Okay well first thing I've learned with SELinux: it's kinda broken on Universal Blue atomic distros right now, due to a quirk of how OCI-based ostree images get built. Binaries in such images don't get the right SELinux labels applied to them, and so installing anything privileged like libvirtd or incus results in broken programs, unless you turn off selinux enforcement :/
iiuc, Silverblue is not affected by this since it doesn't (yet) use the OCI based ostree mechanism.
Part of the appeal of going to a redhat-ish system is to finally have nice things with selinux, so I don't think I'm willing to just turn it off in order to be able to use bluefin and ucore :/
Blergh, so I guess next up is Fedora Silverblue, and see how it does...
btw found this trying to learn about selinux, and finding that tools like seinfo aren't installed so I couldn't go peek at the system config, and running seinfo inside a distrobox fails due to the imperfect illusion of not being a container, and I realized that this atomic distro stuff makes debugging the system itself quite tricky if it doesn't ship the tools you need to debug it, or said tools are shipped broken.
That definitely pushes me back away from the bleeding edge a fair bit.
@4raylee That's pretty much all the redhat atomic distros and their derivatives... ostree is pretty much that, albeit it seems all its users wrap it in more layers and end up hiding that fact or making it unusable in some way.
Add comment