Hi, mostly i use REHL based distros like Centos/Rocky/Oracle for the solutions i develop but it seems its time to leave…
What good server/minimal distro you use ?
Will start to test Debian stable.
You can’t go wrong with Debian
All my servers run debian and it’s going swimmingly. My daily driver runs bookworm with huge success
Bookworm is such a tremendously good release. I’ve been on Debian since Potato, and IMHO we are seeing the absolute best release they ever put out.
I’ve used debian on and off since the late 90s, what stands out about bookworm? They’ve been mostly the same to me, not that that’s a bad thing.
I’m going to throw my support behind this one as well. I’m circling back to Debian after a long stint on Fedora on my primary machine. I’ve been running Debian 12 on my desktop for several weeks now and it’s been pretty great.
it is one version behind fedora in gnome releases, so I installed the latest gnome from the experimental repos and that worked pretty well. I don’t know if I would recommend that for anyone else, but it worked for me.
I have a few personal servers still running CentOS 7, but I will be migrating them to Debian slowly over the next few months. I suspect I will go fine. Debian organization to maintain FOSS ideals over the next 5 to 10 years, so it seems like a good default for me.
I have read about Vanilla OS. It is Debian based with some neat features stacked on top that might be fun for a desktop OS. I can see myself switching to that on the desktop if they deliver on all their promises.
Life long Debian (and Debian derivatives) user (23 years and counting). I have pretty much settled down into (this has been true for years):
- Debian for servers.
- Mint for workstations (that you want to just work and don’t want to spend time troubleshooting / tinkering). Mint is linux your grandma can use (my Boomer real estate broker father has been running Mint laptops for the last 5 years).
- Ubuntu for jr. Engineers who want to learn linux.
- Qubes (with Debian VMs) for workstations that must be secure (I’ve been working recently with several organizations that are prime targets either the CCP or have DFARS / NIST compliance requirements).
I would recommend openSuSe. It is using rpm, but it is an independent distribution.
Huge fan of openSuse Tumbleweed. Rolling release like Arch with the backing of a decently sized organization.
I think OpenSuSe is really the best alternative. As much as I like Debian, OpenSuSe will be pretty comfy for someone coming from RHEL.
Until it is clear, how Leap 16 will look like, I would not start to use it now.
Debian.
Desktop? Arch. Server? Debian, NixOS.
Go Debian
Debian 12 just released this month too! It has LXD in the repos now, no snap required.
Debian 12, Opensuse leap or tumbleweed, SLES, Fedora, Linux mint / LMDE, Freebsd, Alma Linux OS
NixOS
Reproducible and unbreakable
With great power comes a steep learning curve.
Eh. I mean it’s certainly a smaller curve than other “hard” distros like Arch or Gentoo, and there really isn’t one at all since the installer does most of the complicated stuff for you.
Would I recommend it to beginners? Probably not as they wouldn’t be willing to do any reading, configuring, or time sinking at all.
However, for this use case of building solutions by an experienced Linux user, the 30 min to an hour of learning is really not a lot when it would save a ton of time down the line. It’s not like you need to be a nix lang or nixos expert to use it effectively
I mostly agree with this, I have it on my laptop. Took an hour or two to learn it, used a live image from the website just like any distro. Not for beginners, but someone that is used to arch, after you rtfm it’s fine.
I see more and more people mentionning NixOS, until I read your message I thought it’d be more complicated than that to use it. But I have a beginner question: do the Nix repositories contain many packages that you’d want, or do you find yourself installing stuff manually?
Debian always
If your solutions are work/job related and need to be distributed I think your current options are SUSE or Debian. If your solution is something only you maintain, you could check out NixOS.
One of my work colleagues actually uses Nix on Debian to distribute a piece of software. Though it is software made for a hardware appliance so that’s a bit special.
Debian stable. The mix of having a stable host but being able to pull in flatpak / appimage / docker containers with newer software is awesome.
Debian yes, but don’t install from flatpaks or docker. Neither is secure.
AppImage can be secure if the release is signed.
Docker can pull images securely, but it’s disabled by default and many developers don’t sign their releases, so even if you enable it client-side there’s a risk you’ll download something malicious.
Flatpak is never secure because it doesn’t support signing of releases at all.
Apt is always secure because all packages must be cryptographically signed (by default).
Flatpak is never secure because it doesn’t support signing of releases at all
Can you elaborate on this? I ask because I build my own flatpaks, and signing is part of the publishing process.
You should switch to something that’s actually secure. Flatpak devs haven’t addressed this since 2015, and I doubt they ever will. They don’t seem to care about security.
Your earlier comment complains about pulling images securely, presumably meaning signature verification, which I believe Flatpak does.
The report you linked is about tying downloaded sources to their author using public key infrastructure, which is a different issue. APT and dpkg don’t do that, either. (I know this because I build and publish with those, too.)
Can you name a packaging system that does? I can’t. I would like to see it (along with reproducible builds) integrated into the software ecosystem, and I think we’re moving in that direction, but it will take time to become common.
I have my own criticisms of Flatpak, mostly regarding the backwards permissions model (packages grant themselves permissions by default) and sloppy sandboxing policies on Flathub, so I caution against blindly assuming it’s safe. But claiming that it doesn’t support signing of releases is just plain false.
This is not correct. APT always verifies cryptographic signature unless you explicitly disable it. Yet it’s very important to understand who is signing packages. What kind of review process did the software go through? What kind of vetting did the package maintainer themselves go through?
If software is signed only by the upstream developer and no 3rd party review is done by a distribution this means trusting a stranger’s account on a software forge.
This is not correct. APT always verifies cryptographic signature unless you explicitly disable it.
You’ve misunderstood what I wrote.
I believe Flatpak does.
Flatpak does not authenticate files that it downloads. Please stop spreading misinformation that flatpak is secure. It’s not.
If the flatpak (flathub?) repo was compromised and started serving malicious packages, the client would happily download & install them because it doesn’t have any cryptographic authenticity checks.
APT and dpkg don’t do that
Apt does verify the authenticity of everything it downloads (by default) using PGP signatures on SHA256SUMS manifest files. This provides cryptographic authenticity of everything it downloads. Flatpak doesn’t do this.
Again, this is clearly documented here https://wiki.debian.org/SecureApt
Again, you’re confusing two different things (sources vs. packages). I’m not going to argue with you, though. Good day.
I’m talking about the end-user securely downloading packages from the repo, not how the package maintainer obtains the software upstream.
How a package maintainer obtains the software from the source is dynamic and depends on the package. Ideally those releases are signed by the developer. In any case, if the package is poisoned when grabbing the source, it’s much easier for the community to detect than a targeted MITM attack on a client obtaining it from the repo.
I can say that I do maintain a software project that’s in the repo, and we do sign it with our PGP release key. Our Debian package maintainer does verify its authenticity by checking the release’s signature. So the authenticity is checked both at the source and when downloading the package.
minimal: alpine
general purpose: debian or CentOS, i’ll still use it for now.Can’t really go wrong with Debian or Ubuntu server LTS
You can definitely go wrong with an Ubuntu server
How? I’ve run several for years with no issue. They’re as stable as a rock
snaps are pretty insecure.
Snaps are pretty terrible IMO, so I usually end up bootstrapping a custom Ubuntu image without snap for this reason (and others) for my cloud images. Definitely not general purpose though.
*citation needed
Go to the snap site and try to find a security section that describes how snap packages are signed. You won’t be able to find it because it doesn’t exist, and they don’t highlight their own security vulnerabilities.
What I can cite is how this should work, for example how apt signs all packages by default
Note how in the above doc there’s a message
WARNING: The following packages cannot be authenticated! ... Install these packages without verification [y/N]?That doesn’t exist in snap because snap does not authenticate downloads. It’ll just happily install something maliciously modified.
I’ve been running Debian stable for years now on everything. My laptop runs it, my home server runs it headless with no GUI installed, my gaming desktop runs it and even my kids run it without issue. If we need a newer version of some desktop app I just get the Flatpak. It’s pretty great and the good thing is that it’s predictable. Once it’s up and running I don’t have to worry about things breaking because of an update.
Debian is my go-to for containers and VMs. Stable af. For my laptop and desktop I run pop_os.
Any issues with CentOS stream for your work? Could always switch to Fedora server too if you wanted to keep the same structures and such, but separate some from RedHat.
