Dom0 OS Selection

If dom0 were to move away from Fedora as the OS for dom0; what would be the criteria for choosing an alternative?

SeL4 is a microkernel. Any thoughts on using a Rust-based hypervisor like Gramine? or Occulum?
(or are these projects just to take advantage of Intel SGX enclaves).

What about a unikernel (LibraryOS) like mirageOS for dom0?

Please familiarize yourself with Qubes OS architecture and then see these threads:

and also

These discussions should give you a comprehensive idea of all the ideas that have been discussed, the reasoning behind them and links to plenty of material relevant to this question.

1 Like

Heh. I was about to link to them before I saw your response :slight_smile:

1 Like

Yeah, this is a very good candidate for an FAQ entry. Something along the lines of…

  • it doesn’t really matter, because offline / no user interaction / hardware isolation
  • it’ll be even less important in the future or go away anyway, because more hardware isolation (net, usb, audio, gui domains)
  • if an attacker reaches dom0 your hardening / favorite distro won’t save you
1 Like