlue releases?We solve this problem by treating distroboxes as cattle and not as pets. Blow them away at any time.
So what happens to the apps installed?
And what about running different distros in the same homedir, and dotfile clashes?
Use the distrobox assemble command, that’ll let you have an ini file with all the stuff you want and then when the assemble command runs it’ll remake the entire thing. Then just toss the assemble in cron and you’ll always have a fresh container with your exact setup.
Interesting, never used that, thanks!