It’s an immutable/atomic version of Fedora: https://fedoraproject.org/atomic-desktops/silverblue/

My understanding is that the core system is immutable (read-only) and major upgrades essentially just swap out that whole layer. Updates are atomic, meaning the entire thing either succeeds or fails and you can never end up with a broken half-updated system. UI apps all run using Flatpak.

I’ve never tried it though!

It’s immutable (aka. atomic), which means the system files cannot be changed, even by root. System updates come as complete system snapshots of the core filesystem, and everything else exists in containers or filesystem overlays (user directory is still writeable). Containers and the user’s home directory are unaffected by the updates, so the update process is typically much safer overall.

If an update does break something, you can easily do rpm-ostree rollback, and everything will be working again. On top of that, you can swap between versions with a simple rebase command (e.g. swap between Silverblue and Kinoite, Kinoite and Bazzite).

It’s an “immutable” Fedora, that is, the system comes as a read only image, kind of like how android works. Anything you do is “layered” on top of that image. This means you have to actually try to break it, because you can undo anything you did to break it by simply not booting with the extra layer(s).

You’re encouraged to install in userspace flatpaks instead of system-wide rpms where possible, as system-wide rpms means adding a layer on top if the image as it is.

that the thing, if it breaks, the roolback is there or simply rebase without merging /etc, so basically a factory reset

Yes but only from Gnome directly with an app called extensions manager. You can’t install them from the Fedora repo.

Have you tried Gradience?

https://stopthemingmy.app/

TL;DR Don’t (unless your needs are really basic or you really don’t want to layer more packages)

Distrobox ftw, its website is pretty good to find all its features and it has a neat GUI BoxBuddy too! And also the generic Pods can be useful for more advanced needs.

Extra tip: if you have more time to spend on learning, I think Nix Home Manager will actually be the better solution in the long run, no need to worry about containers breaking in some way after system updates with scattered solutions that are hard to understand and remember, also you get to bring your configuration anywhere

Toolbox create  
Toolbox enter  

Now you have a standard Fedora command line system that shares your home folder but otherwise has its own filesystem.
There’s more options (like using other distro’s), but it’s really not complicated.

To install CLI stuff that needs to access your host system’s root files, use rpm-ostree (but if you need a lot of that, use a non-immutable distro instead).

I actually use neither anymore. My stuff I actually want to work with is in home and I have no need to tinker on this system, cause it just works.

What does rebasing mean in this context? I try to google it, but all I get is git rebase.

Any articles about it that are worth reading? Or if you can explain, that would be neat. Thanks!

What’d you dislike about Incus that libvirt does easier? I’m on a similar trajectory as you. I have Incus on Debian but I am transitioning to IoT for that machine. I kinda like Incus. I want to attach USB devices to a couple of my containers, it was a learning curve but eventually worked out alright.

why not use fedora’s built-in openvpn client and just add the pia info? That should likely work. https://helpdesk.privateinternetaccess.com/guides/linux/linux-installing-openvpn-through-the-terminal

or built-in wireguard client? https://helpdesk.privateinternetaccess.com/guides/linux/alternative-setups-4/linux-manual-connection-scripts

I don’t use PIA, but /opt and /etc are both r/w in Silverblue/Kionite

Any program with an install script makes assumptions about your system, if it doesn’t work it just isn’t compatible.
Either modify the script, package the software for your distro or find out if someone else has done it.
My first instinct would be to look if it’s in the AUR and install it inside an Arch Toolbox.

Yeah, third-party Linux VPN clients are pretty screwed on silverblue, and probably always will be. Especially since when installed in a container, they require being ran in a rootful container with selinux labeling disabled to enable direct access to /dev/net/tun, and as you’ve quickly found out, most of those weird bash based installers haven’t adapted. It’s best to use generic VPN configs through your DE atm.

you can unlock your /usr with rpm-ostree usroverlay

you can unlock the file system, don’t remember how tho