Dom0 OS Selection

[huaopeng]

If dom0 were to move away from Fedora as the OS for dom0; what would be the criteria for choosing an alternative?

Dev/Operating System

Security

https://www.hardenedbsd.com/content/easy-feature-comparison

Change the OS used in dom0

https://www.gnu.org/distros/free-distros.html

[bored]

https://trustworthy.systems/projects/TS/makatea

[huaopeng]

SeL4 is a microkernel. Any thoughts on using a Rust-based hypervisor like Gramine? or Occulum?
(or are these projects just to take advantage of Intel SGX enclaves).

What about a unikernel (LibraryOS) like mirageOS for dom0?

[Sven]

Please familiarize yourself with Qubes OS architecture and then see these threads:

Alt Distro in dom0

I’m trying to summarize and redirect Github discussions about alternative dom0 distros to the forum. These discussions surfaced the following developer concerns: Long Term Support (reduce update churn). dom0 gets updated between 1-3.5 years/~1.9 years on average. Up-to-date userland (updated packaging, large support community). This will be less important as more functionality is moved out of dom0. Up-to-date kernel (good driver/hardware support). Small TCB. “Secure” packaging (reprodu…

Alt RPM Distro (CentOS?) in dom0

I wanted to continue discussion from the Debian in dom0 and Alt RPM Distro (CentOS, RHEL, Suse, Oracle Linux) in dom0 tickets. To keep discussion on track, this thread is to discuss RPM based distros only. Recap The short Fedora release cycle is a drag on development, but sticking to a Red Hat adjacent distro has many benefits: A lot less work than switching to Debian or Nix. Efficiency gains from using the same distro in dom0 and VMs (via UBI or Fedora CoreOS/IoT). A lot of money is poured …

[qubes-users] Is Fedora Really A Good Choice For QubeOS?

We all know Fedora is a big name, but is it a good choice for a Security Driven OS like QubeOS to be based around? I found it interesting reading that it was mentioned about the Surface Attack on some things related to QubeOS because it was small in size, like the code, not containing much, therefore limiting the Surface Attack. Ok, GREAT point, but what about the IDEA that if you use a BIG DISTRO like Fedora and the MASSIVE SIZE of the repos and the software contained in it, this sounds like …

and also

Qubes-Air? Qubes in the cloud?

Hi I just found Joanna Rutkowska’s blog post Qubes Air: Generalizing the Qubes Architecture where she states that that is the next step for Qubes-OS. The article was written in 2018. So, I wonder whether that’s still the objective; getting Qubes in the cloud? Really?

These discussions should give you a comprehensive idea of all the ideas that have been discussed, the reasoning behind them and links to plenty of material relevant to this question.

[deeplow]

@Sven

then see these threads:

Heh. I was about to link to them before I saw your response

[Sven]

Yeah, this is a very good candidate for an FAQ entry. Something along the lines of…

• it doesn’t really matter, because offline / no user interaction / hardware isolation
• it’ll be even less important in the future or go away anyway, because more hardware isolation (net, usb, audio, gui domains)
• if an attacker reaches dom0 your hardening / favorite distro won’t save you

[Churros]

Is this the canonical thread for the “other distribution for dom0” conversation? I’m thinking no?

I noticed the Github issue was set to “this is not the best place to discuss this”, but it’s not immediately clear to me where to go to follow or participate in that discussion

The issue links to this Discourse group URL, but that fails to load for me

Though I don’t have much currently, I would be happy to contribute whatever time I do have to development or testing. I’m capable of (at least) building, developing glue and testing

… from the Github issue though, it seems to me there’s still considerable work and discussion required just to determine what distribution would be suitable, and why

My interest is backed by a pretty weak case - would be very happy to be rid of Fedora (or any RHEL-based distributions) simply because I don’t like using them, as a function of not knowing their tools and conventions well in the way that I know those used by Debian. Not reason enough to make a serious argument for all Qubes developers and users, I admit

Is the best place for this discussion in the real-time chat app used by Qubes devs? (Forgetting the name but I have a Qube set up for it that I just haven’t yet actually used)

I’ve considered it’s very possible this isn’t really “a thing” anymore, due to priorities and a possible lack of substantial “pain” from Fedora

[adw]

@Churros

I noticed the Github issue was set to “this is not the best place to discuss this”

That’s because the issue tracker is not intended to be a discussion forum.

@Churros

but it’s not immediately clear to me where to go to follow or participate in that discussion

This is the discussion forum, so the best place is either here or one of the mailing lists.

@Churros

The issue links to this Discourse group URL , but that fails to load for me

You have to replace qubes-os.discourse.group with forum.qubes-os.org, because the forum changed domains a long time ago.

It’s supposed to redirect automatically, but it looks like that’s no longer working for some reason.

[skyvine]

There’s a GitHub PR stating that “basic functionality” works for NixOS as Dom0. I haven’t tried it myself though.

Qubes packages (Its alive!)

[FranklyFlawless]

I often encounter Alpine Docker images when deploying and administrating software on my servers:

index | Alpine Linux