snosi builds Debian Trixie bootc OCI images and /usr-only system
extensions (sysexts) with mkosi, for
people who want a desktop or server that installs and updates as one image.
Status: pre-release. Snow, Floe and Sundog pass VM fresh installs; Snowfield is untested on Surface hardware.
Documentation: frostyard.org/docs
| Image | Purpose | Base |
|---|---|---|
Snow (snow) |
GNOME workstation | Debian Trixie, newer Debian kernel |
Snowfield (snowfield) |
GNOME workstation for Surface devices | Debian Trixie, linux-surface kernel |
Floe (floe) |
Headless Podman server | Debian Trixie, newer Debian kernel |
Sundog (sundog) |
KDE Plasma Wayland workstation | Debian Trixie, newer Debian kernel |
shared/kernel/ selects each kernel and says which suite it comes from.
The sysexts add optional software to any image; the
sysext design lists them.
Download the Firn installer, check it, and follow the installation guide:
The native segment in the URL is a publication namespace, not an install
choice. Firn offers the four bootc choices above. Native A/B and nbc hosts
get no new images: reinstall with Firn as the
migration guide says.
Repository cleanup deletes no published artifacts; any disposal needs the
exact-object gate of ADR-0018.
The root mkosi.conf builds the base image and the sysexts; each product
profile in mkosi.profiles/ adds its payload, kernel and the secure bootc
fragment. /usr is immutable, /etc is managed by the deployment and
/var persists. On an installed host, bootc-update-stage.timer pulls the
next signed image and stages it for the next reboot, and
updex-update.timer stages sysext updates for the next boot. The
overview has the details.
- Snowfield ships untested on representative Surface hardware: its catalog gate is waived, not passed.
- Fixture tests do not establish production Secure Boot support or signed update and rollback evidence; see secure bootc operations.
mise install # the pinned tools (Node for the make gate)
make ci # what ci.yml runs
just # list the build recipes (mkosi is bootstrapped at its pin)Image builds and VM tests need root and privileged tools: see the build pipeline and testing.
- AGENTS.md: the rules for agents and contributors.
- CONTRIBUTING.md: how to contribute.
- docs/README.md: the decisions, designs, specs and plans.
- SECURITY.md: report a vulnerability privately.
- LICENSE: MIT.