Field Notes

entity

secureblue

StatusStableReviewdue UpdatedStands on5 sourcesSupportsnotes

secureblue is a security-focused desktop and server Linux operating system shipped as OCI bootable container images built on top of Fedora Atomic Desktop via BlueBuild. It is not a distribution in the traditional sense; it layers hardening on Fedora’s base images (Silverblue, Kinoite, Sway Atomic) and relies on Fedora for packaging, repositories, and container infrastructure. The project began in 2023 and publishes daily image builds via GitHub’s container registry.

Security model

secureblue pursues proactive exploit mitigation within a single-OS model rather than VM isolation. Its hardening is layered on top of Fedora’s existing SELinux enforcement, as the project documents in secureblue features and FAQ:

  • Memory allocator: hardened_malloc (from GrapheneOS) installed globally, including for Flatpaks.
  • Browser: Trivalent, a Chromium-based browser inspired by Vanadium (GrapheneOS’s browser), with SELinux confinement.
  • Kernel hardening: sysctl settings and boot arguments aligned with the Kernel Self Protection Project.
  • User namespaces: SELinux-confined rather than globally disabled, restricting userns to Flatpaks and Trivalent without requiring suid-root binaries.
  • SUID reduction: SUID removed from numerous binaries, replaced with capabilities where needed. The system is sudoless: sudo, su, and pkexec are removed; run0 and polkit handle privilege escalation.
  • Network: DNS over TLS with local DNSSEC via Unbound, Network Time Security for chronyd, flathub-verified remote only by default.
  • USB: USBGuard installed.
  • Disk unlock: tooling for LUKS unlock by TPM2 with a PIN, or by a FIDO2 token.
  • Display: Xwayland disabled by default on GNOME, KDE, and Sway images.
  • Supply chain: SLSA attestations, Cosign-signed images, Trivy vulnerability scanning.

Atomic update model

Updates arrive as OCI container images pulled by rpm-ostree and staged as pending deployments. The /usr filesystem is read-only by default; configuration overrides live in /etc. This is not true immutability (rpm-ostree operations mutate /usr per deployment) but provides atomic, rollback-capable updates.

Desktop environments

Available for GNOME, KDE Plasma, and Sway. Desktop environment support requires an upstream Fedora Atomic image, Wayland support, the ability to run with Xwayland entirely disabled, and proper securing of privileged Wayland protocols.

Hardware and usability

Runs on any x86_64 hardware supported by Fedora. No special virtualization or IOMMU requirements. Gaming is supported via Steam (Flatpak or distrobox). Nvidia images are available with closed, open, or Nouveau drivers. Server images include ZFS support. The learning curve is moderate, comparable to any Fedora Atomic Desktop.

Relationship to other projects

secureblue is independent of Qubes OS and Kicksecure. It does not provide VM-level isolation.

No secureblue template exists for Qubes, where Kicksecure templates do. The obstacle usually cited is that Qubes’ GUI agent is X11 while secureblue disables Xwayland by default, and Qubes’ Wayland work has been open without a milestone since February 2024 and largely idle since. Trivalent is separable from the rest, though: it ships as a Fedora package from the project’s own repository and installs in a stock Fedora template, which puts secureblue’s browser inside Qubes without the system hardening that normally surrounds it. Desktop operating system security comparison sets out what that configuration does and does not buy. The project acknowledges that it lacks several virtualization features that Qubes has and that its hardening approach differs from Kicksecure’s Debian-based model. See Kicksecure vs secureblue development comparison for a detailed feature-by-feature comparison from the Kicksecure project’s perspective.

See also

Built on 5 sources (5 external).

Working out connections…