Ubuntu Details Initial Plans For Immutable Linux Desktop With Ubuntu Core & Snaps

[phoronix]

Phoronix: Ubuntu Details Initial Plans For Immutable Linux Desktop With Ubuntu Core & Snaps

For next year's Ubuntu 24.04 LTS release, Canonical is planning to offer an Ubuntu Core based immutable desktop OS flavor as an alternative to the traditional Ubuntu Desktop image. A new Ubuntu.com blog post today outlines Ubuntu Core usage for an immutable Linux desktop...

https://www.phoronix.com/news/Ubuntu-Desktop-Immutable-Plans

[V1tol]

Ubuntu Core with Snaps

My Ryzen 5950X: finally a worthy oponnent; our battle will be legendary.

[uid313]

I don't care much for an immutable OS but would love to see the PDF reader, email client and media player packaged as Snap and sandboxed.

[sarmad]

Very promising. If this works as expected it will no doubt push Ubuntu back to its glory days.

[skeevy420]

Since I know I can't be the only one who looked at that flow chart and wondered WTF is a gadget:

• Gadget: Defines the system’s bootloader, partition layout and default configurations for snaps.
• Kernel: Containing the Linux kernel and hardware drivers.
• Base: A minimal Ubuntu OS image containing only the necessary services and utilities to support the applications running on top.
• Snapd: Manages the lifecycle of all snaps in an Ubuntu Core system.

On the whole their idea isn't a bad one, especially for servers and single-purpose devices. It'd be cool if it was modular enough that distributions like Mint can replace Snap with Flatpak. I could care less about Snap vs Flats, but I know that kind of a decision can affect whether or not their downstream distributions make atomic editions.

[kylew77]

SO, how is the security of an immutable OS like this? Is it a lot higher than normal or no?

[evasb]

As much I don't like snaps, I think this is an appropriate usage for it. What I don't like is snaps for GUI apps, in that I think that Flatpaks are a much better choice.

[szymon_g]

I don't care much for an immutable OS but would love to see the PDF reader, email client and media player packaged as Snap and sandboxed.

good luck waiting for that.

[spyke]

Since I know I can't be the only one who looked at that flow chart and wondered WTF is a gadget:

Gadgets are just driver snap packages. But boot loaders and some other stuff are also gadgets.

The difference with Fedora Silverblue and other OSTree-based distros is that in OSTree your base OS layer just follows a git branch and updates as a whole. In Ubuntu the base layer is split into several components (gadgets, kernel, etc). So, you may choose your own kerner channel different to the default and install different/less/more gadgets that you need. And they all will update at their own pace depending on the chosen snap track/channel. So, it is more flexible for simple users, but less space efficient than OSTree, which shares files between snapshots (just like git shares object between commits) while snaps do not (yet). Not the worst trade-off.

[skeevy420]

SO, how is the security of an immutable OS like this? Is it a lot higher than normal or no?

Depends on your perspective. I'm a big believer of security via obscurity and being different so I think they're less secure since they offer fixed point targets like a game console or a mobile phone. Hackers and governments have fixed targets to try and access over multitudes of varying configurations. Other people would say more secure due to the read-only root and things of that nature, but there are plenty of examples of read-only fixed point hardware being remounted read-write from one exploit or another. I once remounted an Xbox read-write with a Splinter Cell save game. The pre-modchip days.

Realistically, in actual practice, they're no more or less secure than any other Linux operating system where it all comes down to the competency of the sys admin(s) and your standards and practices in regards to security and access. IMHO, these operating systems are just as much about having repeatability and dependability as they are with security.