Dom0 OS Selection

If dom0 were to move away from Fedora as the OS for dom0; what would be the criteria for choosing an alternative?

https://www.hardenedbsd.com/content/easy-feature-comparison

https://www.gnu.org/distros/free-distros.html

1 Like

https://trustworthy.systems/projects/TS/makatea

1 Like

SeL4 is a microkernel. Any thoughts on using a Rust-based hypervisor like Gramine? or Occulum?
(or are these projects just to take advantage of Intel SGX enclaves).

What about a unikernel (LibraryOS) like mirageOS for dom0?

2 Likes

Please familiarize yourself with Qubes OS architecture and then see these threads:

and also

These discussions should give you a comprehensive idea of all the ideas that have been discussed, the reasoning behind them and links to plenty of material relevant to this question.

3 Likes

Heh. I was about to link to them before I saw your response :slight_smile:

2 Likes

Yeah, this is a very good candidate for an FAQ entry. Something along the lines of…

  • it doesn’t really matter, because offline / no user interaction / hardware isolation
  • it’ll be even less important in the future or go away anyway, because more hardware isolation (net, usb, audio, gui domains)
  • if an attacker reaches dom0 your hardening / favorite distro won’t save you
3 Likes

Is this the canonical thread for the ā€œother distribution for dom0ā€ conversation? I’m thinking no?

I noticed the Github issue was set to ā€œthis is not the best place to discuss thisā€, but it’s not immediately clear to me where to go to follow or participate in that discussion

The issue links to this Discourse group URL, but that fails to load for me

Though I don’t have much currently, I would be happy to contribute whatever time I do have to development or testing. I’m capable of (at least) building, developing glue and testing

… from the Github issue though, it seems to me there’s still considerable work and discussion required just to determine what distribution would be suitable, and why

My interest is backed by a pretty weak case - would be very happy to be rid of Fedora (or any RHEL-based distributions) simply because I don’t like using them, as a function of not knowing their tools and conventions well in the way that I know those used by Debian. Not reason enough to make a serious argument for all Qubes developers and users, I admit :slight_smile:

Is the best place for this discussion in the real-time chat app used by Qubes devs? (Forgetting the name but I have a Qube set up for it that I just haven’t yet actually used)

I’ve considered it’s very possible this isn’t really ā€œa thingā€ anymore, due to priorities and a possible lack of substantial ā€œpainā€ from Fedora

1 Like

That’s because the issue tracker is not intended to be a discussion forum.

This is the discussion forum, so the best place is either here or one of the mailing lists.

You have to replace qubes-os.discourse.group with forum.qubes-os.org, because the forum changed domains a long time ago.

It’s supposed to redirect automatically, but it looks like that’s no longer working for some reason.

3 Likes

A post was split to a new topic: Why are qubes-os.discourse.group links broken

There’s a GitHub PR stating that ā€œbasic functionalityā€ works for NixOS as Dom0. I haven’t tried it myself though.

1 Like

I often encounter Alpine Docker images when deploying and administrating software on my servers: