If dom0 were to move away from Fedora as the OS for dom0; what would be the criteria for choosing an alternative?
SeL4 is a microkernel. Any thoughts on using a Rust-based hypervisor like Gramine? or Occulum?
(or are these projects just to take advantage of Intel SGX enclaves).
What about a unikernel (LibraryOS) like mirageOS for dom0?
Please familiarize yourself with Qubes OS architecture and then see these threads:
These discussions should give you a comprehensive idea of all the ideas that have been discussed, the reasoning behind them and links to plenty of material relevant to this question.
Heh. I was about to link to them before I saw your response
Yeah, this is a very good candidate for an FAQ entry. Something along the lines of…
- it doesn’t really matter, because offline / no user interaction / hardware isolation
- it’ll be even less important in the future or go away anyway, because more hardware isolation (net, usb, audio, gui domains)
- if an attacker reaches dom0 your hardening / favorite distro won’t save you