Selfhosted

40667 readers

306 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

Silverblue or other immutable on remote VPS? (self.selfhosted)

submitted 3 months ago by aordogvan to c/selfhosted

29 comments fedilink hide all child comments

Does anyone know of a hosting service that offers Silverblue as a possible choice for OS?

It seems to me that for a server running only docker services the greatly reduced attack surface of an immutable distro presents a definitive advantage.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 5 points 3 months ago* (last edited 3 months ago) (11 children)

An attacker escaping from a container can’t be system root as Podman runs rootless (without some other exploit or weak password).

That would be true of podman running anywhere, and is not unique to an immutable distribution.

The filesystem itself is also read-only.

You can change that real quick if you have root access.

[–] asap 1 points 3 months ago* (last edited 3 months ago) (10 children)

edit: "Immutable" means "all of them are the same", not "unchangeable".

~~You sound confident, but the fact that Fedora is using the term "immutable" makes me wonder if you actually have domain expertise here.~~

~~Immutable means immutable. It would be strange for them to call it that if it actually means "completely irrelevant from a security perspective".~~

~~Unless you provide some evidence to the contrary I'm going to assume you aren't correct.~~

[–] [email protected] 6 points 3 months ago (1 children)

The immutability isn't designed to protect against a malicious attacker with root access.
Any system is fucked if that happens.
It's designed to reduce the workload of the maintainers, because they effectively only need to test and build for one standard image.

[–] asap 3 points 3 months ago

Makes sense. An "immutable" distro provides no additional security benefit, however CoreOS does have a reduced attack surface area compared to other distros, which itself is a benefit.

load more comments (8 replies)