being a mutable minimal CentOS. So all the linking and making immutable would need to be done.
No it's designed to be consumed as a base image for ostree enabled OCI containers.
j0rge
joined 2 years ago
This requires the presence of rpm-ostree and a kernel, which are both missing in the CentOS Stream image.
There are ostree-enabled OCI containers of centos if you know where to look. :D
This should be enough until they start publishing official ones, never used it:
https://quay.io/repository/centos-bootc/centos-bootc-dev?tab=tags
https://github.com/ublue-os/main/blob/main/packages.json
Docs for future reference: https://universal-blue.discourse.group/docs?topic=868
Yeah it's 2024, this stuff should just be built into the OS! I'm at kubecon so don't have time to look into it now but it'd be an awesome thing to have, we'd love the help!
bluefin co-maintainer here. espanso is a hard one, we have an open issue on getting it to work because it'd be something awesome to include. We might end up needing to package it but haven't had a chance to look deeper into the issue.
I'm not a security expert but I do know that the Homebrew is working with openssf on security: https://openssf.org/blog/2023/11/06/alpha-omega-grant-to-help-homebrew-reach-slsa-build-level-2/
Boxkit predates wolfi so it's still alpine, I'll probably replace it at some point but most of the forks of boxkit are because people want the premade github actions and they end up replacing it with whatever distro they want anyway. The wolfi connection is because I know the people who work there (including a ublue maintainer) and we have similar goals/ideas on how linux distros should be put together. My ideal dream is a wolfi userspace systemd-sysext on top of fedora base, then we can have our cake and eat it too!
We're not security experts but lots of us work in the field and that gives us access to peer review from experts when we set things up. We sign every artifact with sigstore so users can verify that the code used in github is what's on their image, that sort of thing. And most of our practices utilize CNCF governance templates that lots of other projects use.
Been there and done that. It's better to just not have the host OS break in the first place.
My Ubuntu installs are extremely reliable, both on desktops and servers.
Probably because you're an experienced user, not everyone has the same skillset.
mozillavpn
I would just overlay this, that's what it's there for, there's no need to do a full new image for VPN stuff.
We use quadlets to manage those containers: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html
As others in the thread have pointed out just having systemd manage them is the way to go, it's a nice combo!
What package is it?
That's exactly what all universal blue images do. It's just that setup is done every single day in github from scratch and stamped out as an image so that the end result gets to your computer as a finished deployment artifact. Leads to better update reliability, built in rollback.
The biggest benefit is that it's easier for a community to fix the fast moving gamer stuff as a config layer on top of a distro that's delivered this way than me having to manually figure out what component of my gaming setup changed that week.