Ubuntu Developing "crypto-config" For System-Wide Cryptography Configuration

[egorfine]

the entirety of Ubuntu including the kernel is not only atomic but snapped.

Is this sarcasm or are there plan to make ubuntu... like this?

I'm genuinely asking because it's hard to tell these days. Some things that were once thought to be absurd are not part of core systemd.

[adrien-n]

The catch is that most things I might want to secure these days run in containers... where such system-wide configuration is irrelevant. And conversely, anything not in a container is probably something I'm happy to trust to OS-shipped defaults.

(Again, author here)

Whether we'd want this system-wide configuration to apply to containers is an open question at the moment. Indeed, containers are used for separation but you might also expect system-wide configuration to apply inside containers. I'm not sure there is a one-size-fits-all answer. In any case, I don't see a technical issue.
Configuration is done with profiles and if you're using the same distribution on the host and in the containers, the profiles will be the same, so that the only data you need to pass to the containers is the profile name you want. Moreover, profile switching is merely a symlink and you can do that in your image recipes.

There could be smarter algorithms for profile choice forwarding: the "modern" profile on Ubuntu 24.04 and 18.04 wouldn't mean the same thing. It's also possible that profile could receive updates over time to adapt with landscape changes, in which case, the meanings could be fairly close across versions. Anyway, I think it's probably too early to settle on something and fortunately, we don't have to decide today.

Lastly, I wanted to mention that goes together with an effort to ensure that these choices are actually respected by all the software in the distribution. Seemingly innocuous features or choices are often in the way because if you merely change a library's default but an application has its own default configuration, your changes will be overwritten by the application. Sometimes, the application's default also go without updates during many many years and what was advanced becomes deprecated.
The situation is actually quite messy across the many thousands of free software libraries and applications; there is a lot of work to make everything consistent and without surprises.