Unfortunately, I’ve yet to experience Qubes OS myself. So I can’t help you with that. Wish ya the best of luck though!

I hope at least the earlier problems with distrobox have been solved.

Is your intention to go in the direction of Qubes OS with extra steps?

Yo OP, did it work out in the end?

Thanks a ton for the elaborate answer!

I’ve moved to cachy OS mainly because I needed to get certain things working that were only packaged in appimage

Hmm…, I’m aware that the AppImage situation is pretty dire since it requires FUSE 2 libs while everyone and their grandmothers have moved to FUSE 3; software that’s been almost out for a decade now. Thankfully, I’ve never actually experienced trouble getting it to work on any distro. Sure, installing some libs was often required, but nothing too fancy.

BUT I believe I could have worked it out in Aeon by fiddling around with distrobox

FWIW, I’m 100% positive that you could get it to work on Aeon. IIRC, I’ve also used AppImages through distrobox containers.

I think once there is a mature wayland-based Openbox replacement

Interesting. If it isn’t too much of a trouble, could you pitch Openbox :P for me? I’m not too familiar with it, but you did get me curious.

(eyes on labwc)

Put into my backlog of stuff I’ve got to checkout.

I was hoping that this reply wasn’t needed 😅. In all fairness, some of the replies found on ycombinator definitely offer legitimate criticism. However, secureblue’s dev team didn’t just ignore all of that as they can be found discussing on the very same thread. Since then, they’ve actually implemented changes addressing these concerns. For example:

Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege. And flatpak is a lot of attack surface no matter how you run it, and the packages have a bad security reputation.

This was raised as a good objection to some of its design choices. This eventually lead secureblue’s dev team to maintain twice as many images for the sake of offering images in which this was handled differently. And it didn’t stop there, it has continued to output a lot of work addressing concerns both found on that thread and outside of it. Consider looking into its commit history. Heck, even some of the GrapheneOS-people have provided feedback on the project.

Of course, no one dares to claim it comes close to Qubes OS’ security model. Nor is this within scope of the project. However, apart from that, I fail to name anything that’s better. Kicksecure is cool, but they’ve deprecated Hardened Malloc; a security feature found on GrapheneOS and that has been heavily inspired by OpenBSD’s malloc design. By contrast, secureblue hasn’t abandoned it. Heck, it elevated its use by allowing it to be used with Flatpak; something that hasn’t been done on any other distro yet. This is just one example in which the secureblue dev team and its various contributors have shown to be very competent when it comes to implementing changes that improve security beyond trivial checkboxes.

Peeps may name other hardening projects. But fact of the matter is that I’m unaware of another hardened Linux project that’s quite as feature-rich:

• Tails; cool project that does wonderful work against protecting one against forensics. But that’s literally it. It’s not even meant as a daily driver.
• Whonix; developed somewhat together with Kicksecure, so this one actually has put in substantial work into hardening. But, again, not meant to be used as a daily driver.
• Nix-mineral; cool project, but it’s still alpha software by its own admission.
• Spectrum OS; great idea, but it’s not even out yet.

Please feel free to inform me if I’ve forgotten anything. So, basically, if you want a hardened daily driver for general computing, then one simply has to choose between Kicksecure and secureblue. I wish for both projects to flourish, but I’ve stuck with the latter for now.

Do you run Steam inside gamescope as well ?

Nope I don’t. But that’s because running Steam isn’t really a thing for me to begin with. I don’t own my games through Steam aside from a couple that are only accessible through it. Whenever I need to play those, I access those through another system; be it another distro or (God forbid) M$. For the games I’ve played on secureblue, none of them were owned through Steam. Hence, running Steam inside gamescope has not been something I had to do yet. Unsure, if it even works as supposed.

Does your setup support casks ?

I actually don’t know. It probably doesn’t, though. EDIT: Found the following within Bluefin’s documentation: “Note that the cask functionality in homebrew is MacOS specific and non functional in Bluefin, flatpak is used instead.”

That was a great read. Wonderfully detailed. Thank you!

It’s a pity that it went down like that. Would you say that a properly matured openSUSE Kalpa would be your perfect setup? Out of curiosity, have you used projects related to Fedora Atomic for long periods of time? If so, how would you compare them?

I’m glad to find that the general perception on CachyOS has definitely changed for the better. I believe it was two or three years ago when I stumbled upon CachyOS for the very first time. I don’t think it did anything noticeably different back then compared to now. But as it was still relatively new, people didn’t quite jump on the bandwagon. As such, I actually received quite a bit of condemnation whenever I tried to recommend the distro to others. I’m glad to see that it’s currently flourishing. Congratz to the CachyOS team for sticking to their guns. Whenever a product is good, it will eventually receive recognition.

I put it on my partners computer after Aeon crapped itself and put the system in a boot loop until I switched the hard disk out.

It is only release candidate software. As such, I didn’t have high expectations. However what you’ve described here is pretty troublesome. And I’d imagine your partner didn’t do crazy stuff that would justify such a reaction by the OS.

I’m personally very interested in the future of openSUSE Aeon. So far, I’ve mostly seen positive reactions. Therefore, a negative experience as such really piques my interest. If possible, could you elaborate upon what had transpired before the system broke? Or perhaps your partners personal experience with the distro in hindsight.

Try invoking ujust distrobox-assemble first. This command is also found on the FAQ page. Enter the container created through this method.

FYI, the userns images have been (or are about to be) deprecated.

Under the USERNS caption of the FAQ , there’s a link to another entry. In there, you may find the following command: ujust toggle-container-domain-userns-creation. After invoking this, distrobox should at least start working.

Do you use GNOME?

Yes, I do! I personally prefer GNOME over other DEs anyways, so I’m absolutely fine with that.

They disable GNOME extensions. Did you turn it back on?

They disable the installation of GNOME extensions by users. But, system-wide GNOME extensions are enabled by default. So, GNOME extensions that are found in Fedora’s repositories can be installed right out of the box. Thankfully, all my extension needs are taken care of within the extensions found in Fedora’s repositories. So, this doesn’t constitute a limitation for me. Curiously, I’ve actually installed extensions through this method ever since I recognized how the other way wasn’t remotely as secure. So this (relatively recent) change by secureblue to enforce it upon everyone (at least by default) came as a pleasant surprise.

Did you re-enable XWayland?

Nope. I initially had troubles with playing games through Wine. But I’ve learned how to use gamescope for that instead. Currently, I’m honestly unaware of anything I’d need XWayland for. Wayland development has come a long way. And while I’m sure some systems and/or workflows don’t play nice with it yet, for myself (pure) Wayland is all I need.

Do you use bubblejail?

Currently, I don’t think I’ve got any use for it:

• The only layered packages are the aforementioned GNOME extensions. I’m unaware if bubblejail can be used to sandbox these. But I’ll look into it. Thanks for bringing this up!
• My GUI apps are taken care of by Flatpak. Which, AFAIK, utilizes bubblewrap already for its sandboxing.
• My CLI apps are taken care of by Linuxbrew. Perhaps these can be sandboxed using bubblejail, but I wouldn’t even know. Thanks for reminding me of this (potential) blindspot!

Also, I’ve heard about the dev(s) and community being a bit toxic, or at least not being a pleasure to collaborate with. But I can’t verify that.

FWIW, this hasn’t been my own experience. If anything, it may give of some “know-better”-vibes like one might recognize from engaging with some of GrapheneOS’ community members.

Does anybody in this sub using Fedora Secureblue?

I do. And have done so for almost a year now.

What is your opinion?

It’s pretty neat. Though, don’t expect to roll your way in without any troubles if you don’t take the effort to read its documentation. Fedora Atomic already does things its own way. However, secureblue, by virtue of its superior security standard, adds its own set of ‘rules’ that one should abide. Personally, I absolutely love how this is enforced. But I can understand why it might be a bit overwhelming for those new on the block. But I have personally helped introduce relative newbs to secureblue and they managed (with some help). So you should be fine; their community on Discord also has been pretty helpful in my experience.

So, if your first priority for your desktop operating system is for it to be Linux-based and your second priority is that it’s properly hardened, then you simply can’t go wrong with secureblue.

I was about to write a long piece comparing different security-focused systems, but I retracted for the sake of brevity. Please feel free to ask a specific comparison if you will.

Sorry for late response.

Also didn’t know about secureblue

Yup. It’s a relatively new project and doesn’t try to be very newbie-friendly. Hence, will not be talked about commonly in threads. Rightfully so, as I’d argue exquisitely hardened systems simply have to prefer security over convenience.

But it’s definitely neat and had its fair share of users. As the folks over at GrapheneOS and Privacy Guides seem to be enthusiastic on it, I wouldn’t be surprised if it receives a new influx/stream of users once community members of GOS have launched a dedicated website on it (which is already in the works) and the peeps responsible for PG’s recommendations have finally included secureblue as their de facto Linux recommendation.

hopefully it can all work together

So do I 😊!

Thank you for the chitchat! I wish you the best!

That sounds a bit funny, when those technologies are just (despite me not liking to use this term) inferior

Perhaps I should have worded that better 😅. It was meant as a textbook example of status quo bias; anything found by default on a ‘product’ that’s deliberately opinionated will see its audience gravitate towards said defaults. Even if those defaults are inferior to other options.

So, in this case, uBlue initially had a script within ujust (or just) that installed the Nix package manager. It wasn’t necessarily the perfect fit, but it definitely had its use cases:

• Installation of CLI software was better handled by Nix than the alternatives (read: either Toolbx/Distrobox or layering with rpm-ostree)
• Flatpak was even more restricted than today. So Nix offered an additional avenue for installing GUI software without layering.
• The nixpkgs repository supersedes even Fedora’s own repositories in terms of available packages, effectively making it their atomic AUR.

But then, not long after the troubling conflicts between Nix and SELinux, brew was inaugurated as the de facto alternative for CLI and the rest is history.

in terms of packaging, only flatpak really shines because of its embedded permission model

Yup, can’t agree more.

Yeah, I think you should at least give it a shot and see how you like it, it’s not as easy right out of the box as the other 2 you mentioned, of course, so you should find out for yourself what you feel more comfortable using.

FWIW, I have actually used Nix sparingly in the past. IIRC, it broke on me at some point 😅. That could be on me, though. Unfortunately, I don’t recall the details. It could also be related to the hardening found on secureblue.

I agree 😜.

lol. I initially had a better written reply that I was about to send, but I clicked on cancel instead of reply. RIP.

First of all, thank you for sharing your own experiences!

Secondly, in short, looking at the discord servers that are related to the uBlue project, general folk seem to have moved past Nix and use flatpak and brew instead for GUI and CLI respectively. Though, some community members happily report to be content with Nix. So, perhaps I shouldn’t be necessarily opposed to home-manager.

Finally, I didn’t expect to find a crossover between brew and chezmoi to effectively become a quasi-home-manager.

Honestly, you could be absolutely right. I haven’t revisited Nix since Bazzite Buzz #12 informed us on the following:

“The Nix ujust script has also been removed due to conflicts with SELinux policies. Users can still install the Nix package manager manually if they so desire at their own risk.”

However, the above could be outdated; I simply don’t know. Are you aware of any developments that have changed things for the better?