展示 HN:一个基于 ostree 的不可变 Arch Linux 镜像
Show HN: An immutable ostree-based Arch Linux image

原始链接: https://github.com/myyc/vyy

Vyy 是一个基于 ostree 的 Arch Linux 发行版,旨在提供类似 Fedora Silverblue 的不可变体验,但采用来自 CachyOS 的注重性能的 Zen4 软件包。本质上,它是一个定制化的、基于 GNOME 的 Arch 系统,利用 Fedora 强大的基础来提供稳定性和安全性。 安装方式独特:首先安装 Fedora Silverblue(或 Kinoite/Bazzite),然后使用 `bootc` “切换”到 Vyy。更新也通过 `bootc upgrade` 处理。提供密钥支持安全启动。 Vyy 故意避免使用传统的包管理器。修改是通过fork项目并编辑配置文件,或利用 Distrobox 等包含的工具进行。核心系统是 pacstrap 基础,软件包列表在 `packages.txt` 中。 虽然目前可用且稳定,但它仍在开发中。可以通过自行编译获得 Zen3 构建版本。该项目优先通过 Fedora 的安装过程建立坚实的基础,使其适用于关键设备,因为具有易于回滚的功能。

一位开发者在Hacker News分享了一个项目,该项目使用`ostree`创建基于Arch Linux的不可变操作系统镜像,灵感来自Fedora的Silverblue。目标是将Arch的灵活性与不可变基础的可靠性和安全性结合起来。 讨论的中心在于这种方法是否符合Arch传统的可变特性。创建者承认与Silverblue的相似之处,但强调了高度定制构建的可能性,以及在不冒系统不稳定的风险下进行本地开发的便利性。 目前尚未实现完整的`ostree`服务器用于更新(需要大量的基础设施),但每日构建和`bootc`工具提供了替代方案,尽管图像下载量会更大。其他类似的项目,如Zenare,也被提及。该开发者认为不可变的Linux是未来,它提供了一种安全且可定制的体验,超越了锁定的平台。
相关文章

原文

An ostree-based full fledged Arch Linux distribution, with no package manager. Basically Fedora Silverblue but with CachyOS' Zen4 packages, because we all want that 1% performance improvement.

It's a largely vibe coded attempt at essentially gerrymandering a standard GNOME-based Arch Linux setup into Fedora's immutable system. And yes, it works perfectly in its current state.

This README isn't written by an AI though so you can at least take it at face value.

Warning: This project is work-in-progress and even though it is very usable and stable it might miss some random stuff here and there.

GHCR – recommended but you kind of have to trust the ordeal

  • Install Silverblue, or Kinoite, or Bazzite, or whatever
sudo bootc switch ghcr.io/myyc/vyy-zen4:latest

Reboot. bootc upgrade to update it. The kernel is signed so you can enable secure boot after trusting the key.

sudo mokutil --import /usr/share/vyy/secureboot.cer

There are no zen3 builds uploaded but you can build one yourself.

  • Install Silverblue, or Kinoite, or Bazzite, or whatever
  • Run scripts/dev.sh zen3 as root (yes, sorry).
  • From there, run build-vyy-root.sh zen3
  • Commit to your ostree repo, deploy and reboot.
sudo ostree commit --repo=/ostree/repo \
    --branch=vyy --owner-uid=0 --owner-gid=0 \
    --subject="vyy YYYYMMDD" \
    --skip-list=/path/to/vyy/config/ostree-skip-list \
    /path/to/vyy/work
sudo ostree admin deploy vyy

You will lose out-of-the-box secure boot this way but you can create your own keys. As long as the paths are right the scripts will do it for you.

You could also use scripts/daily-build.sh and the systemd units if you have a server to run this on; edit the placeholders first though.

All the scripts default to zen4 but you can launch them with zen3 or generic as arguments. I haven't tested these two, but they should work.

The "install Silverblue" part is pretty much what makes this distro solid avoiding most possible sources of human error. Partitioning, encryption (if you want) and the bootloader are Fedora's defaults, which should be more than enough for most people – Silverblue by default configures btrfs and has native encryption, so hooray.

This is also why you can use this sort of thing on relatively critical devices – I literally developed all of this on the only device I had access too, for work included. It doesn't boot? Roll back and forget.

No package manager. The system is immutable. Want to add stuff? Fork and edit config/packages.conf. Or use distrobox. It's included.

The core thing is just a basic pacstrap setup with a bunch of packages added. You can see all of them in confg/packages.txt. The main build script doesn't do much else, besides perhaps setting the locale.

Most of the hammering is done by restructure.sh which is invoked by build-vyy-root.sh so you might as well check that too since it runs within a rootful container.

Globally, it does a few things, e.g.:

  • Building the initramfs with the ostree module (and others)
  • Moving everything system inside /usr (including most of /etc)
  • Ensuring the root is compatible with ostree
  • Allowing sudo for wheel users (otherwise you're locked out)
  • Some sane defaults for pam (including the fingerprint)

Why depend on AUR packages?

So like ... it doesn't actually depend on them yet. The only core one is bootc. If you want to build locally you don't need it, you only need vanilla ostree. You don't even need it if you want to update from your own ostree repo.

The other packages are more of a personal convenience. They're the Mullvad CLI, ibus-m17n which is required for certain input methods, and raw-thumbnailer.

Why not NixOS at this point?

Fuck off

联系我们 contact @ memedata.com