Linux

48721 readers

2262 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

ELI5: What is an immutable OS, in practical terms? (feddit.de)

submitted 2 years ago* (last edited 2 years ago) by [email protected] to c/[email protected]

32 comments fedilink hide all child comments

I've heard of immutable OS's like Fedora Silverblue. As far as I understand it, this means that "system files" are read-only, and that this is more secure.

What I struggle to understand is, what does that mean in practical terms? How does installing packages or configuring software work, if system files can't be changed?

Another thing I don't really understand is what the benefits as an end user? What kinds of things can I do (or can be done by malware or someone else) to my Arch system that couldn't be done on an immutable system? I get that there's a security benefit just in that malware can't change system files -- but that is achieved by proper permission management on traditional systems too.

And I understand the benefit of something declarative like NixOS or Guix, which are also immutable. But a lot of OS's seem to be immutable but not purely declarative. I'm struggling to understand why that's useful.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 27 points 2 years ago (1 children)

An immutable distro, to my understanding, locks core components of Linux (mainly /sys afaik) from interaction from not only bad actors but also the user so that you can't fuck up you're system in a way like Linus from LTT (removing X11 by forcefully ignoring all warnings). Applications can be installed as Flatpak, AppImage, Snap or through OverlayFS from regular repositories.

Advantages to (non- tech savvy) users are an additional layer against their own mistakes and easier support since the important stuff is identical on every install of the given distro.

[–] [email protected] 17 points 2 years ago (1 children)

This is, IMO, the biggest yet least obvious advantage of immutable systems. A traditional Linux environment is "just as safe" as the immutable setups, if only the user/administrator is perfect, never makes a mistake, and always makes the right decisions for now and the future.

Given reality tends to differ from the above, having a system that, at a bare minimum, provides you the "oh shit go back" button to system-level changes, and at best provides a clear, reproducible, trail of actions, is a huge advantage for long-term stability for all users, experienced or not. I've been through the school of hard knocks far too many times maintaining everything from server setups to gaming desktops the traditional way, and have committed to "early adopting" immutable distros for pretty much everything except the gaming setup (given the whole suite of proprietary and out-of-date/out-of-touch applications that are basically necessary in that space and not-fully-compatible with the sandboxes and abstraction layers necessary).

[–] [email protected] 1 points 2 years ago* (last edited 2 years ago)

You don't have to be perfect or make zero mistakes. You just have to be careful with a couple things like sudo rm -rf and overriding warnings when you try to uninstall system packages. This is not rocket science and has not been for decades. The average user is not the worst-case user. More frequently something specific is broken, like ssh, so that it would be more useful to have file versioning.