• 0 Posts
  • 46 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle
rss



  • It fulfills a different purpose than system packages. First, it can be run without privileges/system modification, so it works on immutable distributions. Second, it doesn’t share libraries between apps (with some exceptions) or the system, so you don’t have to package separately for each. It essentially takes some of the container philosophy/tech and brings it to desktop apps. This also gives it some ability to do some sandboxing that isn’t as easy with system installed apps.

    This approach comes with some downsides. Particularly larger storage requirement for apps, sometimes less integration with the system, and lack of ability for apps to easily call/interact each other unless they’re packaged together.

    It’s meant for complete GUI apps and not small tools/packages that are the standard in system package managers










  • By default, an enencrypted boot drive is not sufficient to be able to decrypt a LUKs drive. If you have to type in your password to start the computer/unlock LUKs then you should be good.

    If you’ve setup a keyfile or TPM based decryption of LUKS, then your data is probably not safe (though a TPM based decryption could be if the OS is secure and secure boot is setup properly)

    In this case, if you have another server then you could setup a mutual tang/clevis system where each device gets the keys it needs from the other server on the LAN. Both would be LUKs encrypted. So if one is online the other gets the required key from the online one while booting. But if both are offline then no keys are available and you have to type in a LUKS password to boot. Something like https://www.ogselfhosting.com/index.php/2023/12/25/tang-clevis-for-a-luks-encrypted-debian-server/ but what they do with multiple servers is probably overkill



  • I think if you switch back to the original target that depends on those services they should start again?

    Like systemctl isolate yourtarget.target and then a systemctl isolate graphical.target to return to normal operation

    Isolate will stop any services that aren’t required by the dependency chain.

    Some of these might be user services though, in which case you’d need to create a user target

    It’s possible that you don’t need to use isolate though, and can just start a target that conflicts and then instead of stopping it, start graphical.target