The recording of my #AllSystemsGo 2026 talk is up: “Immutable, Fully-Confined Debian Server Images, Even on a Raspberry Pi 3”.
A minimal Debian server built with mkosi and apparmor.d: UKI, A/B updates, dm-verity, a whole-system #AppArmor policy and an immutable /etc from signed confext images. Same image on x86-64 and a Pi 3, with different attacker models.
Video: https://www.youtube.com/watch?v=5Kft4nlDKR8
Slides: https://cfp.all-systems-go.io/all-systems-go-2026/talk/KJNYQ8/