secureblue

Reader supplied reviews for secureblue Average rating 10 from 2 review(s) Version: 20250626 Rating: 10 Date: 2026-03-14 Country: United States Votes: 0 I'm not a distro-hopper. I have been a dedicated user of Arch Linux for close to 20 years. It is a fantastic distro and was always rock-solid for me. But, as I started to take a more serious approach to system security, I began the task of robustly hardening my existing installation. However, I soon became frustrated by the difficulty involved, especially the application of some implementation of Mandatory Access Control (SELinux, AppArmor, etc)). While Arch does support this, it is not default (obviously) and not trivial to comprehensively implement. I was also looking for reliable application sandboxing, hardened kernel and malloc implementations, unprivileged user namespaces and SUID binaries avoided where possible, and so on. Again, Arch does support this, but generating and maintaining a working implementation is not trivial. In my search for alternatives, I stumbled across secureblue. Initially, I had reservations. I had never used an "atomic" OS before, and the use of Flatpak for applications was NOT something that I was accustomed to. As an experienced user however, I found the adjustment painless. The documentation is good, and the developer and community is very responsive and engaged. I installed the Fedora "Kinoite" spin and quickly had a functional KDE Plasma desktop. I really appreciated the fact that several "toggles" are available to enable/disable some of the security features based on your specific threat model or use case. I would highly recommend reading through the documentation and FAQ to get a sense for what to expect from the default settings before you dive in and install. There is valuable information there that will help you assess if this is the right O/S for you. I have been happily using secureblue for about 9 months now, and am quite impressed. I've got everything that I was looking for from a security standpoint (and more) in an easy-to-maintain, reliable system. It's a great project and well worth an in-depth look if you are searching for a security-focused Linux O/S. Version: 20250626 Rating: 10 Date: 2025-08-21 Votes: 43 I was looking for a GrapheneOS "alternative" for desktop and I found this project on privacyguides, it was the only non-debian project (which is a must for me) that was aimed at hardening your security. I was a Fedora KDE user, gave this project a try, without ever using rpm-ostree and with little knowledge about atomic distros. I have to say I was surprised and amazed by all the tools you can use to make your distro work just like a normal one. The distro is pretty much foolproof with rpm-ostree and with it's ujust menu that can install vpn, steam(flatpak or distrobox) and help you harden/customize your security features and much more. I was able download apps via flatpak, packages via homebrew and use distrobox when I wouldn't want a flatpak for an app (examples would be: signal, which is non-verified on flatpak and I made a debian distrobox and installed from there and it's pretty much seamless, I know it still uses electron but it's still better ig; spyder, which is non-verified on flatpak so I got it directly on a fedora box and mpv+mpv-mpris which are also unverified and they work seamless on a fedora box even with kde-connect control, which I layered on the image). Gaming for me had no performance loss, but using steam flatpak (which is not verified) was the only way I could make it work, distrobox wouldn't let me use the nvidia gpu, so installing steam on a box would result in using igpu (secureblue comes with nvidia container toolkit by default but I couldn't make it work for me, it's just nvidia shenanigans probably). Security wise, there are many features, which I won't get to, cause I'm not that technical. You lose access to sudo (you can layer sudo-rs) but you can still have an admin user with run0 and I had no issues without sudo. Secureblue comes with Trivalent, which I didn't use much yet, I'm a librewolf user and I'm not sure how "ungoogled" the browser is, as that is necessary for me, so I'll trade a little security for now, until I find out more. You can use hardened_malloc from GOS, but you have to see which apps work with it, for me librewolf and steam won't work with it so it seems that most of the apps just work with it. Overall, I enjoyed fedora atomic more than the classic, and with the "flavour" of secureblue, security wise, with no performance loss and everything working just as intended, I can say that I found MY distro :)