28
Try Immutable Mode with openSUSE Leap 16.1 RC (news.opensuse.org)
submitted 1 month ago by to c/opensuse@lemmy.world
13 comments fedilink hide all child comments
 

openSUSE Leap 16.1 has entered the Release Candidate phase.

Usecase: Try the new Immutable mode

Leap 16.1 is the first Leap release to offer an Immutable Mode, a transactionally updated system with a read-only root filesystem. This is essentially what our users know from Leap Micro, just integrated directly into Leap.

Leap 16.1 in Immutable mode is replacing Leap Micro. There won’t be a Leap Micro 6.3 or 7.0; Leap Immutable is the way forward for container and virtual machine hosts, edge devices and anyone who prefers atomic updates with easy rollback.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 month ago (1 child)

I can't get into a discussion about something I know too little about it. But, it has a reduced attack surface. Do you agree on that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 month ago* (last edited 1 month ago)

    Some immutable distros like talos linux, have an extremely stripped down installation of linux with just what ia needed to run kubernetes.

    However most immutable distros have something akin to the standard base of a normal linux distro.

    And even then, the Linux kernel, is now one of the biggest attack surfaces, infintely more of a threat than having a package on the host. Most packages on the host, since they aren't setuid, can't really do anything malicious.

    Flatpak sandboxing is interesting but not as strong as I would like, and not unique to immutable distros. In additiom to that, flatpak and docker have very little supply chain security compared to the traditional distro model of packaging, so the result is that we are trading this invincible supply chain (Debian/RedHat enterprise linux (but NOT fedora or bazzite or other less stable distros/Ubuntu were not affected by xz utils backdoor) for weak sandboxing, which is not something I'm very happy about.

    Security makes a lot of trade offs between other elements of security, and features and peformance.

  • permalink
  • fedilink
  • source
  • parent