Desktop

  • blendOS - Immutable Linux distribution that emphasizes using containers and multiple distribution environments for applications and development workflows. It is relevant for Distrobox-like workflows and containerized development. Warning: Secure Boot support is missing or not clearly confirmed; verify current project documentation before relying on it.
  • Fedora Silverblue - Reliable, atomic, safe (rollback), containerized (Flatpak), developer friendly, private, trusted, open-source.
  • HeliumOS - Immutable Linux distribution focused on containerized desktop and development workflows. It is relevant for Podman, Distrobox, or similar container-first usage patterns. Warning: Secure Boot support is missing or not clearly confirmed; verify current project documentation before relying on it.
  • openSUSE Aeon - Immutable openSUSE desktop designed around transactional updates, Flatpak applications, and containerized development workflows. Distrobox is part of the intended workflow for development tools and CLI apps, with Secure Boot support inherited from openSUSE.
  • secureblue - Security-focused desktop and server Linux operating system shipped as OCI bootable container images generated with BlueBuild, using Fedora Atomic Desktop base images. It keeps Fedora Atomic’s container-native workflow with Podman and Distrobox while adding hardening-focused defaults, and supports Secure Boot through the Fedora boot chain.
  • Universal Blue Aurora - KDE-focused Fedora Atomic Desktop image from Universal Blue, designed as a batteries-included developer workstation. It builds on the same container-native base as Bluefin, with Podman, Distrobox, dev-container oriented workflows, Homebrew, and Secure Boot support through the Fedora/Universal Blue boot chain.
  • Universal Blue Bluefin - Developer-focused Fedora Atomic Desktop image from Universal Blue. It puts Podman, Distrobox, dev containers, and other cloud-native workflow tools close to the OS foundation, includes Homebrew, and supports Secure Boot through the Fedora/Universal Blue boot chain.

Distributions focused on containerized development environments

These desktop operating systems are notable for development workflows built around Podman, Distrobox, dev containers, or similar container-first tooling. Secure Boot support is especially relevant here because these systems often aim to combine an immutable or image-based base OS with a trusted boot chain. Check each distribution’s notes, as Secure Boot support can vary or be unconfirmed.

  • blendOS - Immutable Linux distribution that emphasizes using containers and multiple distribution environments for applications and development workflows. It is relevant for Distrobox-like workflows and containerized development. Warning: Secure Boot support is missing or not clearly confirmed; verify current project documentation before relying on it.
  • HeliumOS - Immutable Linux distribution focused on containerized desktop and development workflows. It is relevant for Podman, Distrobox, or similar container-first usage patterns. Warning: Secure Boot support is missing or not clearly confirmed; verify current project documentation before relying on it.
  • openSUSE Aeon - Immutable openSUSE desktop designed around transactional updates, Flatpak applications, and containerized development workflows. Distrobox is part of the intended workflow for development tools and CLI apps, with Secure Boot support inherited from openSUSE.
  • secureblue - Security-focused desktop and server Linux operating system shipped as OCI bootable container images generated with BlueBuild, using Fedora Atomic Desktop base images. It keeps Fedora Atomic’s container-native workflow with Podman and Distrobox while adding hardening-focused defaults, and supports Secure Boot through the Fedora boot chain.
  • Universal Blue Aurora - KDE-focused Fedora Atomic Desktop image from Universal Blue, designed as a batteries-included developer workstation. It builds on the same container-native base as Bluefin, with Podman, Distrobox, dev-container oriented workflows, Homebrew, and Secure Boot support through the Fedora/Universal Blue boot chain.
  • Universal Blue Bluefin - Developer-focused Fedora Atomic Desktop image from Universal Blue. It puts Podman, Distrobox, dev containers, and other cloud-native workflow tools close to the OS foundation, includes Homebrew, and supports Secure Boot through the Fedora/Universal Blue boot chain.

Security by Compartmentalization

Operating systems:

Experiments:

Tools:

  • libkrun - A dynamic library providing Virtualization-based process isolation capabilities
    • muvm - run programs from your system in a microVM
  • MicroVM.nix - NixOS MicroVMs

Casual

Network devices (firmware)

NAS / self-hosting OS:

  • Sandstorm - Open source platform for self-hosting web apps.
  • TrueNAS - The Enterprise Data Platform
  • YunoHost - With YunoHost, easily manage self-hosted apps for your friends, your association, your company.

Android-like

Container host

  • Bottlerocket - Bottlerocket has three primary goals: Minimal, Safe Updates and Security Focused.
  • Fedora CoreOS - A minimal OS with automatic updates. Scalable and secure.
  • Flatcar - Minimal & Focused. Only the essential tools to run your container. No package manager, no configuration drift. Fortress-Level Security. An immutable, read-only filesystem. Effortless, Automated Updates. Atomic, hands-free updates.
  • Kairos - Transform your Linux system and preferred Kubernetes distribution into a secure bootable image for your edge devices.
  • Talos Linux - Talos Linux is designed from the ground up as a secure, immutable, and minimal operating system for Kubernetes. It removes configuration drift by treating infrastructure as code.

Server

  • secureblue - Security-focused desktop and server Linux operating system shipped as OCI bootable container images generated with BlueBuild, using Fedora Atomic Desktop base images. It keeps Fedora Atomic’s container-native workflow with Podman and Distrobox while adding hardening-focused defaults, and supports Secure Boot through the Fedora boot chain.