Distributions
ParticleOS, from Fedora to Feast: Stirring Traditional Distros into Immutable Delights
<p>How to successfully brew a Linux immutable image, with bells and whistles</p>
<ul>
<li>take a <a href="https://github.com/systemd/particleos">ParticleOS recipe</a> 📜</li>
<li>generously pour in packages from a traditional distribution like <a href="https://www.fedoraproject.org/">Fedora</a> 🫗</li>
<li>add a pinch of <a href="https://microsoft.github.io/ipe/">security policies for code integrity</a>, build time and boot time customizations to taste 🧂</li>
<li>amalgamate them together with <a href="https://systemd.io/">systemd</a> 👩🏻🍳</li>
<li>stir vigorously with <a href="https://github.com/systemd/mkosi">mkosi</a> 🥣</li>
<li>bake until crispy in the <a href="https://openbuildservice.org/">Open Build Service</a> ♨️</li>
<li>allow time to cool in your <a href="https://download.opensuse.org/repositories/system:/systemd/">CDN</a> 🥧</li>
</ul>
<p>Creating a (truly!) immutable distribution with a strong security posture and a chain of trust that starts in the hardware and ends in userspace is no longer a job that requires an entire team and starting from first principles. With the power of tooling and infrastructure provided by the <a href="https://systemd.io">systemd project</a>, anyone can customize, build and deploy at scale and securely starting from your preferred traditional package-based distribution.</p>
<p>This talk will go over all the tooling and infrastructure available to achieve this, from systemd to mkosi, from UEFI Secure Boot and dm-verity to the Integrity Policy Enforcement LSM, from OBS to systemd-sysupdate, from systemd-repart to systemd-firstboot, and show a working example and how to reproduce and customize it.</p>
Additional information
| Live Stream | https://live.fosdem.org/watch/ub2147 |
|---|---|
| Type | devroom |
| Language | English |
More sessions
| 2/1/26 |
<p>Welcome to the FOSDEM 2026 edition of the Distributions DevRoom! Meet the organizers of this year's Distribution DevRoom, learn a little bit about the history of our DevRoom, and go over some ground rules for the day.</p>
|
| 2/1/26 |
<p>The systemd project and some others have been adopting the Varlink IPC system recently, in places traditionally reserved for D-Bus. In this talk I'd like to explain why Varlink matters, and is a major step forward from D-Bus for almost all areas of Linux OSes. I'll talk about patterns, lifecyles, tracing, parallelism, security, and a lot more.</p>
|
| 2/1/26 |
<p>For decades, building a Linux distribution has been considered a highly specialized craft. To participate, one had to master complex toolchains—building package files, navigating the intricacies of dependency resolution, and operating hard-to-grok build systems like OBS or Koji & Pungi & ImageBuilder. While extremely powerful, this entire stack presents a massive barrier to entry. The result is a demographic crisis: the average age of package maintainers is rising, and new ...
|
| 2/1/26 |
<p>eBPF introduces new challenges for Linux distributions: programs depend on kernel, CO-RE relocations, pinning behavior, and version-aligned bpftool or libbpf tooling. This session looks at what it really takes to package eBPF programs as RPMs and explores specific, real world usecases in Fedora. We’ll explore issues such as pinned maps, privilege models, reproducible builds, SELinux implications, kernel-user ABI considerations, and managing kernel updates without breaking packaged eBPF ...
|
| 2/1/26 |
<p>How do you ensure code works across distributions before it reaches users? The Packaging and Testing Experience (PTE) project is an open-source approach to solving the upstream-to-downstream testing challenge.</p> <p>The traditional model fragments testing: upstream tests their code, distribution maintainers test packages, and users discover the gaps. PTE bridges this by creating a continuous testing pipeline where upstream changes are automatically built, tested in realistic distribution ...
|
| 2/1/26 |
<p>The software supply chain for Linux distributions is under growing pressure. Several distributions have recently suffered from infected packages caused by compromised or malicious upstream sources, including core libraries, leading to significant security implications.</p> <p>These incidents prompted Arch Linux to reflect on the way we handle our package sources. With the objective of bringing greater transparency to our packaging process, we revisited historical decisions and established ...
|
| 2/1/26 |
<p>TL;DR: Write a Containerfile, use image-builder to convert it to an ISO with a live environment.</p> <p>bootc revolutionized how we build and consume image-based systems: just build an OCI container in your preferred git forge, publish it in a registry, and voilà, anyone can come and rebase their bootc-based system to it. A great example is Bazzite: one of the most popular gaming-oriented distributions today.</p> <p>However, the first-day experience is still lacking: the installers don’t ...
|
