differences.html

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Differences and known failures - UraniumOS</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<header><div class="in"><nav class="l"><a href="index.html">Home</a><a href="download.html">Download</a><a href="docs.html" aria-current="page">Documentation</a><a href="rod.html">Packages</a><a href="news.html">News</a><a href="about.html">About</a></nav><nav class="r"><a href="features.html">Features</a><a href="media.html">Install</a><a href="security.html">Security</a><a href="hardware.html">Hardware</a></nav></div></header>
<main class="in docs">
<aside><div class="sbhead"><a class="sbh" href="index.html">&#8962; UraniumOS</a><svg aria-hidden="true" viewBox="-50 -50 100 100"><circle r="48" fill="#f2d21b"/><circle r="6.5" fill="#1b1b19"/><path fill="#1b1b19" d="M6.50 -11.26 A13 13 0 0 0 -6.50 -11.26 L-20.00 -34.64 A40 40 0 0 1 20.00 -34.64 Z M-13.00 -0.00 A13 13 0 0 0 -6.50 11.26 L-20.00 34.64 A40 40 0 0 1 -40.00 -0.00 Z M6.50 11.26 A13 13 0 0 0 13.00 0.00 L40.00 0.00 A40 40 0 0 1 20.00 34.64 Z"/></svg><span class="ver">0.1.1</span><input type="search" placeholder="Search docs" aria-label="Search docs"></div><h4>Read first</h4><ul><li><a href="differences.html" aria-current="page">Differences and known failures</a></li></ul><h4>1 Installation</h4><ul><li><a href="download.html">1.1 Download</a></li><li><a href="media.html">1.2 Live medium</a></li><li><a href="partitioning.html">1.3 Partitioning notes</a></li><li><a href="manual-install.html">1.4 Manual install</a></li><li><a href="first-steps.html">1.5 First steps</a></li></ul><h4>2 Configuration</h4><ul><li><a href="users.html">2.1 Users and groups</a></li><li><a href="keyboard.html">2.2 Keyboard</a></li><li><a href="time.html">2.3 Date and time</a></li><li><a href="services.html">2.4 Services</a></li><li><a href="cron.html">2.5 Cron</a></li><li><a href="network.html">2.6 Network</a></li><li><a href="ssh.html">2.7 SSH</a></li><li><a href="blastdoor.html">2.8 Firewall</a></li><li><a href="desktop.html">2.9 Desktop</a></li><li><a href="firmware.html">2.10 Firmware</a></li><li><a href="boot.html">2.11 Boot</a></li><li><a href="kernel.html">2.12 Kernel</a></li><li><a href="storage.html">2.13 Storage</a></li><li><a href="security.html">2.14 Security</a></li><li><a href="geiger.html">2.15 Health report</a></li></ul><h4>3 Packages</h4><ul><li><a href="rod.html">3.1 rod</a></li><li><a href="cheatsheet.html">3.2 rod cheat sheet</a></li><li><a href="not-in-rod.html">3.3 Package not in rod</a></li><li><a href="recipes.html">3.4 Recipes</a></li><li><a href="silo.html">3.5 Containers</a></li><li><a href="hazmat.html">3.6 Sandboxes</a></li></ul><h4>4 Snapshots</h4><ul><li><a href="scram.html">4.1 scram</a></li><li><a href="backups.html">4.2 Backups</a></li></ul><h4>5 Reference</h4><ul><li><a href="system.html">5.1 System and files</a></li><li><a href="troubleshooting.html">5.2 Troubleshooting</a></li><li><a href="hardware.html">5.3 Hardware status</a></li><li><a href="faq.html">5.4 FAQ</a></li></ul><h4>6 Project</h4><ul><li><a href="developers.html">6.1 Developers</a></li><li><a href="contributing.html">6.2 Contributing</a></li><li><a href="about.html">6.3 About</a></li><li><a href="features.html">6.4 Features</a></li><li><a href="news.html">6.5 News</a></li></ul></aside><article><div class="band"><h1>Differences and known failures</h1></div>

<p>UraniumOS has been run in QEMU only.</p>

<h2>Known failures</h2>
<h3>Real hardware is untested</h3>
<p>All tests have been run in QEMU with KVM and OVMF; see <a href="hardware.html">hardware status</a>. You should boot the live ISO first, read <code>dmesg</code> and report what you find; see <a href="contributing.html">contributing</a>.</p>
<h3>Builds are not known to be reproducible</h3>
<p>No rebuild has been compared bit for bit with the published files. The signature in <code>SHA256.sig</code> shows that the files come from the holder of the key, and not that they match the source. See <a href="download.html">download</a>.</p>
<h3>BIOS machines do not install</h3>
<p>The installer checks <code>/sys/firmware/efi</code>, and the boot menu is limine on the EFI System Partition. Start the machine in UEFI mode, because legacy boot is not supported.</p>
<h3>Secure Boot is not supported</h3>
<p>Limine, the kernel and the initramfs are not signed, and the boot partition is not authenticated. Turn Secure Boot off.</p>
<h3>The package index is not on the medium</h3>
<p>Fetching the index (<code>rod +s</code>, 40 MB, 197 MB unpacked) and installing a package both require the network, and packages are downloaded from <code>cache.nixos.org</code>. Bring the network up first; see <a href="network.html">network</a>. The installer tries <code>rod +s</code> and <code>rod +i</code> for the sets and packages that you chose, and if this fails it says so and tells you to run them after the first boot. The base system installs without the network.</p>
<h3>There is no Wi-Fi or Bluetooth</h3>
<p>The kernel configuration builds the wireless stack and no wireless chip driver (<code>CONFIG_IWLWIFI</code> and the other vendor drivers are not set), and <code>CONFIG_BT</code> is not set. The kernel has no modules, and the base system contains no wireless tool. Installing <code>linux-firmware</code> does not help without a driver. Use a wired connection, or a USB Ethernet adapter that a built-in driver supports. To add a driver, change <code>recipes/linux-uranium.config</code> and rebuild the kernel recipe; see <a href="kernel.html">kernel</a>.</p>
<h3>Some graphics, SD card and network hardware has no driver</h3>
<p>Only Intel graphics, virtio-gpu, Bochs and the firmware framebuffer are built, there is no MMC support, and the list of wired network drivers is short. The lists are given in <a href="hardware.html">hardware status</a>.</p>
<h3>An empty root password</h3>
<p>The stage and the live image have an empty root password. The installer asks for one, but an answer file without <code>ROOTPASS</code> leaves it empty. It works only at the console, because <code>sshd</code> sets <code>PermitRootLogin no</code> and the firewall drops incoming connections. Set <code>ROOTPASS</code>, or run <code>passwd</code> after the first boot.</p>
<h3>Paths with spaces in the scram configuration</h3>
<p><code>/etc/scram</code> is read word by word. Exclude the parent directory, or rename the path; see <a href="scram.html">scram</a>.</p>
<h3>The installer cannot encrypt the disk</h3>
<p><code>uranium-install</code> has no option for encryption. Use the manual install with the LUKS steps in <a href="partitioning.html">partitioning</a>.</p>
<h3>Network configuration</h3>
<p>The <code>dhcp</code> service runs <code>udhcpc</code> on the first network device that has a <code>device</code> entry in <code>/sys/class/net</code>, and it configures IPv4 only. The firewall accepts DHCP replies on UDP port 68 from port 67, and ICMPv6, so router advertisements are accepted. Addressing over IPv6 has not been tested. A machine with two network devices recieves DHCP on one of them. Configure the others by hand and keep the commands in <code>/etc/rc.local</code>; see <a href="network.html">network</a>.</p>

<h2>Differences from a conventional Linux system</h2>
<h3>Packages come from nixpkgs through nix-env</h3>
<p><code>rod</code> runs <code>nix-env</code> on the profile <code>/rod/profile</code>, and the packages are stored in <code>/nix/store</code>. The index is the nixpkgs channel <code>nixos-26.05</code> unless <code>CHANNEL</code> in <code>/etc/rod.conf</code> says otherwise. Nix checks package files against the signing key of the binary cache <code>https://cache.nixos.org</code>, which is the Nix default that <code>/etc/nix/nix.conf</code> does not change. See <a href="rod.html">rod</a>.</p>
<h3>Reproducibility covers the package set only</h3>
<p><code>rod +s REVISION</code> pins the index to one nixpkgs commit, and <code>rod +o FILE</code> writes the installed names, the holds and the revision, so that <code>rod +a FILE</code> installs the same set elsewhere. Packages that are not in the cache are compiled on your machine, and the result is not reproducible bit for bit. The kernel, the initramfs and the tools are recipes and are compiled locally. To get the same package set again, pin the index and keep the file from <code>rod +o</code>.</p>
<h3>Builds run without a sandbox, as the user that started rod</h3>
<p><code>/etc/nix/nix.conf</code> sets <code>sandbox = false</code> and leaves <code>build-users-group</code> empty. A package or recipe that is built locally runs it's build with the rights of that user, normally root, and with network access. Read a recipe before you install it; see <a href="recipes.html">recipes</a> and <a href="security.html">security</a>.</p>
<h3>There is no FHS layout</h3>
<p><code>/bin</code>, <code>/sbin</code>, <code>/usr/bin</code> and <code>/usr/sbin</code> link to <code>/rod/profile/bin</code>, <code>/lib</code> links to <code>/rod/profile/lib</code>, and <code>/lib64/ld-linux-x86-64.so.2</code> links to the glibc of the profile. There is no <code>/usr/lib</code> and no <code>/etc/ld.so.cache</code>. A prebuilt binary that was linked for another system finds only the libraries of the packages that are installed, and it fails to start. Install the packages that provide the library, or run the program in a <a href="silo.html">container</a> or with <code>rod +e</code>; see <a href="not-in-rod.html">package not in rod</a>.</p>
<h3>runit and busybox init, not systemd</h3>
<p><code>/etc/inittab</code> is read by busybox init, which runs <code>/etc/rc</code> and <code>runsvdir -P /etc/service</code>. Software that needs systemd, logind or polkit does not work unchanged. There is no PAM: <code>sshd</code> has <code>UsePAM no</code>, and <code>doas</code> is built without PAM. See <a href="services.html">services</a>.</p>
<h3>doas is the only setuid program</h3>
<p>The stage copies <code>doas</code> to <code>/rod/wrappers/doas</code> with mode 4755, and <code>/etc/profile</code> puts <code>/rod/wrappers</code> first in <code>PATH</code>. <code>/etc/doas.conf</code> contains <code>permit persist :wheel</code>. Binaries in a Nix profile cannot carry the setuid bit, and there is no <code>sudo</code>. See <a href="users.html">users</a>.</p>
<h3>Frames are snapshots on the same disk</h3>
<p>A frame is a read-only btrfs snapshot of <code>@</code> and <code>@home</code> on the disk that holds the system. It does not survive a failed disk, a deleted filesystem or <code>mkfs</code>. It does not contain the boot partition, the package index, <code>/var/cache</code>, <code>/var/tmp</code>, the paths excluded in <code>/etc/scram</code> and <code>/etc/scram.d</code> (<code>~/Downloads</code>, <code>~/Documents</code> and <code>/srv</code> in <code>scram.conf.example</code>), or other filesystems. The kernel and initramfs of each frame are copied to the boot partition, at most three more than the current one. A flash does not undo changes to the excluded paths, the boot partition or the firmware. Copy data that you cannot lose to another disk; <code>scram send</code> can write a frame to a stream. See <a href="backups.html">backups</a>.</p>
<h3>A flash or a commit cannot run on the mounted subvolume</h3>
<p>Add <code>--boot</code> (<code>scram flash --boot FRAME</code>, <code>scram commit --boot</code>) so that the initramfs makes the swap before the root is mounted. Booting a frame from the menu is the other way back.</p>
<h3>An update on trial takes at least five minutes to be confirmed</h3>
<p><code>scram verify</code>, which the <code>trial</code> service starts, waits 300 seconds and then runs <code>geiger</code> up to three times, 30 seconds apart. If every run fails, the system reboots and the initramfs flashes <code>@</code> back to the <code>pre-commit</code> frame. A further boot without <code>scram confirm</code> also reverts. <code>geiger</code> fails only if a service is not running, if a machine with a network device has no IPv4 address, if the root filesystem is at 95% or if the boot partition is at 92%. An update that breaks anything else is confirmed. After you have checked the system, run <code>scram confirm</code>, or run <code>scram flash --boot pre-commit</code> to go back; see <a href="scram.html">scram</a> and <a href="geiger.html">geiger</a>.</p>
<h3>Reinstalling a recipe package</h3>
<p><code>rod +i NAME</code> on a recipe in <code>/rod/recipes</code> builds from the file. The kernel, the initramfs, <code>uranium-tools</code>, <code>doas-uranium</code>, <code>avtty</code> and <code>zen</code> are recipes and are not taken from the index. <code>rod +r NAME +i NAME</code> rebuilds one of them.</p>
<h3>The kernel has no modules</h3>
<p><code>CONFIG_MODULES</code> is not set. <code>modprobe</code> and <code>insmod</code> have nothing to load, and out-of-tree drivers (DKMS, NVIDIA) cannot be added. See <a href="kernel.html">kernel</a>.</p>
<h3>Swap is zram only</h3>
<p><code>/etc/rc</code> creates a zram device of half the memory and enables it with priority 100. The kernel has no hibernation. To use a swap partition, call <code>swapon</code> from <code>/etc/rc.local</code>.</p>
<h3>User namespaces are enabled</h3>
<p><code>silo</code> and <code>hazmat</code> use bubblewrap, which requires unprivileged user namespaces. The kernel has <code>CONFIG_USER_NS=y</code>, and no sysctl restricts them. The sandboxes use the kernel of the host and the same user id, and the network is shared unless you ask for none (<code>-n</code>). See <a href="security.html">security</a>.</p>
<h3>Services that write to /var/log</h3>
<p>Services that have a <code>log/run</code> script send their output to <code>svlogd</code>, which writes <code>/var/log/NAME/current</code>. Nothing rotates the <code>sshd</code>, <code>dhcp</code>, <code>ntpd</code>, <code>crond</code> and <code>autoframe</code> logs except the size limit of svlogd. There is no <code>syslogd</code>, <code>journalctl</code> or <code>/var/log/messages</code>. Read the <code>current</code> files, and use <code>dmesg</code> for the kernel.</p>
<div class="pager"><span></span><a href="download.html">Download &rarr;</a></div></article>
</main>
<footer><div class="in"><p>Public domain, CC0 1.0</p><p><a href="https://github.com/uranium-os">GitHub</a> &nbsp; <a href="https://texivi.github.io">Blog</a></p></div></footer>
<script>document.querySelectorAll("pre:not(.term):not(.portrait)").forEach(function(p){var b=document.createElement("button");b.textContent="\u29c9";b.title="Copy";b.onclick=function(){navigator.clipboard.writeText(p.innerText.replace(/\u29c9$/,"").trim());b.textContent="\u2713";setTimeout(function(){b.textContent="\u29c9"},900)};p.appendChild(b)});</script>
<script src="docs.js"></script>
<script src="fun.js"></script>
</body>
</html>