I recently switched my regular Fedora 31 workstation over to the 31 Silverblue release. I’ve played with Project Atomic before and have been meaning to try it out more seriously for a while, but never had the time. Silverblue provided the catalyst to do that.
What this brings to the table is quite amazing and seriously impressive. The base OS is immutable and everyone’s install is identical. This means quality can be improved as there are less combinations and it’s easier to test. Upgrades to the next major version of Fedora are fast and secure. Instead of updating thousands of RPMs in-place, the new image is downloaded and the system reboots into it. As the underlying images don’t change, it also offers full rollback support.
This is similar to how platforms like Chrome OS and Android work, but thanks to
ostree it’s now available for Linux desktops! That is pretty neat.
It doesn’t come with a standard package manager like
dnf. Instead, any packages or changes you need to perform on the base OS are done using
rpm-ostree command, which actually layers them on top.
And while technically you can install anything using
rpm-ostree, ideally this should be avoided as much as possible (some low level apps like shells and libvirt may require it, though). Flatpak apps and containers are the standard way to consume packages. As these are kept separate from the base OS, it also helps improve stability and reliability.
I copied the Silverblue installer to a USB stick and booted it to do the install. As my Dell XPS has an NVIDIA card, I modified the installer’s kernel args and disabled the
nouveau driver with the usual
nouveau.modeset=0 to get the install GUI to show up.
I’m also running in UEFI mode and due to a bug you have to use a separate, dedicated
/boot/efi partition for Silverblue (personally, I think that’s a good thing to do anyway). Otherwise, the install looks pretty much the same as regular Fedora and went smoothly.
Once installed, I blacklisted the
nouveau driver and rebooted. To make these kernel arguments permanent, we don’t use
grub2, we set kernel args with
rpm-ostree kargs --append=modprobe.blacklist=nouveau --append=rd.driver.blacklist=nouveau
The NVIDIA drivers from RPMFusion are supported, so following this I had to add the repositories and drivers as RPMs on the base image.
rpm-ostree install \ https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-31.noarch.rpm \ https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-31.noarch.rpm systemctl reboot
Once rebooted I then installed the necessary packages and rebooted again to activate them.
rpm-ostree install akmod-nvidia xorg-x11-drv-nvidia-cuda libva-utils libva-vdpau-driver gstreamer1-libav rpm-ostree kargs --append=nvidia-drm.modeset=1 systemctl reboot
That was the base setup complete, which all went pretty smoothly. What you’re left with is the base OS with GNOME and a few core apps.
Working with Silverblue
Using Silverblue is a different way of working than I have been used to. As mentioned above, there is no
dnf command and packages are layered on top of the base OS with the
rpm-ostree command. Because this is a layer, installing a new RPM requires a reboot to activate it, which is quite painful when you’re in the middle of some work and realise you need a program.
The answer though, is to use more containers instead of RPMs as I’m used to.
As I wrote about in an earlier blog post,
toolbox is wrapper for setting up containers and compliments Silverblue wonderfully. If you need to install any terminal apps, give this a shot. Creating and running a container is as simple as this.
toolbox create toolbox enter
Once inside your container use it like a normal Fedora machine (
dnf is available!).
rpm-ostree has no search function, using a container is the expected way to do this. Having created the container above, you can now use it (without entering it first) to perform package searches.
toolbox run dnf search vim
Graphical apps are managed with Flatpak, the new way to deliver secure, isolated programs on Linux. Silverblue is configured to use Fedora apps out of the box, and you can also add Flathub as a third party repo.
I experienced some small glitches with the Software GUI program when applying updates, but I don’t normally use it so I’m not sure if it’s just beta issues or not. As the default install is more sparse than usual, you’ll find yourself needing to install the apps you use. I really like this approach, it keeps the base system smaller and cleaner.
While Fedora provides their own Firefox package in Flatpak format (which is great) Mozilla also just recently started publishing their official package to Flathub. So, to install that, we simply add the Flathub as a repository and install away!
flatpak remote-add flathub https://flathub.org/repo/flathub.flatpakrepo flatpak update flatpak install org.mozilla.firefox
After install, Firefox should appears as a regular app inside GNOME.
If you need to revert to an earlier version of a Flatpak (which I did when I was testing out Firefox beta), you can fetch the remote log for the app, then update to a specific commit.
flatpak remote-info --log flathub-beta org.mozilla.firefox//beta flatpak update \ --commit 908489d0a77aaa8f03ca8699b489975b4b75d4470ce9bac92e56c7d089a4a869 \ org.mozilla.firefox//beta
Replacing system packages
If you have installed a Flatpak, like Firefox, and no-longer want to use the RPM version included in the base OS, you can use
rpm-ostree to override it.
rpm-ostree override remove firefox
After a reboot, you will only see your Flatpak version.
I upgraded from 31 to the 32 beta, which was very fast by comparison to regular Fedora (because it just needs to download the new base image) and pretty seamless.
The only hiccup I had was needing to remove RPMFusion 31 release RPMs first, upgrade the base to 32, then install the RPMFusion 32 release RPMs. After that, I did an update for good measure.
rpm-ostree uninstall rpmfusion-nonfree-release rpmfusion-free-release rpm-ostree rebase fedora:fedora/32/x86_64/silverblue rpm-ostree install \ https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-32.noarch.rpm \ https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-32.noarch.rpm systemctl reboot
Then post reboot, I did a manual update of the system.
You can see the current status of your system with the rpm-ostree command.
On my system you can see the
ostree I’m using, the commit as well as both layered and local packages.
State: idle AutomaticUpdates: disabled Deployments: ● ostree://fedora:fedora/32/x86_64/silverblue Version: 32.20200410.n.0 (2020-04-10T08:35:30Z) BaseCommit: d809af7c4f170a2175ffa1374827dd55e923209aec4a7fb4dfc7b87cd6c110c9 GPGSignature: Valid signature by 97A1AE57C3A2372CCA3A4ABA6C13026D12C944D0 LayeredPackages: akmod-nvidia git gstreamer1-libav ipmitool libva-utils libva-vdpau-driver libvirt pass powertop screen tcpdump tmux vim virt-manager xorg-x11-drv-nvidia-cuda LocalPackages: rpmfusion-free-release-32-0.3.noarch rpmfusion-nonfree-release-32-0.4.noarch ostree://fedora:fedora/32/x86_64/silverblue Version: 32.20200410.n.0 (2020-04-10T08:35:30Z) BaseCommit: d809af7c4f170a2175ffa1374827dd55e923209aec4a7fb4dfc7b87cd6c110c9 GPGSignature: Valid signature by 97A1AE57C3A2372CCA3A4ABA6C13026D12C944D0 LayeredPackages: akmod-nvidia git gstreamer1-libav ipmitool libva-utils libva-vdpau-driver libvirt pass powertop screen tcpdump tmux vim virt-manager xorg-x11-drv-nvidia-cuda LocalPackages: rpmfusion-free-release-32-0.3.noarch rpmfusion-nonfree-release-32-0.4.noarch
To revert to the previous version temporarily, simply select it from the
grub boot menu and you’ll go back in time. If you want to make this permanent, you can rollback to the previous state instead and then just reboot.
Silverblue is really impressive and works well. I will continue to use it as my daily driver and see how it goes over time.
I have run into a couple of issues, mostly around using the Software GUI (which I don’t normally use). Mostly these were things like it listing updates for Flatpaks which were not actually there fore update, and when you tied to update it didn’t do anything.
If you hit issues, you can try clearing out the Software data and loading the program again.
pkill gnome-software rm -rf ~/.cache/gnome-software
If you need to, you can also clean out and refresh the
rpm-ostree cache and do an update.
rpm-ostree cleanup -m rpm-ostree update
To repair and update Flatpaks, if you need to.
flatpak repair flatpak update
dnf on the host terminal a little easier with aliases.
Accessing USB serial devices on the host and in a toolbox container.