Goldboot: Immutable infrastructure for the desktop | Hacker News Reader

Goldboot: Immutable infrastructure for the desktop

github.com

62 pointsthunderbong22 comments

Fedora does this with a series of supported desktops, using ostree under the hood: https://fedoraproject.org/atomic-desktops/

It supports using OCI (Docker) images as a base system. I've been running the KDE Spin, Kinoite, on my desktop and laptop recently and I'm really happy with it.

I also run Fedora's atomic desktop (GNOME flavor) on my main desktop. It is really snappy, no frills and just works. Almost everything I do terminal wise is inside of toolbox/podman containers. If a tool is a big enough of a hassel or something I haven't tried I can create a toolbox, enter it and install deps then build/run the application.

>goldboot is a tool that builds machine images for real hardware

In Windows I use the built-in Deployment Image Servicing and Management (DISM) tools for this, manipulating the Windows Image .WIM files originally designed for NT6 from Windows Vista onward. With Vista, DISM did not yet exist, WIMs were handled by imagex.exe at the time.

>Warning: this tool is totally unfinshed and should be used for testing only! Proceed at your own risk!

Goldboot looks promising anyway. For Windows it could be benchmarked against DISM, or even the Wimboot tangent.

DISM was not perfect when it first appeared, but after over 10 years it is more well-tested and capable than ever.

You can autoingest a configuration file, but also quite easy to go pretty far just dropping commands from a text file into Powershell.

Here's a fairly good example, all of which may not be useful every day, but I do think every Windows person should be familiar with the one section "Capture a Custom Windows Image Using DISM". This is what you do once you have gotten the OS settings the way you want and have installed your needed apps. You may have already accomplished that much on your Windows PC. A WIM of that is really just a backup of your present "golden" image for future deployment or recovery:

https://woshub.com/create-custom-windows-image-preinstalled-...

You can redeploy the WIM file to an empty formatted partition using the DISM.exe /Apply-Image command.

Also, a couple other DISM users and how they utilize its capabilities:

https://matthewhard.com/windows-command-line-dism

https://4sysops.com/archives/create-a-customized-windows-10-...

In Windows Education or Enterprise versions you could also enable the Unified Write Filter which can discard all per-session changes rather than having them written to the disk. This may or may not be used to keep the golden image from allowing persistent changes once deployed.

Perhaps it would be a good idea if Goldboot included the ability to handlle WIM files itself, or especially to make viable WIM files from Linux installs.

Very cool, I was just asking for something like this today to reflash community machines instead of having tons of user restrictions.

Freedom!

Gotta say, on first glance I thought this was a new thing being added to Godbolt.

With nixos you can boot to a tmpfs root, and every time you reboot your system is new and clean, and entirely defined by your nix file.

I just mount my home as a persistent disk and it's truly wonderful.

Wouldn't it make more sense to use an encrypted volume you throw away the key for though? That's a lot of RAM for files you don't need in RAM all the time.

You can also use a ZFS or BTRFS snapshot that gets restored in the initramfs, discarding your changes. That's a common approach for people doing this on NixOS.

> That's a lot of RAM for files you don't need in RAM all the time.

It shouldn't be; the idea is to make it so little to no data actually gets written to that tmpfs (everything is in /nix, /persist, or /home), and it's only even present and not read-only in case you've missed something.

I track it and it's rarely over 100 or 200MB, which is nothing to a 32GB machine.

AGPL will make this unusable for a lot of places.

Yep. MAANG won't touch it because they can't by company policy. But some FOSS people don't know any bettor or commercial FOSS-washed startups don't understand the implications of encumbering a project with impractical strings on use because "everyone else is doing it." Either let the code be free or keep it proprietary rather than waffle or force unreasonable BS on users.

> But some FOSS people don't know any bettor or commercial FOSS-washed startups don't understand the implications of encumbering a project with impractical strings on use because "everyone else is doing it."

Or, they correctly understand exactly how the license works and intentionally choose something that's effectively impossible to use in anything proprietary (for some definition of "use in" that's probably less severe than you're implying, though IANAL).

> Either let the code be free or keep it proprietary rather than waffle or force unreasonable BS on users.

Correct; AGPL is 100% Free and a commendable choice. (Not that there's anything wrong with permissive licenses, but copyleft is also good.)

AGPL is Russian roulette by footgun with 6 loaded chambers. They are free to be virtuous in their self-righteous RMS talking points but dead wrong in the economic realities and what freedom actually means rather than dithering about a purist utopia.

So to try and be very charitable and read between the lines to get something out of your vague insults... you think FOSS needs to be possible to wrap in proprietary in order to get enough funding or labor to succeed? Because that could plausibly be a defensible claim, but I think I still disagree; even if AGPL really meant it was impossible to use without publishing everything (which I'm pretty sure isn't actually true but again IANAL) software can still be created and used purely by non-commercial actors (i.e. actual human beings writing software to be useful to themselves and others), and also by pure FOSS companies (see: sourcehut).

Yeah, it is practically true that AGPL means a project is impossible to use for a lot of people, but that doesn't have much to do with the license itself. A lot of developers work for companies that have legal departments that would rather err on the side of caution with copyleft stuff. But of course a lot of companies love GPL code nowadays. After all, the GPL allows them to exploit the loophole closed by the Affero clause, especially in the case of web services companies. From a corporate perspective, free software is good, but it's only great when you don't have to follow it, because then you effectively get to crowdsource some of your development costs without any reciprocal obligations.

The result is that a lot of developers have had to sign contracts with their employers that say they'll never use or contribute to AGPL code even in their personal time. This is often reinforced by mandatory compliance training that repeats bogus nonsense about how if you ever run an AGPL program on your personal laptop you could turn the entire company codebase into GPL code. These myths then proliferate and end up driving other companies to do the same thing. It's all FUD of course, whether the people repeating it know that or not, but the practical consequences are that a lot of people legally cannot interact with AGPL projects at all. Again, that's not because the license is all that restrictive but because of what amounts to a universal corporate boycott.

It's impossible to please everyone :).

What percentage of companies do you think impose these kinds of restrictions? From what I've seen, lots of small/medium tech places barely care about software licenses at all.

I'm a little bit confused about this. I was under the impression that images were dead.[0] What is the advantage of building images and having to deploy them locally either via usb or pxe?

I'm assuming this is for user's machines, but wouldn't it make more sense to use a config management tool?

[0](https://isimagingdead.com/)

As the dead comment states, that link is only for MacOS, whereas goldboot appears to be for windows, linux, and macOS.

That link was awesome :D

I'd have to agree. Immutable is great for headless server scenarios but I'd imagine it would be a huge headache as a daily driver for end-user desktop scenarios.

Immutable systems like this are great in a lot of educational setups where a lot of different students work at potentially many different workstations while always needing access to the same tools and in general having a "unified" experience.

That link is specifically about MacOS

Reply on news.ycombinator.com