Fedora Onyx voted in as a new official Fedora Linux immutable variant

I love the Fedora image-based distros! Nice to see more desktop environments that will be included officially. If anyone is looking for MATE, XFCE, or LXQt Fedora "immutables" then check out the Universal Blue project - https://ublue.it/

I've been thinking about switching to Fedora Silverblue/Sericea soon, but the only problem with these distributions is their plan to remove Firefox from the base image and install it as a Flatpak. It's not a good idea to install browsers with Flatpaks, because it weakens the sandbox and makes you more vulnerable to attacks. I really don't want to play with my browser like that.

On the other hand, the project is kind of forced to pick the Flatpak because they can't legally distribute H.264/AAC and other codecs with a native Firefox package (I don't know why Flatpaks that come with the ISO are any different, buy anyway), so that results in significant usability compromises.

But I do love how you can have different versions of the same program installed with Toolbox. Really, that's game-changing. And I don't even need to install Gentoo to mess with slots...

That’s an interesting take as Firefox in Flatpak or Snap is supposed to add another layer of sandboxing security.

Quoting: t3gThat’s an interesting take as Firefox in Flatpak or Snap is supposed to add another layer of sandboxing security.

This is true for most software, but Firefox already sandboxes web content. While Firefox's sandbox is weaker than Chromium-based browsers, it is still more robust than Flatpak's sandbox. As you can understand, they've had a lot of practice over the past 28 years...

As Seirdy's note explains, you can't have sandboxes inside of sandboxes:

QuoteWeb browsers are an alternative to Flatpak; they have their own sandboxing and updating mechanisms.

Most distributions build Firefox without auto-update support, of course, but TOR Browser Bundle does have this.

So, in most cases, Flatpak is better than no sandbox, but not in this case.

My information only comes from Seirdy, though, so don't assume I know anything more.

Quoting: pleasereadthemanualI've been thinking about switching to Fedora Silverblue/Sericea soon, but the only problem with these distributions is their plan to remove Firefox from the base image and install it as a Flatpak. It's not a good idea to install browsers with Flatpaks, because it weakens the sandbox and makes you more vulnerable to attacks. I really don't want to play with my browser like that.

On the other hand, the project is kind of forced to pick the Flatpak because they can't legally distribute H.264/AAC and other codecs with a native Firefox package (I don't know why Flatpaks that come with the ISO are any different, buy anyway), so that results in significant usability compromises.

But I do love how you can have different versions of the same program installed with Toolbox. Really, that's game-changing. And I don't even need to install Gentoo to mess with slots...

If you don't like it, you can use ublue to just explicitly add it in the recipe.yml install list, so that there is always built-in firefox package installed in your image regardless of what upstream does. By default, they have firefox and firefox-langpacks in remove list, so it is literally just a copy-paste away.

It isn't as hard as you may think it is, I was a GitHub noob who didn't even know how PR works when I installed it, and now I'm slowly building up into the mix of kinoite and Nobara that I want (since Bazzite, the ublue image with SteamOS and Nobara packages which GE seems to contribute to, is still in alpha).


Last edited by fenglengshun on 26 May 2023 at 5:21 am UTC

Quoting: fenglengshunIf you don't like it, you can use ublue to just explicitly add it in the recipe.yml install list, so that there is always built-in firefox package installed in your image regardless of what upstream does. By default, they have firefox and firefox-langpacks in remove list, so it is literally just a copy-paste away.

It isn't as hard as you may think it is, I was a GitHub noob who didn't even know how PR works when I installed it, and now I'm slowly building up into the mix of kinoite and Nobara that I want (since Bazzite, the ublue image with SteamOS and Nobara packages which GE seems to contribute to, is still in alpha).

Is this different from including Firefox as an overlay?

Part of the reason I want to run Fedora is because I believe it has sane defaults. It's the only desktop distribution that both enables SELinux and includes profiles by default (well, Ubuntu does this with AppArmor). It also does a bunch of other stuff I frankly don't understand, because I'm not a security researcher. To replicate everything in Arch Linux would take a lot of work and I probably wouldn't do it correctly.

So, when they make decisions like this based on usability and security...I start to wonder. What else have they compromised on? They don't even seem to realize the compromise they're making, and they don't explain it anywhere. The reason I want to install Fedora Sericea is because I don't want to keep tinkering with a work computer. The rollback functionality is particularly useful in this instance, as-is the fact user software is updated independently of system packages.

Ahhh...I can't wait for 2028 when these H.264 patents expire so distributions don't need to do stupid stuff like this.

Quoting: pleasereadthemanualIs this different from including Firefox as an overlay?

Alright, long post incoming as I try to explain everything:

You can use overlay, but when I tried to do `rpm-ostree install --dry-run` in my Kinoite image to test things, whenever there's an already installed package, it will exit saying the package is already installed, instead of continuing with installing the other packages I listed in the comment.

By contrast, the ublue builder seems to take care of duplicates easily, unless you have a version conflict due to trying to install something using COPR (tried to install steam but I think the Nobara COPR and packages I enabled caused a conflict of mesa version). Also, they automatically build things in a single layer, I think, which prevents the issue of having too many overlays due to not doing a single `rpm-ostree install`.

In addition, when I asked around, having overlays may make it hard if you want to switch base to a different system image (say, Silverblue to Kinoite, or Kinoite to Onyx, or Kinoite to Kinoite-Nvidia).

If your worry are Firefox and codecs, I believe that uBlue base images currently have firefox and the freeworld codecs installed. I think they only added the firefox and firefox-langpacks on remove list of recipe.yml as an example of how to remove package from the image and probably under the assumption people be installing Firefox through Flatpak via the yafti flatpak installer. But if anyone worries about upstream removing firefox eventually, they can just add it to the install list to make sure it remains installed.

This is the list of the packages they overlay by default on their images which you can use as your base image, this is the template recipe.yml which is applied based on the base image you chose, and this is my recipe.yml and yafti.yml for an example of how I'm doing things (sorry about the mess though, still experimenting here -- check Actions if you want to see how messy installing Teamviewer is).

I still don't know everything yet, I've only been using it for a week, but it was easy enough to understand due to the playbook-like format. Getting started was surprisingly easy, with the automated setup.


Last edited by fenglengshun on 26 May 2023 at 8:40 am UTC

Inspired by this tried Fedora 38. The videos still don't play on Twitch and other video platforms... Even though the codecs were checked to install. Then i tried to go to rpmfusion website as adviced to click those two links https://rpmfusion.org/Configuration:

Graphical Setup via Firefox web browser

1. First enable access to the free repository. For users of gpk (gnome package kit) or kpackagekit in Fedora that is easy and basically only one step: just click on one of the following files, depending on what distribution you use and then follow the default options that Firefox and Package Kit offer by clicking Enter a few times (¹):

RPM Fusion free for Fedora 36

RPM Fusion free for Fedora 37

this > RPM Fusion free for Fedora 38

RPM Fusion free for Fedora Rawhide

RPM Fusion free for RHEL 9 or compatible like CentOS

RPM Fusion free for RHEL 8 or compatible like CentOS

RPM Fusion free for RHEL 7 or compatible like CentOS

2. Once that succeeds, you can enable access to the nonfree repositories by clicking on one of the following files, depending on what distribution you use and then follow the default options that Firefox and Package Kit offer by clicking Enter a few times(¹):

RPM Fusion nonfree for Fedora 36

RPM Fusion nonfree for Fedora 37

and this > RPM Fusion nonfree for Fedora 38

RPM Fusion nonfree for Fedora Rawhide

RPM Fusion nonfree for RHEL 9 or compatible like CentOS

RPM Fusion nonfree for RHEL 8 or compatible like CentOS

RPM Fusion nonfree for RHEL 7 or compatible like CentOS

And it made no difference. Youtube plays videos though that's it. I don't know what is Fedora team doing but obviously something is done wrong. Of course at least the videos should play. What other tweaking is the user supposed to do to get the damn videos play?

Quoting: dziadulewiczInspired by this tried Fedora 38. The videos still don't play on Twitch and other video platforms... Even though the codecs were checked to install. Then i tried to go to rpmfusion website as adviced to click those two links https://rpmfusion.org/Configuration:

Graphical Setup via Firefox web browser

1. First enable access to the free repository. For users of gpk (gnome package kit) or kpackagekit in Fedora that is easy and basically only one step: just click on one of the following files, depending on what distribution you use and then follow the default options that Firefox and Package Kit offer by clicking Enter a few times (¹):

RPM Fusion free for Fedora 36

RPM Fusion free for Fedora 37

this > RPM Fusion free for Fedora 38

RPM Fusion free for Fedora Rawhide

RPM Fusion free for RHEL 9 or compatible like CentOS

RPM Fusion free for RHEL 8 or compatible like CentOS

RPM Fusion free for RHEL 7 or compatible like CentOS

2. Once that succeeds, you can enable access to the nonfree repositories by clicking on one of the following files, depending on what distribution you use and then follow the default options that Firefox and Package Kit offer by clicking Enter a few times(¹):

RPM Fusion nonfree for Fedora 36

RPM Fusion nonfree for Fedora 37

and this > RPM Fusion nonfree for Fedora 38

RPM Fusion nonfree for Fedora Rawhide

RPM Fusion nonfree for RHEL 9 or compatible like CentOS

RPM Fusion nonfree for RHEL 8 or compatible like CentOS

RPM Fusion nonfree for RHEL 7 or compatible like CentOS

And it made no difference. Youtube plays videos though that's it. I don't know what is Fedora team doing but obviously something is done wrong. Of course at least the videos should play. What other tweaking is the user supposed to do to get the damn videos play?

It all comes back to non-free codecs, which Fedora won't ship because of patents and license fees. If you want to get around the problem easily just install your Firefox and other multimedia apps from Flathub and be done with it. If you want to go the more troublesome road, you follow the RPM Fusion Multimedia instructions, with the potential exception of the parts that talk about mesa-freeworld. RPM Fusion is a fast way to break something if you don't pay attention when DNF tells you that an update has broken dependencies.

Eventually the codec problem will solve itself as platforms abandon H.264/H.265 and move to AV1.

QuoteUpgrades are done over the whole thing, it's supposed to be faster and more stable....

Faster? Well, in my anecdotal experience, general usage and OS updates are not faster. You get tricked into feeling that the OS upgrades are faster because it's fewer steps to process before your system requires a reboot, but then the upgrades have to finish during the reboot before your system lets you log in. I never thought speed was the goal of sandboxing. Sandboxing and container-like tech has memory and disk space overhead.

But that's one aspect. There are other benefits. I've been playing with Kinoite in a VM for a while. I like to try the experience of installing and using programs, running updates, to get a feel for daily use. My impression so far is that Flatpak for everything adds annoyance to the user experience. It seems there are assumptions made of which people new to dealing with Flatpaks are ignorant. And thus, the out-of-box or first time runs of applications have been erroneous and required troubleshooting several times. For example, getting vim to work in the terminal was ridiculous!

Overall, my opinion at this point in time is that these immutable systems will be great for the corporate world who has a team of people that are managing custom builds. I don't think they're worth the time and effort as a daily driver for the home user at this point. But it has me very curious and watchful to see how it progresses.