Linux distributions are generally considered safe for daily usage on desktops or on a server. That’s why there are not many viruses that affect Linux, and consequently, there are not many antivirus programs either. That’s mostly because in order to affect a system, any malicious code or person would have to get administrator privileges, and as long as your admin password is secure, your system remains secure
However, if by any chance someone or something malicious does get the administrator privileges, it can most definitely damage your system. Immutable Linux distributions are an attempt to solve exactly this problem.
In immutable Linux distributions, you or any other programs that are installed on the system cannot modify the system files. And yes, that includes the system configuration files as well as applications. But that creates another problem for the users who want to install an application for their work purposes. In this article, we will take a look at the working of Immutable Linux distributions and how they try to solve the various problems that arise while using those distributions.
The Rationale Behind Immutable Linux Distributions
Immutable Linux distributions enhance system security by making system files unmodifiable, even by the administrator. They handle software through universal packaging formats like Flatpak, Snap, and AppImage, which are sandboxed from the operating system. These distributions offer robust security features, making them ideal for various use-cases, from handheld devices to server environments.
As mentioned earlier, Immutable Linux Distributions are extremely secure and tamper-free because even the system administrator cannot modify system files. It is a read-only system. Any kind of change you or any program makes in system files gets reverted automatically when you reboot the system.
Whenever you update the system, it does not install updates to the present system, instead, it creates another ‘OS’ from the packages of the previous installation and the updated files which were downloaded. If any program, whether graphical or CLI, breaks on the PC, you can just roll back your whole system to the previous state. Any type of changes that you make on the system can also be reproduced very easily. Therefore can be helpful in reproducing a lot of systems at the same time, for a school lab for example.
This is advantageous in many use cases, such as in a handheld device such as a Smartphone. Even the Steam Deck uses an Immutable Arch-based distribution, ‘SteamOS Holo’.
There are several advantages of running Immutable distributions on the server side because any kind of update only gets applied when you reboot the system, there is zero chance that something will break in the production environment while updating.
Software Management in Immutable Linux Distributions
Short answer? Flatpaks, Snaps, and AppImages. If you need any application, then you have to install it using the Flatpak or Snap packaging format, which is sandboxed from the entire operating system. These universal packaging formats ship the required programs with all their libraries, and hence they do not depend on the system libraries at all. Now, of course, not everyone likes that packaging format, and hence immutable distributions are not for everyone.
When you update the system, some immutable distributions create a separate partition with the new version of the OS (Like Vanilla OS), while other ones like Fedora Silverblue and Endless OS use a more ‘git’ like system to distinguish between the updated version of the updates. Each new update is a ‘commit’ and all commits are used to build the system image. For instance, OpenSUSE MicroOS employs BTRFS snapshots for system updates.
Some of the Immutable distributions use ‘layering’ from which applications, dependencies, and drivers are installed from the distribution’s repository. These layered packages will be preserved between every system update.
The Trade-offs of Using Immutable Linux Distributions
Immutable Linux distributions are unique in themselves because of the way they approach Desktop OS. Even if you are coming from a traditional Linux OS, then you will have to figure out how everything works once again. You cannot use the usual package managers to install programs. Even running containers can be a hassle most of the time. If you want to configure something that does not have a GUI tool, and need to get into the config files, then you cannot do that (although some of the distributions allow writing to the /etc directory).
You also need to reboot every time you need to update, now This can be a disadvantage as well as an advantage depending upon how you look at it.
Final Thoughts: Is Immutable Linux Right for You?
Since most of the user-facing applications have a Flatpak release, Immutable Linux distributions might not be a bad choice for users who do not want to configure their systems so much. However, most of the things they offer can be implemented in regular operating systems as well. For example, the BTRFS file system allows you to take snapshots of the whole operating system in order to create backups and Flatpak applications can be installed on any Linux distribution.
Immutable Linux distributions do offer more security of the root directory, but anything present in your Home directory can still suffer because of any virus or malicious code. You should give these OSes a try, but in a Virtual machine, to see if the stock version of GNOME or KDE is suited for you and whether you can live without touching the configuration files.
Do let me know in the comments, what you think about Immutable Linux distributions and what it could mean for the future of Linux Desktop.