#ostree — Public Fediverse posts

#RicochetRefresh and #Arti build on #Fedora Atomic #OS.
#rustlang environment is also functional in #rpm #ostree.
(#immutability over sandboxing if not live?)
#FreedomOfThePress #Journalism #ComputerScience #Linux @freedomofpress @torproject

jk, Rotational #HDD and #Rust work together just fine.
Anomalies and vulns in #QubesOS . . .
#console #hacking #rpc #Wayland #fastly @rust

Foreign Sources as attack vector
http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/Install_Software#Foreign_Sources
also → APT::KashGrow “true”;

What other flaws might lie in confidential computing core trust mechanisms?
https://www.theregister.com/security/2026/07/04/confidential-computings-trust-mechanism-is-broken-the-fix-may-not-exist/5266056
@QubesOS @whonix
#attestation #TLS
@rfceditor #GOS

also, in case you didn't know,
rpm-ostree kargs --append=
is really great
and rpm-ostress works over torsocks, atomic just doesn't like systemd so run 'tor' manually

#Karg #Kernel

Those of us on #atomic distros - how do you install bash tools like #nmap, #telnet etc that arent in the base image?

I have been building my own sysext, which, is a lot of work and needs to be manually updated from time to time, but I had someone suggest the #brew repos as an alternative.

I previously aliased #distrobox commands

I try not to layer on my ostree, as it slows down updating so badly.

Comment if you do something else

#ostree #immutable #fedora #linux #tech #question #poll

Can someone tell me why #bootc is a replacement for #ostree? It seems like a solid downgrade.

Ostree has better download semantics, while bootc literally... clones container layers. Ostree lets you create temporary and permanent overlays. Bootc asks you to "maintain" your own container image. The temporary overlay solution is to use sysexts overlays, which is far more restrictive.

There are many other points that I'm forgetting right now.

So why is ostree being sunset in favour of bootc again?

#fedora #coreos #bootc #ostree #immutable #atomic #linux

@britter No, I do not.

Fedora Kinoite and U-Blue Aurora (and Fedora Silverblue ...) are based on container images. So when doing an upgrade or update, actually you are just jumping from one image version to another under the hood.

As they are immutable, most of the system is read-only. Which includes the root partition, so creating the `/nix` directory is not possible.

So my simple solution back in 2023 was to build my own container image that only creates that directory. During the image build this is still possible.

But now this fails, as the base image has too many layers already and docker runs into issues in the GitHub Action.

Hence I need to find another solution. Getting rid of the container image would be good, because why have a container image for just a directory...

#Fedora #Kinoite #ostree #docker

I'm judging distros by the ability to remediate #copyfail and anything #fedora #ostree based right now is failing hard. That applies to #bluefin and #bazzite transitively.

# rmmod algif_aead
rmmod: ERROR: Module algif_aead is builtin.

#nixos does not have this problem, I can rmmod there just fine.

Dear ostree users out there (on Fedora, RHEL, Bluefin, Aurora, Bazzite, ...),

has anyone of you ever seen an error regarding "invalid gzip headers" during a "rpm-ostree upgrade"?

[...]
[2/98] Fetching ostree chunk 53a115d85164231992f (46,2 MB)... done
error: Importing: Unencapsulating base: Layer sha256:53a115d85164231992fb38d82f836a36e9be489b15cfa415559419d164a7b6c0: Importing objects: invalid gzip header

I am building my own images to have the /nix directory available. Worked like a charm but suddenly stopped working for my Fedora43 image due to this error. The Aurora-with-nix image is fine, though.

Funnily enough, as my image only adds the nix directory, I only have one "custom" layer, everything else is from the upstream image. So I am puzzled on why this fails, why it fails for me and not for anybody/everybody else and why I do not find any issues related to "invalid gzip header" errors...

#Fedora #OSTree #rpm-ostree #Aurora #Linux #immutable #HellYeah #DevOps

🐧Bootc and OSTree: Modernizing Linux System Deployment

｢ OSTree is often described as “Git for filesystems”. It enables versioning, distribution, and atomic deployment of Linux systems. Rather than managing packages individually, OSTree stores complete system snapshots, making updates and rollbacks easier ｣

#boot #ostree #opensource #linux
https://a-cup-of.coffee/blog/ostree-bootc/

Bootc and OSTree: Modernizing Linux System Deployment

https://a-cup-of.coffee/blog/ostree-bootc/

#linux #immutableOS #OsTree #bootc

Esta es la realidad de #flatpak al actualizar: un par de megas o menos. Si el cambio es pequeño no hace falta "reempaquetar" todo y bajarlo entero. Por eso a #OSTree se le conoce como el git de los binarios.

Flatpak te sale a cuentas, por espacio, si usas todas las aplicaciones. Para una o dos no te vale la pena instalar tres o cuatro tiempos de ejecución.

OSTree без магии: атомарные обновления, репозиторий и клиентский образ своими руками

На Хабре про OSTree обычно вспоминают не как про самостоятельную технологию, а как про "то, на чём держатся" Fedora CoreOS / Silverblue / Kinoite и вообще вся тема immutable / atomic desktop / container-optimized OS . Это видно по типовым материалам: обзор CoreOS с объяснением rpm-ostree и layering, обзор Silverblue, новости/разборы релизов Fedora, где rpm-ostree фигурирует как механизм поставки базовой системы. При этом намного хуже покрыта практическая сторона "как сделать свой цикл поставки" : поднять свой OSTree-репозиторий, выпускать свои refs и раскатывать их на узлы так, чтобы можно было обновиться и откатиться , а не как герои трагикомедии "обновили пакеты — и внезапно утро не наступило". На фоне обилия статей "как устроен Silverblue/CoreOS" такой сценарий встречается реже. Мы раскроем полный цикл от публикации сервера до создания клиентских образов в этой статье.

https://habr.com/ru/articles/977760/

#linux #ostree #атомарность #туториал

A question to #Guix folks:

I'm having a hard time creating `/gnu` in #Fedora Kinoite which has immutable read-only filesystem and uses #OStree.

The question is: is it possible to have the `/gnu/store` somewhere else? For example `/var/gnu/store`?

ARCH LINUX BOOTC WORKS. I DECLARE THE LINUX ATOMIC AGE IS UPON US!

https://github.com/tulilirockz/arch-bootc

#arch #linux #bootc #cncf #podman #ostree #composefs

and here it is, after asking on the #Kinoite matrix channel dev Tim Ravier pointed me here https://pagure.io/releng/failed-composes/issues

and logs https://kojipkgs.fedoraproject.org/compose/updates/

Useful to see what is appearing in testing composes and when and why your testing branch box hasn't received anything in weeks 😆

#fedora #ostree #compose #fedoraatomic #kinoite #silverblue #linux

I've asked this before, and I'm pretty sure I already know the answer, but is there anywhere on the #fedora build servers to monitor when a new #ostree #compose has completed? something like #koji or #openqa ? maybe with a diff list?

#fedora #atomic #fedoraatomic #immutable #updates

#Fedora #OSTree: Update & #NVIDIA

Fedora OSTree mit NVIDIA proprietären Treiber Release Update. RPMFusion Abhängigkeit zur Version auflösen.

https://gnulinux.ch/fedora-ostree-update-nvidia

Fedora OSTree: Update & NVIDIA

Fedora OSTree mit NVIDIA proprietären Treiber Release Update. RPMFusion Abhängigkeit zur Version auflösen

#Fedora #rpm_ostree #ostree #Nvidia_GPU #Linux

https://gnulinux.ch/fedora-ostree-update-nvidia

If you are a maintainer of #nix, #nixpkgs or #nixos: listen up.

You've got about 2 years or so being a serious contender, until someone like #lix or even #ostree with #ComposeFS comes in and eats your lunch.

Part and parcel of that is the community, the language, the security of knowing that there is culpability and responsibility.

Linus Torvalds had to walk it off because an entire foundation told him to. If the nix "community" is beyond this, why give #DeterminateSystems contracts?

So... instead of going back to #FedoraAtomic, I'm going over to... #lix. Well tomorrow I'm going over to.

I'm on #NixOS now and the idea of going from #nix to lix intrigues me. It's just a change of the underlying tooling that interacts with the nix store, but I'm fascinated by the idea that you can compose NixOS using whatever tooling that works with it.

The nix store is then fully decoupled from nix and nixpkgs, making it more a competing standard against #ostree.

https://lix.systems/

Fedora Silverblue — мнение с точки зрения джависта

Привет, меня зовут Егор Гаврилов, и я хочу рассказать о Fedora Silverblue с точки зрения Junior Java Developer'а, который использует данный дистрибутив в качестве повседневной ОС.

https://habr.com/ru/articles/882920/

#fedora #fedora_silverblue #ostree

Ok, am I weird or does this make no sense? To pin an #ostree deployment in #fedora #atomic desktop you use e.g.

sudo ostree* admin pin 0

Naively, I always think it should be

sudo ostree admin unpin 0

to unpin it again. But no. My sweat summer child. Why, it's *obviously*:

sudo ostree admin pin --unpin 0

(I kinda get why it is that but I will never be able to remember that.)

*Why not rpm-ostree? So many questions.

#linux #bazzite #silverblue #NormieUser

I don't know who needs to hear this, but #System76 needs to rebase #PopOS. No shot, the current stable is 22.04... 22... 04.

#Ubuntu #Linux cannot be trusted, because snaps - and Shuttleworth - which means they have to go fully #Debian, which is respectable, but hear me out here...

#Arch + #ostree...

I can hear you booing from the back, and I can feel the glee of @BrodieOnLinux , but even though I like #Fedora I think competition is good and that #uBlue has that vector sown up. Also, #IBM.