Experimental systemd system extensions (sysexts) for Fedora image based systems

While this is an especially great development for the Fedora Atomic aficionados among us, I wouldn’t be surprised if we’ll be hearing a lot more from sysexts as (yet another) avenue for installing software, particularly on other atomic/immutable distros. The concept itself isn’t new - Flatcar has been utilizing this approach for some time (and has been a significant influence on this Fedora initiative).

The gist would be that it basically allows installing software natively without the traditional rpm-ostree layering method. This approach eliminates both the lengthy installation times and reboot requirements typically associated with that process. Though, it doesn’t seem to completely replace the conventional method as it comes with certain limitations (as per the developer):

They can not be used to:

  • install another kernel
  • install kernel modules
  • make changes to the initrd
  • make changes to /etc
  • add udev rules

For those wondering what is actually envisioned to be installed using this method, the software that’s already available may shed some light 😉.

In any case, note that this is FAR from its final form. The (relative) complexity currently involved in installing and updating software reflects this clearly; don’t expect shiny wrappers that will make all of us blissfully ignorant of the underlying complexity right away 😜.

  • robador51@lemmy.ml
    1·
    4 hours ago

    I saw wireguard tools, isn’t that a kernel module?

    Although this looks interesting, I have trouble understanding the pro’s and cons vs something like flatpak or containers.

    • HayadSont@discuss.onlineOP
      11·
      2 hours ago

      The following has been prepared with help from an LLM. The content is basically mine; it only helped me with wording/phrasing etc. Sometimes, my RSI-like pains come up and I can’t be bothered to do otherwise. Thank you for your understanding:

      I saw wireguard tools, isn’t that a kernel module?

      The WireGuard implementation has two parts - the kernel module (built into the Linux kernel) and the userspace tools package. This sysext only provides the userspace tools (wg and wg-quick commands), not the kernel module itself.

      Although this looks interesting, I have trouble understanding the pro’s and cons vs something like flatpak or containers.

      Sysexts fill a critical gap in the Fedora Atomic ecosystem that neither Flatpak nor containers adequately address.

      While traditional distros let you install packages natively, Fedora Atomic’s direct alternative to this (i.e. layering) comes with significant drawbacks - updates take longer, require reboots that disrupt workflow, and can sometimes block future updates entirely. This has been a persistent pain point for users.

      Flatpaks technically support CLI tools but rarely package them, and containers are impractical for things like shells (imagine running fish or zsh in a container to use on your host). Similarly, applications like Steam or certain browsers sometimes need deeper system integration than Flatpak provides - which is why projects like Bazzite and SecureBlue install them (read: Steam and Chromium-derivative respectively) natively.

      The CLI situation has been particularly frustrating, even for Universal Blue, which has driven much of Fedora Atomic’s ever-growing adoption. Their exploration of various solutions (eventually landing on Homebrew) demonstrates how challenging this problem has been.

      Sysexts offer an elegant alternative - they provide system-wide integration without breaking immutability or requiring reboots. You intuitively know when to use a sysext versus Flatpak or containers - they’re not competing but complementing each other.

      They aren’t a silver bullet (we’ll still need layering for kernel modules, etc.), but for many tools, sysexts provide the solution the immutable OS ecosystem has been waiting for.