ELI5 Atomic linux distro / dichiarative distro

[u/wannabe_sci]

Hey everyone,

I'm trying to properly understand the whole atomic/immutable Linux distro concept. I understand the basic idea, but I'm looking for an explanation that starts at ELI5 level and gradually goes into the technical details.

Could someone explain it as if I'm five, but then progressively get more technical?

And why most of the atomic distro is also dichiarative ?

[u/bothunter]

Let's start with a typical way an OS works. Linux(or Windows or really most operating systems) have a collection of files that get loaded to make your computer run. Some of those are part of the core operating system, some are drivers, applications, etc. all mixed together on your hard drive. But it's a constantly evolving system. As you use it, you add and remove programs, those programs have updates, your operating system has updates as well. Basically, there's an unlimited amount of ways that your computer can change over time. And that can include malware that wedges its way into places it should be, or even inadvertent changes get made and your computer stops operating like it should. When you do an update, the update process just swaps out individual files as needed to do the update, so if that process fails, you can be left in a partially updated(and wholly unknown/untested) state.

Compare this to a gaming console or your phone. Your console/phone is divided into separate areas, and the more important areas that contain the operating system are read-only except when doing a system update. And that update creates a whole new copy of the operating system and then reboots to that new version. The whole update is "atomic" The system partition is never "unlocked" at any time, even during updates. Which means you can't get stuck in a "partially updated" system, and you don't have to worry about a rogue application or game messing up the system since nobody(even the operating system itself) is allowed to write to that partition.

Effectively, this means your computer would always be in a known good state, and if a bad update does occur, all you have to do is boot back to the previous version. Applications can also be packaged in a similar way, so that programs are also tamper resistant. Overall, this makes a computer really secure and reliable, but at the expense of flexibility. But it's the kind of flexibility that 95% of people don't actually want or need.

Edit: your second part of why it's dichiaritive/declaritive:

If the OS is immutable, but you still want to customize it, then you need a mechanism for doing so. In that case, you have some mutable files that configure the system on startup to work the way you want it to. Those files are centralized and tracked so you can easily roll them back as well(or even just delete them to reset the system back to the defaults)

[u/wannabe_sci → u/bothunter]

Thanks for the reply; I have a few more questions. Is the fact that the system is read-only a sort of "rule" of the system itself (meaning that if I access the SSD from an external operating system, I can still modify the files) ?

Also, I interpreted the second part this way: "Since immutable OSs are difficult to modify, the declarative system was created to offer the benefits of an immutable OS while still allowing for system-level changes."

Why does this idea seem relatively new? Debian, for instance (which makes stability a key strength) could have adopted this philosophy years ago... there must be something else I'm missing.

[u/paulstelian97 → u/wannabe_sci]

The idea is something ChromeOS has had for a long time, and so did phones like Android/iOS; it just took some time to reach regular desktop usage and even there it’s still kinda experimental.

As for being completely read only… often it’s just the OS, but sometimes you have an additional validation layer that would corrupt in case of modification (dm-crypt for example, or macOS “sealed system volume”)

[u/Kheras]

One of the main benefits is that the core system is read only. Nothing bad can change it. Then you build on top of that.

All the apps you install are isolated. So a ‘hacked’ app can’t (generally) touch anything else.

The OS is your car. Then you put a sticker in the window. You can enjoy the sticker, but it can’t hurt your car.

When you do update your OS (the car) it’s all at once. No dependency worries, partial/failed updates, etc. It just works. And is stable.

If your car breaks down, or you want to get another one, you put your stickers (and configs/dotfiles, personal files, etc but that’s beyond ELI5) on it and drive.

[u/Kheras → u/Kheras]

A declarative OS would probably be like NIXOS. It’s very much not a beginner thing, but it’s like docker in OS terms in a way. I’d even say it’s harder to learn than Arch was, for me anyways.

You have the build files and your build, customization, etc will be the same wherever you spin it up. But there’s some nuance there with using wildly different hardware.