# Vanilla OS (Linux Distro) **URL:** https://discuss.privacyguides.net/t/vanilla-os-linux-distro/11784 **Category:** Tool Suggestions **Tags:** waiting **Created:** 2023-02-15T09:08:56Z **Posts:** 25 ## Post 1 by @Darkb — 2023-02-15T09:08:56Z Vanilla OS is a semi-immutable atomic distro based on Ubuntu, that features the `apx` package manager. This awesome program gives you dedicated, isolated containers for all the major distros, and the ability to install apps from those sources that are fully integrated into your system, eg `apx --apt instal` for Ubuntu apps, `apx --dnf install` for Fedora apps, and `apx --aur install` for Arch apps. This works for command line and graphical applications, and it also has Flatpak with Flathub and `nix` out of the box, so you can install pretty much any Linux app. I said “semi-immutable”, because there is a command to enter the root partition (`sudo abroot shell`), for doing things like installing drivers, but they recommend doing this as little as possible. It makes it a much better solution than Fedora Silverblue for the average user, with all this flexibility. I think it deserves a spot on the recommended Linux distro list. It is aiming to be beginner-friendly eventually, but it is still recommended to have good Linux knowledge to use it for now. --- ## Post 2 by @anon46880256 — 2023-02-15T09:15:56Z Last time I checked, VanillaOS didn’t have a way to enable disk encryption during install. Until this changes, I’m not sure it should be considered. Other than that, however, I do agree, VanillaOS is a really interesting project and worth keeping track of for future developments. Another project that does a similar thing is blendOS. > **[Home - blendOS](https://blendos.co)** > > blendOS home page --- ## Post 3 by @anon46880256 — 2023-02-15T09:25:38Z Also, to add on to some of the points for VanillaOS: > [@Darkb](#): > > `apx --apt instal` for Ubuntu apps, `apx --dnf install` for Fedora apps, and `apx --aur install` for Arch apps. This works for command line and graphical applications, and it also has Flatpak with Flathub and `nix` out of the box VanillaOS has a documented list of package managers they support (its grown since I last checked!): [https://handbook.vanillaos.org/2023/01/11/install-and-manage-applications.html](https://handbook.vanillaos.org/2023/01/11/install-and-manage-applications.html) > [@Darkb](#): > > I said “semi-immutable”, because there is a command to enter the root partition (`sudo abroot shell`), for doing things like installing drivers, but they recommend doing this as little as possible. It is fully immutable: [Chronos](https://documentation.vanillaos.org/docs/ABRoot/) --- ## Post 4 by @jonah — 2023-02-15T16:54:15Z > [@anon46880256](#): > > Last time I checked, VanillaOS didn’t have a way to enable disk encryption during install. Until this changes, I’m not sure it should be considered. Going to mark this topic as “waiting.” I’m inclined to agree, also if our criteria PR ([#1980](https://github.com/privacyguides/privacyguides.org/pull/1980)) is merged this will become a hard requirement. --- ## Post 5 by @Darkb — 2023-02-16T05:41:03Z > [@anon46880256](#): > > Last time I checked, VanillaOS didn’t have a way to enable disk encryption during install. Until this changes, I’m not sure it should be considered. [Here](https://github.com/Vanilla-OS/vanilla-installer/issues/102) is the tracking issue, it should be coming soon. --- ## Post 6 by @prosperina — 2023-03-19T12:19:23Z It looks like upcoming versions will be based on Debian. Not sure if that counts for the PG recommendations but I think it’s a big plus: > **[Vanilla OS - is your next Operating System.](https://vanillaos.org/2023/03/07/vanilla-os-2.0-orchid-initial-work.html)** > > Vanilla OS is an operating system built with simplicity in mind. It's fast, lightweight, beautiful and ready for all your daily tasks. --- ## Post 7 by @anon73250778 — 2023-03-19T13:20:31Z Probably not. Something more faster than whatever their cadence is more desirable. Something based on Sid is probably desirable but that might introduce breakages for the user. Although I’ve heard elsewhere that Sid is pretty much becoming more and more stable these days. --- ## Post 8 by @Alex — 2023-03-19T22:39:02Z > [@Darkb](#): > > that features the `apx` package manager. This awesome program gives you dedicated, isolated containers for all the major distros They’re not really isolated, despite being advertised as “a sandboxed environment” [Chronos](https://documentation.vanillaos.org/#title2) all apx is, at least now is a very bare bones wrapper for distrobox which explicitly states sandboxing is the opposite of their goal [GitHub - 89luca89/distrobox: Use any linux distribution inside your terminal. Enable both backward and forward compatibility with software and freedom to use whatever distribution you’re more comfortable with. Mirror available at: https://gitlab.com/89luca89/distrobox](https://github.com/89luca89/distrobox#security-implications) (although they may add a sandboxed mode at some point) Don’t get me wrong, I like the idea of having an immutable base and installing all user apps in sandboxed containers, but it’s not quite there yet and doesn’t yet provide the level of isolation they seem to imply in their docs. --- ## Post 9 by @jonah — 2023-03-21T14:32:29Z > [@anon73250778](#): > > Something based on Sid is probably desirable Vanilla OS 2.0 _is_ based on Debian Sid. --- ## Post 10 by @anon73250778 — 2023-03-21T23:21:12Z I should probably check this out then. Thank you for pointing it out! --- ## Post 11 by @dumpster — 2023-04-09T17:30:36Z Take your time, 2.0 hasn’t been released yet. --- ## Post 13 by @Alex — 2023-08-29T17:51:20Z > [@anon49304593](#): > > FSGuard This looks interesting, just have a couple questions: 1. This looks pretty similar to Advanced Intrusion Detection Environment (AIDE), how is it different and what advantages does it bring? 2. Does it make use of Linux’s Integrity Measurement Architecture (IMA)? Why or why not? > [@anon49304593](#): > > possibly an opt in ClamAV setup Not bad as long as it’s optional, although the only real use case I ever have for it is the compliance checkbox in enterprise settings. Also of note is [picosnitch](https://github.com/elesiuta/picosnitch) which has the option of checking programs with VirusTotal which has much better detection and community ratings. Thanks for you work on Vanilla OS! It’s starting to tick off more and more of my check boxes. --- ## Post 15 by @Alex — 2023-08-29T19:51:31Z Thanks for the quick and detailed reply! > [@axtlos](#): > > I’ll be completely honest, I was not aware of AIDE when writing FsGuard, both seem to be doing the same, with the difference that FsGuard also checks if a file has the suid bit, and modifies it according to the initial database. As a former AIDE user currently looking for something better, the biggest area of improvement is the the signal to noise ratio. AIDE requires lots of configuring to get right, so if FsGuard already has good out of the box defaults it’s miles ahead in my books. This means checking all the right system and configuration files to monitor, and omitting frequently changing log/tmp files, and omitting package updates if the changed hashes match the upstream hashes. > [@axtlos](#): > > Although I could imagine adding support to utilize IMA in the future. This would be a nice feature, especially if I don’t have to customize the kernel myself and just install whatever is required from your repos. I can see why you’d add your own system first though since a kernel with IMA probably has too much of a performance trade off for most users, especially for gaming I imagine. > [@axtlos](#): > > I am a user of picosnitch myself, but I never thought of shipping it in VanillaOS, it could be considered for a future release. I would like this too, especially since I think it would need to be installed on the host instead of inside a container, and I am not sure how easy this is to do on Vanilla OS with immutability. --- ## Post 16 by @Swarming0001 — 2023-11-21T15:08:57Z This looks very interesting. I’m a bit of a distro-hopper so I’ll probably give this one a go. --- ## Post 17 by @theamazing0 — 2024-07-28T13:37:40Z The release notes for Vanilla OS 2 ([Vanilla OS](https://vanillaos.org/blog/article/2024-07-28/vanilla-os-2-orchid---stable-release)) include “Orchid takes your data security seriously, this is why we suggest encrypting your personal data by default, ensuring it stays private and protected from unauthorized access.” which suggests that disk encryption is an option during install. --- ## Post 18 by @Darkb — 2024-07-28T21:45:01Z Yes, Orchid has an option in the installer to encrypt your /var partition (and user files are stored in /var/home, like Silverblue). The rest of the root is immutable/atomic, and protected by FsGuard (which was explained by its developer earlier in this thread). --- ## Post 19 by @InternetExplorer — 2024-07-30T11:17:35Z I tried Vanilla OS Orchid for a bit… just to switch back to Fedora very quickly. I noticed a few things: - Installation is takes long time (probably because of this A/B partition scheme) - If you have a bad connection, finishing the app installation takes also a very long time (because every app it installs is Flatpak) - The subsystems via apx didn’t worked at all (failed immediately with exit code 255) - no Secure Boot support (the [handbook](https://docs.vanillaos.org/handbook/en/installation) of the previous version says “Good to have **Secure Boot enabled** ” - didn’t got to the login screen after unlocking the disk) - uses X11 instead of Wayland (unsure if it’s just with Nvidia drivers or always) The project has potential definitely, but it’s currently not ready imo to be mentioned on Privacy Guides if you ask me. --- ## Post 20 by @Astatine — 2024-10-11T16:40:26Z I apologize for reviving this conversation, but is there going to be any progress with adding [VanillaOS](https://vanillaos.org/) as a recommendation, or is it going to be rejected? VanillaOS Orchid 2, was released a a few [months ago](https://vanillaos.org/blog/article/2024-07-28/vanilla-os-2-orchid---stable-release) It is unfortunately not [rolling release](https://vanillaos.org/blog/article/2023-03-07/vanilla-os-20-orchid---initial-work), however. It does support [full disk encryption](https://vanillaos.org/blog/article/2023-11-22/vanilla-os-orchid---devlog-22-nov). It almost fits the criteria below, with a few issues: > - Free and open source. :white_check_mark: > - Receives regular software and kernel updates. :cross_mark:(No, it’s point release like Debian) > - Avoids X11, as its last major release was more than a decade ago. :white_check_mark: (Uses GNOME) > - Supports full-disk encryption during installation. :white_check_mark: > - Doesn’t freeze regular releases for more than 1 year. :cross_mark:(No, it’s point release like Debian) > - Supports a wide variety of hardware. :white_check_mark: > - Preference towards larger projects. :cross_mark: (It’s not…) --- ## Post 21 by @Shampoo — 2024-10-11T21:58:59Z > [@Astatine](#): > > It is [rolling release](https://vanillaos.org/blog/article/2023-03-07/vanilla-os-20-orchid---initial-work) According to that article vanillaOS isn’t a rolling release. It’s based on a snapshot of a rolling release. --- ## Post 22 by @anonfox — 2024-10-12T11:02:41Z > **[Vanilla OS - is your next Operating System.](https://vanillaos.org/blog/article/2023-01-31/point-vs-rolling-release-and-the-modern-solutions)** > > Vanilla OS is an operating system built with simplicity in mind. It's fast, lightweight, beautiful and ready for all your daily tasks. They say it’s frozen --- ## Post 23 by @Astatine — 2024-10-12T12:45:28Z Thanks for pointing that out, I completely missed that. --- ## Post 24 by @anon48875053 — 2024-10-12T13:00:26Z If a desktop distribution isn’t a rolling release (Tumbleweed, Aeon) or a semi-rolling release (Fedora, Silverblue), then you should avoid it. Above distributions are just examples. --- ## Post 25 by @anon52856436 — 2024-10-12T19:35:27Z [https://vanillaos.org/blog/article/2024-09-25/vanilla-os-2—future-plans-updates-and-next-release](https://vanillaos.org/blog/article/2024-09-25/vanilla-os-2---future-plans-updates-and-next-release) They plan to have an experimental version eventually which I believe means rolling, but that experimentality might have security risks of its own