Immutable Bookworm

[pwzhangzz]

(In Taiwan attending Computex 2024*)

No big deal. We (me & most forum members) have major differences in backgrounds and drives for using Debian/Linux. Totally expected. Really appreciate your opinions (& those of others).

* This is a very big event, keynote speakers include Lisa Su (CEO of AMD), Pat Gelsinger (CEO of Intel), Rick Tsai (CEO of MediaTek), Charles Liang (CEO of Supermicro), Jensen Huang (CEO of Nvidia), etc. These are just some the names that I can recognize. Only 5000 seats are available, very difficult to get ticket.

[donald]

(In Taiwan attending Computex 2024*)

No big deal. We (me & most forum members) have major differences in backgrounds and drives for using Debian/Linux. Totally expected. Really appreciate your opinions (& those of others).

* This is a very big event, keynote speakers include Lisa Su (CEO of AMD), Pat Gelsinger (CEO of Intel), Rick Tsai (CEO of MediaTek), Charles Liang (CEO of Supermicro), Jensen Huang (CEO of Nvidia), etc. These are just some the names that I can recognize. Only 5000 seats are available, very difficult to get ticket.

We should have made you a Debian User Forums t-shirt!

[pwzhangzz]

But again everyone seems to have ignored an important factor in our choice of bookworm in making our immutable system. As I mentioned, again repeatedly, Debian bookworm went through more than two and half years of open and public testing before it came out, and we have at least made every effort to familiarize ourselves with this product before introducing it to our students. This is the same reason why we are using Sid (not Testing) as our primary OS.

Debian has another distinctive advantage, as far as we are concerned, in the ease and flexibility of making a Debian Live USB. Previous discussions briefly touched the aspect of flexibility (e.g., simulating a live "usb" in a system disk), the following is an example illustrating how easy it is to create a Debian Bookworm Live USB (an "immutable" system).

An example of making a Debian Bookworm Live USB without persistence:

1. Create a fat32 partition, of at least 4GB, as the first partition on a usb; this partition can be labeled "EFI", or any other label, or without label.

2. Mount a Debian Bookworm live iso; this can be a live iso downloaded from Debian web site, or any remasterized live iso that we hope the community can help to optimize (thus the description "iteration").

3. Copy the content of the above-mounted live iso to the fat32 partition* (this example uses Gnome Nautilus to mount the live iso and it was automatically assigned the directory name of "d-live 12.5.0 gn amd64":

Code: Select all

rsync -rlv /media/ryzen/"d-live 12.5.0 gn amd64"/   /media/ryzen/EFI

This is only one of the examples of preparing a Debian Bookworm Live USB from an official live iso (Debian developers call it "non-official"), or an iterated live iso that you subsequently created with the help of a persistence partition. With this approach, it is very easy to add persistence.

* I suppose I could also do this with Windows Explorer, but since I don't use Windows (a severe disadvantage definitely not something to brag about), don't have any idea.

[pwzhangzz]

If you're surprised at how easy it is to create a Bookworm Live USB, you'll be even more impressed at how much easier to create a Bookworm Live USB with persistence. It's so open, so transparent, and completely third_party_apps_free.

An example of making a Debian Bookworm Live USB with persistence:

1. The first thing that needs to be done is to create an ext4 partition, labeled "persistence"*. Because USB sticks are cheap (a 64GB usb stick is selling for less than 5 bucks), we typically gave it 16GB of space.

2. Then create a persistence.conf file in this persistence partition, the simplest form is:

Code: Select all

sudo chmod -R a+rw /media/ryzen/persistence;   echo  / union > persistence.conf

3. Finally, edit the /boot/grub/grub.cfg file in the live iso (the content of which has been copied to the fat32 partition) to add the "persistence" parameter to the kernel boot option:

linux /live/vmlinuz-6.1.0-18-amd64 boot=live persistence components quiet splash findiso=${iso_path}

* I don't know how to use a different label for this persistence partition, for example, using "bookworm_1" instead of "persistence". If anyone can find any info, would really appreciate it.

** as a further "off" topic, during this trip to Taipei, I realized, for the first time, how f*cked up Android is (Google's new motto: do nothing but evil). The info you supplied as well as those collected by Google at least via Google PlayStore is etched into the phone itself, a factory reset will not erase it. Thus, when you create a fake account, those who paid money to Google will know who you actually are. Not only search results are full of sponsored junk, every time I went into a store, ads related to goods sold in the store would automatically pop up. No wonder an immutable system has its special appeal.

[panpan]

@pwzhangzz, I think that for the immutable system you want to make the best distribution is with this tool: https://mxlinux.org/wiki/help-files/hel ... -snapshot/

At the persistent live USB you suggest, how you can add the command in read only state, made for example the USB with the dd command?

linux /live/vmlinuz-6.1.0-18-amd64 boot=live persistence components quiet splash findiso=${iso_path}

[pwzhangzz]

? ? ?

We don't use dd ???

[pwzhangzz]

"Snapshots" can be done by making a time-stamped copy of the /persistence/rw folder. A simple cp or rsync command will do.

Actually, a remasterized live iso is a self-contained snapshot which is bootable essentially from any PC. This is the whole idea behind this "immutable" Debian Bookworm thing.

[pwzhangzz]

Come to think about it, I think it is possible to invoke persistence with a dd-created live usb, assuming you already have a persistence partition properly set up on the system HD. However, this is quite cumbersome and since I don't think our students are technically savvy enough to handle it, it's not worth any discussion.

[pwzhangzz]

I don't think our students are technically savvy enough to handle it

Actually one of our former students is a retired professor of electrical engineering who has advised myriad of PhD graduates. In terms of Unix and low-level programming skills, I don't think I can find too many of his peers. But he was struggling trying to install Mint on his Windows laptop, and our persistent (at that time) Ubuntu Live USB helped him got started on Linux. He has since moved on to Macbook. We are just too small and with too limited resources*, can't do much beyond the initial welcome.

* This statement probably needs to be qualified. Who is Linux competing against? Microsoft (Windows) and Apple (MacOS). The latter recently overtook the former as the largest company in the universe, both are over three trillion dollars in market cap (for comparison, Intel has a market cap of "only" just under 130 billion). Any corporation will be "too small and with too limited resources" if to go against either. **

** That said; however, recently Huawei's HarmonyOS (华为鸿蒙) has overtaken iOS as the No. 2 operating system for phones in China. It went from essentially zero percent just two years ago to 17% in 2024Q1. Since HarmonyOS is only pre-installed in new phones and since the majority of Android phones are over two years old, the percentage of new phones in China that run the HarrmonyOS could be much much higher than the 17% reported. An interesting observation is, during my recent trip to Taiwan (attending Computex 2024), I watched a couple of Chinese soaps (with English subtitle) in my hotel room. I specifically noticed that people in the shows are actually using the HarmonyOS. Devil is in the details; this is a more powerful statement than news report/propaganda.

Ed.: As I mentioned above, since I started this thread, I have been more extensively using this bookworm live iso as my daily OS. Initially it was done with the aid of a persistence partition. After several iterations through remastering, I am getting very comfortable running the live iso without the persistence partition. Actually I am getting a kick of running this immutable bookworm! While this is an immutable system, some flexibility (ie., "persistence") can still be provided by aliasing ("mount --bind") external folders into the live iso, and by extensively using appimages for third-party apps, such as LibreOffice, gimp, google-chrome, etc, which can be updated without touching the live iso. Some of these "portable" applications include:

avidemux_2.8.0.appImage. LibreOffice.AppImage, digiKam-7.8.0-x86-64.appimage, Gimp.AppImage, linuxqq_3.1.2-13107_x86_64.AppImage, Google-Chrome.AppImage. Login_Manager_Settings.3.2.AppImage, shotcut-linux-x86_64-220923.AppImage, Inkscape-dc2aeda-x86_64.AppImage, VLC_media_player-3.0.11.1-x86_64.AppImage, krita-5.2.2-x86_64.appimage

Now that I have an immutable bookworm for daily use, the next step is to discuss the steps of creating a Sid LiveUSB with persistence.

[friendlysalmon88]

One of the critical advantages of using bkworm in making an "immutable OS" is that after more than two and half years of the equivalent of (open and public!) alphas, betas, RCs, etc via Sid and/or Testing, Bkworm is a very mature and very stable operating system.

If we are in the GNU/Linux community and wish to attract both Windows and Apple OSX users of any age and skill level, we need to embrace solutions like Silver Blue and its competitors. I much prefer to use a distribution such as Debian or one of its several derivatives which are just as good I'm looking right at you Linux Mint.

[CwF]

we need to embrace solutions like Silver Blue and its competitors.

No, we don't, not really

[pwzhangzz]

Speaking of Fedora, I was one of the handful of supporters of the original Fedora Linux when it came out of University of Hawaii's computer lab right after Red Hat abandoned the community edition of Red Hat Linux. (Fedora Linux's creator Warren Togami, then a junior CS student at University of Hawaii, has since assigned all its IP rights to Red Hat. UH's current president, Dr. David Lassner, was director of its computer lab at that time.) I would love to return to Fedora if I could, but Fedora is not really for daily consumption by the general public. In contrast, if managed properly, Debian Sid provides an essentially seamless transition between progressive versions of Debian. As a result, Debian Bookworm, when it came out, had over two and half years of public testing under its belt, which was tagged onto another two and half years of Bullseye development. And so on so forth . . . The process is continuous. This is the beauty of using Debian as a base for creating an immutable OS. Of course, the "two and half years of public testing" doesn't mean much if not enough users participated in the testing process.

After I started this thread, I began using my own remasterized immutable bookworm on a more regular basis. I like it. Actually I Like It A Lot! Except occasionally boot into Sid (mainly to update the installed base), I am using this live iso (w/o a persistence partition) almost all the time. However, just yesterday, I had to boot into the persistence mode to install the libfuse2 package b/c some appimages won't run without this library. As time goes on the need for remasterization should get rarer and rarer. (Of course I could run a script to do away with the need for remasterization.)

Most people don't use (& don't have) PCs at home any more. But most people still need a computer to write documents and do spreadsheet accounting, etc. As a result, the computers should be made as simple as possible, no one is interested in messing with the operating system. An immutable Debian fits the bill very well (& probably the only hope that Linux will beat Windows and Mac*). What we really need is a system that integrates pc and mobile phone. My lack of experience with apps like GSconnect puts me in a severe disadvantage.

* LibreOffice provides several options for running appimages, which are in sync with regular LibreOffice updates:

https://www.libreoffice.org/download/appimage/

https://appimages.libreitalia.org/Libre ... 4.AppImage

Also, AppImages for Google Chrome can be downloaded from:

https://github.com/ivan-hc/Chrome-appim ... continuous

[DebianFox]

How does a immutable system created on bookworm actually handles security and feature updates. While this concept looks good it does have some limited use cases and scenarios. Further the security that all the viruses, trojans, junk is discarded on reboot is a mirage. As the very same viruses, trojans, junk can re-accumulate once again.
Is something missing over here?

[pwzhangzz]

Absolute security is way beyond the scope of our interest. What we have here is simply an "immutable system" (aka "live iso" or "read-only system"). When the computer is powered off, it will return to its original state. Nothing more. Our students are fully aware of this limitation and have a propensity to try to keep their computer on time as short as possible.

Regarding system update, this is part of the remasterization process as discussed above.

[pwzhangzz]

In contrast, if managed properly, Debian Sid provides an essentially seamless transition between progressive versions of Debian. As a result, Debian Bookworm, when it came out, had over two and half years of public testing under its belt, which was tagged onto another two and half years of Bullseye development. And so on so forth . . . The process is continuous. This is the beauty of using Debian as a base for creating an immutable OS. Of course, the "two and half years of public testing" doesn't mean much if not enough users participated in the testing process.

Because Sid is constantly being updated, as opposed to the much more "stable" bookworm, it is not practical to build an immutable Sid live iso. However, the aforementioned steps can be used to include (1) an immutable Sid and (2) a live Sid with persistence in the grub boot option, by adding the following two menuentries to the grub.cfg file*:

Code: Select all

menuentry "Debian Sid Remasterized" --hotkey=l {
	linux	/live/vmlinuz-6.9.7-amd64 boot=live components noeject quiet splash findiso=${iso_path}
	initrd	/live/initrd.img-6.9.7-amd64
}

Code: Select all

menuentry "Debian Sid with Persistence" --hotkey=l {
	linux	/live0/vmlinuz-6.8.12-amd64 boot=live persistence components noeject quiet splash findiso=${iso_path}
	initrd	/live0/initrd.img-6.8.12-amd64
}

Part (2) can be remasterized to update part (1).

Since Debian developers do not provide live iso for Sid, it must first be upgraded from Debian testing. I have tried to build Sid live isos using the live build package, but their quality was always not as good as those remasterized from the official live iso. Some things were always missing.

* It is possible to use different labels for the persistence partitions (thus allowing multiple persistent Bookworms and Sids on the same USB stick, each with its own persistence partition--if you don't mind turning your Debian world upside down), but I understand this thread is already confusing enough for most "traditional" Linux old-timers (i.e, using installed systems), I won't stray further. As the title suggests, the gist of this thread, though so far largely a futile attempt (an understatement ), is to collect "low tech" user experiences (i.e., how you use your Debian desktop for everyday chore**) so as to iteratively build an immutable Debian Bookworm live iso that will be enticing/easy to use by the general public.

** Or how you will build a Debian desktop for your grandma .

[DebianFox]

Absolute security is way beyond the scope of our interest. What we have here is simply an "immutable system" (aka "live iso" or "read-only system"). When the computer is powered off, it will return to its original state. Nothing more. Our students are fully aware of this limitation and have a propensity to try to keep their computer on time as short as possible.

Regarding system update, this is part of the remasterization process as discussed above.

Yeah but the issue of re-infection still remains. Because of the re-initialization of the system in its flawed form with the security holes is booted up again. Further the system is immutable as long as the physical storage medium onto which it is written it immutable. In simple words, a ssd / flash drive / hdd has data that can be overwritten. If the ISO is burnt on a DVD-RW or CD-RW then that immutable system image can be infected.

[pwzhangzz]

** Or how you will build a Debian desktop for your grandma .

The other end of the user spectrum is teen-aged kids. From our experience, kids don't care about open source, but they LOVE LibreOffice*. Schools use Microsoft Office, but for some reason kids hate Microsoft Office. LibreOffice seems to give them "freedom", both spiritually (for lack of a better word) and functionally/technically speaking. As mentioned above, we run LibreOffice as an appimage so that it can be upgraded without touching the iso or the squash file. The appimage, not only itself is read-only, it is also stored in a read-only partition. This way the whole USB is read-only. Our older students are especially careful about security, but for high school kids, we have to make sure that the whole thing, especially something like a USB stick that can be carried around, is immutable--just like a CD/DVD.

Of course, any tool that can fend off internet attacks while the system is running on RAM will be a great addition to this immutable live iso. This is an iterative process.

* What really struck me is that we have tried to teach some kids to use Microsoft Office but almost always hit a stone wall; they seemed to have problems remembering the steps. But with LibreOffice, it's a different story. Within a few minutes of introduction, they were already on their own. Actually some of them were able to teach us a few tricks.

[DebianFox]

It will be funny to find out why the teen-aged kids love LibreOffice is it the rebellious streak or something else?

[pwzhangzz]

[W]ith LibreOffice, it's a different story. Within a few minutes of introduction, they were already on their own. Actually some of them were able to teach us a few tricks.

One of the things the kids taught us was that you can activate the "Draw" functions in LibreOffice "Writer", thus combining the features of both Draw and Writer and making LibreOffice a very neat tool for school writing projects. Kids love unbridled freedom (whatever that means), which is synonymous with creativity. Of course the "Show Draw Functions" icon has been there in the Writer toolbar for quite some time but we never paid attention.

Although this thread is about Bookworm, discussions on LibreOffice actually do not stray from the subject. From our experience, we can never (& WILL NEVER) install Debian or any other Linux distro in anyone's machine. Again, from our experience, short of using your own laptop, a live USB is the only way to get someone to try Linux (on their machine). And an enticing app is the only way to get kids willing to try a live Linux USB. Staying power, however, is another story. Our live USB is just not enticing enough.

[pwzhangzz]

This is a screenshot of running an "immutable bookworm" (i.e., customized live USB) on HD (NVME):

As mentioned previously, since I started this thread I have begun to use this live bookworm iso as my primary OS for everyday use. As a relatively experienced Debian desktop user, using a read-only system was awkwardly inconvenient. Almost everything I need was missing. However, things got much improved as time went on and the bookworm live iso got incrementally customized. I have a live iso dual-grub-boot subsystem, one with persistence and one without, that are attached to the system grub.cfg file via running the /etc/grub.d/40_custom script* in case I need to further modify my live iso. But this need has become less and less frequent. It definitely gives me a different feeling running a read-only (aka "immutable") OS, especially in light of the CrowdStrike/Microsoft fiasco today.

As shown in the screenshot, Google Chrome is running as an appimage in RAM. Ditto LibreOffice but for some reason it was not shown as also mounted in /tmp.

* This is an example of the /etc/grub.d/40_custom file that I have been using for my immutable bookworm:

Code: Select all

user@debian:/tmp$ cat /media/user/d12/etc/grub.d/40_custom 
#!/bin/sh
exec tail -n +3 $0
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
menuentry "Debian 12.6 ISO Remasterized" {
set iso_path="/debian12/new-debian-live-12.6.0.iso"
        search --no-floppy --label --set=iso_partition iso
rmmod tpm
loopback loop ($iso_partition)$iso_path
linux (loop)/live/vmlinuz-6.1.0-22-amd64 boot=live components quiet splash noeject noresume findiso=$iso_path
initrd (loop)/live/initrd.img-6.1.0-22-amd64
}
menuentry "Debian 12.6 ISO with persistence" {
set iso_path="/debian12/debian-live-12.6.0-amd64-gnome.iso"
        search --no-floppy --label --set=iso_partition iso
rmmod tpm
loopback loop ($iso_partition)$iso_path
linux (loop)/live/vmlinuz-6.1.0-22-amd64 boot=live persistence persistence-label=persistence_12 components noresume noeject quiet splash findiso=$iso_path
initrd (loop)/live/initrd.img-6.1.0-22-amd64
}

Both the official (with persistence) and the remasterized bookworm isos are stored in the "iso" partition on the HD. They can also be stored on a USB, thus allowing the USB-based immutable or persistent live iso to boot from HD.

The following grub.cfg file is used to run a similar immutable bookworm multi-boot: from a USB stick

Code: Select all

source /boot/grub/config.cfg

menuentry "Debian 12.6 remasterized" {
	linux	/live/vmlinuz-6.1.0-22-amd64 boot=live components noeject noresume quiet splash findiso=${iso_path}
	initrd	/live/initrd.img-6.1.0-22-amd64
}

menuentry "Debian 12.6 ISO with persistence" {
set iso_path="/debian12/debian-live-12.6.0-amd64-gnome.iso"
        search --no-floppy --label --set=iso_partition iso_usb
rmmod tpm
loopback loop ($iso_partition)$iso_path
linux (loop)/live/vmlinuz-6.1.0-22-amd64 boot=live persistence persistence-label=persist_12 components noresume noeject quiet splash findiso=$iso_path
initrd (loop)/live/initrd.img-6.1.0-22-amd64
}

menuentry "Debian 12.6 ISO Remasterized with persistence" {
set iso_path="/debian12/new-debian-live-12.6.0.iso"
        search --no-floppy --label --set=iso_partition iso_usb
rmmod tpm
loopback loop ($iso_partition)$iso_path
linux (loop)/live/vmlinuz-6.1.0-22-amd64 boot=live persistence persistence-label=persist_12b components quiet splash noeject noresume findiso=$iso_path
initrd (loop)/live/initrd.img-6.1.0-22-amd64
}