Differences and known failures

UraniumOS has been run in QEMU only.

Known failures

Real hardware is untested

All tests have been run in QEMU with KVM and OVMF; see hardware status. You should boot the live ISO first, read dmesg and report what you find; see contributing.

BIOS machines do not install

The installer checks /sys/firmware/efi, and the boot menu is limine on the EFI System Partition. You must start the machine in UEFI mode, because legacy boot is not supported.

Secure Boot is not supported

Limine, the kernel and the initramfs are not signed, and the boot partition is not authenticated. You must turn Secure Boot off.

The package index is not on the medium

Fetching the index (rod +s, 40 MB, 197 MB unpacked) and installing a package both require the network, and packages are downloaded from cache.nixos.org. You must bring the network up first; see network. The installer tries rod +s and rod +i for the sets and packages that you chose, and if this fails it prints packages were not installed, run rod +s and rod +i after the first boot. The base system installs without the network.

There is no Wi-Fi or Bluetooth

The kernel configuration builds the wireless stack and no wireless chip driver (CONFIG_IWLWIFI and the other vendor drivers are not set), and CONFIG_BT is not set. The kernel has no modules, and the base system contains no wireless tool. Installing linux-firmware does not help without a driver. You must use a wired connection, or a USB Ethernet adapter that a built-in driver supports. To add a driver, you must change recipes/linux-uranium.config and rebuild the kernel recipe; see kernel.

Some graphics, SD card and network hardware has no driver

Only Intel graphics, virtio-gpu, Bochs and the firmware framebuffer are built, there is no MMC support, and the list of wired network drivers is short. The lists are given in hardware status. The same remedy applies as for wireless hardware.

An empty root password

The stage ships /etc/shadow with an empty root password, and the live image is the same system. The interactive installer asks for a root password and refuses to install without one. An installation from an answer file without ROOTPASS leaves the root password empty, and the console login accepts it. The manual install sets the password with chpasswd. You should always set ROOTPASS, or run passwd as root after the first boot. The firewall drops incoming connections and sshd sets PermitRootLogin no, so an empty password can be used only at the console.

Paths with spaces in the scram configuration

/etc/scram is read word by word. You must exclude the parent directory, or rename the path; see scram.

The installer cannot encrypt the disk

uranium-install has no option for encryption. You must use the manual install with the LUKS steps in partitioning.

Network configuration

The dhcp service runs udhcpc on the first network device that has a device entry in /sys/class/net, and it configures IPv4 only. The firewall accepts DHCP replies on UDP port 68 from port 67, and ICMPv6, so router advertisements are accepted. Addressing over IPv6 has not been tested. A machine with two network devices recieves DHCP on one of them. You must configure the others by hand and keep the commands in /etc/rc.local; see network.

Differences from a conventional Linux system

Packages come from nixpkgs through nix-env

rod runs nix-env on the profile /rod/profile, and the packages are stored in /nix/store. The index is the nixpkgs channel nixos-26.05 unless CHANNEL in /etc/rod.conf says otherwise. Nix checks package files against the signing key of the binary cache https://cache.nixos.org, which is the Nix default that /etc/nix/nix.conf does not change. The system is changed with commands and not with a configuration file. See rod.

Reproducibility covers the package set only

rod +s REVISION pins the index to one nixpkgs commit, and rod +o FILE writes the installed names, the holds and the revision, so that rod +a FILE installs the same set elsewhere. Packages that are not in the cache are compiled on your machine, and the result is not reproducible bit for bit. The kernel, the initramfs and the tools are recipes and are compiled locally. To obtain the same package set again, you should pin the index and keep the file from rod +o.

Builds run without a sandbox, as the user that started rod

/etc/nix/nix.conf sets sandbox = false and leaves build-users-group empty. A package or recipe that is built locally runs it's build with the rights of that user, normally root, and with network access. You should read a recipe before you install it; see recipes and security.

There is no FHS layout

/bin, /sbin, /usr/bin and /usr/sbin link to /rod/profile/bin, /lib links to /rod/profile/lib, and /lib64/ld-linux-x86-64.so.2 links to the glibc of the profile. There is no /usr/lib and no /etc/ld.so.cache. A prebuilt binary that was linked for another system finds only the libraries of the packages that are installed, and it stops with the loader message error while loading shared libraries. You must install the packages that provide the library, or run the program in a container or with rod +e; see package not in rod.

runit and busybox init, not systemd

/etc/inittab is read by busybox init, which runs /etc/rc and runsvdir -P /etc/service. Software that needs systemd, logind or polkit does not work unchanged. There is no PAM: sshd has UsePAM no, and doas is built without PAM. See services.

doas is the only setuid program

The stage copies doas to /rod/wrappers/doas with mode 4755, and /etc/profile puts /rod/wrappers first in PATH. /etc/doas.conf contains permit persist :wheel. Binaries in a Nix profile cannot carry the setuid bit, and there is no sudo. See users.

Frames are snapshots on the same disk

A "frame" is a read-only btrfs snapshot of @ and @home on the disk that holds the system. It does not survive a failed disk, a deleted filesystem or mkfs. It does not contain the boot partition, the package index, /var/cache, /var/tmp, the paths excluded in /etc/scram and /etc/scram.d (~/Downloads, ~/Documents and /srv in scram.conf.example), or other filesystems. The kernel and initramfs of each frame are copied to the boot partition, at most three more than the current one. A flash does not undo changes to the excluded paths, the boot partition or the firmware. You must copy data that you cannot lose to another disk; scram send can write a frame to a stream. See backups.

A flash or a commit cannot run on the mounted subvolume

You must add --boot (scram flash --boot FRAME, scram commit --boot), so that the initramfs makes the swap before the root is mounted. Booting a frame from the menu is the other way back.

An update on trial takes at least five minutes to be confirmed

scram verify, which the trial service starts, waits 300 seconds and then runs geiger up to three times, 30 seconds apart. If every run fails, the system reboots and the initramfs flashes @ back to the pre-commit frame. A further boot without scram confirm also reverts. geiger fails only if a service is not running, if a machine with a network device has no IPv4 address, if the root filesystem is at 95% or if the boot partition is at 92%. An update that breaks anything else is confirmed. After you have checked the system, you must run scram confirm, or scram flash --boot pre-commit to go back; see scram and geiger.

Reinstalling a recipe package

rod +i NAME on a recipe in /rod/recipes builds from the file. The kernel, the initramfs, uranium-tools, doas-uranium, avtty and zen are recipes and are not taken from the index. rod +r NAME +i NAME rebuilds one of them. The kernel build compiles Linux and takes a long time.

The kernel has no modules

CONFIG_MODULES is not set. modprobe and insmod have nothing to load, and out-of-tree drivers (DKMS, NVIDIA) cannot be added. See kernel.

Swap is zram only

/etc/rc creates a zram device of half the memory and enables it with priority 100. The kernel has no hibernation. To use a swap partition, you must call swapon from /etc/rc.local.

User namespaces are enabled

silo and hazmat use bubblewrap, which requires unprivileged user namespaces. The kernel has CONFIG_USER_NS=y, and no sysctl restricts them. User namespaces give an unprivileged user access to more kernel code, and several kernel vulnerabilities have used them. The sandboxes use the kernel of the host and the same user id, and the network is shared unless you ask for none (-n), so they are not virtual machines. See security.

Services that write to /var/log

Services that have a log/run script send their output to svlogd, which writes /var/log/NAME/current. Nothing rotates the sshd, dhcp, ntpd, crond and autoframe logs except the size limit of svlogd. There is no syslogd, journalctl or /var/log/messages. You should read the current files, and use dmesg for the kernel.