Immutable Linux is about as secure as an OS can get. By mounting certain directories as read-only, malicious code or bad actors cannot affect the data within. I could seriously place my full faith in immutable Linux and not worry about a thing.
Until I wanted to install an application using the distribution's built-in package manager.
With immutable Linux distributions, software is typically installed via containers, such as Flatpak or Snap. Installation of apps is done this way because of the read-only nature of certain directories. Because of that, standard package managers cannot install the necessary files, so using the likes of apt, dnf, or pacman is a no-go.
Does that mean you're limited to the apps you have available on an immutable distribution? Somewhat. Don't get me wrong, the average user won't feel as if they're missing out on anything because Flathub and Snapcraft have tons of apps.
But when I'm using an immutable distribution, and I want to install something like Ollama, I'm out of luck if I want to ensure I'm using the latest version of the app (I currently run Ollama 0.30.7 on my Pop!_OS desktop). I've attempted to install Ollama via Flatpak, and although the command completes, the app is nowhere to be found.
I've tried several times, but the end result is a failure. However, running the command sudo dnf install ollama works just fine; it shouldn't, but it does.
Why should the DNF command fail? Because RakuOS is immutable, installing via DNF shouldn't be possible. That's where RakuOS says, nay, nay. How does RakuOS pull this off? According to the official site, "RakuOS uses a persistent overlay system mounted directly on /usr. Your base system is always pristine -- but you can install any native package you want, and it survives every system update."
With this hybrid system, you get: In other words, you get the best of both worlds.
The thing I appreciated the most about RakuOS is that, while it had all of the underpinnings of an immutable distribution, it still felt like a traditional Linux OS. The only difference was that instead of the KDE Plasma Discover app store, there was the RakuOS Software app store. The good news is that the RakuOS Software app looked and behaved similarly to that of Discover.
With RakuOS, I was able to install all of the software I normally would use via a combination of Flatpak and DNF. If I wanted to install an app with the added security of isolation, I used Flatpak; otherwise, I dove into DNF.
As far as performance is concerned, RakuOS uses the CachyOS kernel, so it's built for speed. No matter what I threw at the desktop, it didn't bat an eye. Even running a hefty Ollama query (writing a Python GUI app) didn't slow the machine down.
That CachyOS kernel is something special, and the RakuOS devs were smart to include it.
But then, my curiosity got the best of me, and I decided to try the "pristine reset" option to see how well it worked. After installing several apps and saving some files/data to my home directory, I scoured the RakuOS website for any mention of the actual command used for this, but found nothing.
Given how RakuOS creates the overlay in /usr, I thought, "What happens if I simply remove everything in /usr? Couldn't hurt, right? I am running RakuOS as a virtual machine, so if it does FUBAR the system, I can spin up another VM without much trouble.
A quick restart to see what the results were, only to find the restart failed. I forced the VM off and then restarted. The boot process took considerably longer than I would have expected, but then, given that I'd nuked the /usr directory, I'm thinking maybe RakuOS had to rebuild it.
I waited, and waited, and waited.
Once more unto the breach with a reboot, and the same issue persisted. Time to reinstall. This time around, I remembered that RakuOS was based on OSTree, so the command was simple: Even someone who's used a piece of technology for decades can get tripped up now and then.
The second time around, everything went well, and I wound up with a pristine OS (after installation, use, and resetting with the proper command).
My final thought on RakuOS is this: I'm impressed. This Linux distribution gives users the best of both worlds: immutability with the ability to use default package managers. Although installation takes a bit longer than I'm used to, the end result is very much worth the time invested.
If you're looking for an OS that is equal parts secure and user-friendly, give RakuOS a try. You can download an ISO for the KDE Plasma, GNOME, or COSMIC versions, create a bootable USB drive, and install it.
If you're already running a Fedora Atomic-based distro, you can reset with: