DEV Community

Cover image for My Opinionated Fedora Silverblue Setup
Archer Allstars
Archer Allstars

Posted on

My Opinionated Fedora Silverblue Setup

#productivity #linux

This is intended to be my personal note of what I will do after installing Fedora Silverblue.

But why does it have to be Fedora Silverblue?

Because it's so simple to use, i.e., it's so simple to debug, since the core is immutable and the update process is atomic. Moreover, as almost everything is being layered on the base system, you can start anew easily without affecting the base system in anyway, doesn't leave any residues, etc. even the config files...

Basically, it's a system that you or your mom/grandma can't break.

Table of Contents

  1. Enable Transparent Disk Compression
  2. Using a Secure DNS Resolver
  3. Enable BBR, a Better Network Congestion Control Algorithm
  4. Enable ptrace_scope = 1
  5. Changing the Default ZRAM Configuration
  6. Enable RPM Fusion for Nonfree Codecs
  7. Removing All the Apps From Fedora’s Flatpak and Disable the Repo Entirely From the App Store
  8. Removing All the Unused Apps From the Default Image (Base System)
  9. Enable the System’s Auto-Update

1. Enable Transparent Disk Compression

Sadly, this technology that's available natively with Btrfs file system that the system uses is not enabled by default.

As someone who wants to save his disk space whenever it's possible, so I enable it.

First, find out your current kernel boot parameters (to avoid duplicates):

rpm-ostree kargs
Enter fullscreen mode Exit fullscreen mode

It should return many parameters, including rootflags=subvol=root to which is our target for enabling the compression.

You can simply append your custom parameters after the ones from the default configuration that's can't be replaced or deleted for obvious reason like this:

sudo rpm-ostree kargs --append="rootflags=subvol=root,compress=zstd:1"
Enter fullscreen mode Exit fullscreen mode

Then, reboot the system for it to take effect.

I use the compression level 1 instead of the default (3), that's because it uses the least CPU time while providing a reasonable compression ratio, see more on here.

You can also add other kernel boot parameters with the same command, for example, snd-intel-dspcfg.dsp_driver=1 to use the HD Audio driver instead of the default AVS driver on some old Intel hardware, at least until this issue is sorted out.

Compress Existing Data

The above command will only compress new data. To compress existing data:

sudo btrfs filesystem defragment -r -v -f -czstd /var
Enter fullscreen mode Exit fullscreen mode

2. Using a Secure DNS Resolver

I wrote about this in detail here.

Disable systemd-resolved 

sudo systemctl disable systemd-resolved-monitor.socket && sudo systemctl disable systemd-resolved-varlink.socket
Enter fullscreen mode Exit fullscreen mode 
sudo systemctl stop systemd-resolved-monitor.socket && sudo systemctl stop systemd-resolved-varlink.socket
Enter fullscreen mode Exit fullscreen mode 
sudo systemctl disable systemd-resolved && sudo systemctl stop systemd-resolved
Enter fullscreen mode Exit fullscreen mode

Also remove the existing resolv.conf file:

sudo rm /etc/resolv.conf
Enter fullscreen mode Exit fullscreen mode

Enable DNS Option in NetworkManager

Edit the NetworkManager.conf file:

sudo nano /etc/NetworkManager/NetworkManager.conf
Enter fullscreen mode Exit fullscreen mode

In the [main] section, put in this line:

dns=dnsmasq
Enter fullscreen mode Exit fullscreen mode

Restart NetworkManager:

sudo systemctl restart NetworkManager
Enter fullscreen mode Exit fullscreen mode

Configure Your Preferred DNS Resolver in the GUI

For example, using Cloudflare (with malware filtering) as your DNS resolver:

IPv4 

1.1.1.2, 1.0.0.2
Enter fullscreen mode Exit fullscreen mode

IPv4

IPv6 

2606:4700:4700::1112, 2606:4700:4700::1002
Enter fullscreen mode Exit fullscreen mode

IPv6

3. Enable BBR, a Better Network Congestion Control Algorithm

I wrote about this in detail here.

Enable the Module

Check whether the module is already enabled:

lsmod | grep bbr
Enter fullscreen mode Exit fullscreen mode

If it doesn't return anything, you must enable tcp_bbr module first:

echo "tcp_bbr" | sudo tee /etc/modules-load.d/bbr.conf
Enter fullscreen mode Exit fullscreen mode

Then, reboot.

Change the Congestion Control Algorithm to BBR

Edit the /etc/sysctl.conf file:

sudo nano /etc/sysctl.conf
Enter fullscreen mode Exit fullscreen mode

Add these lines:

net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
Enter fullscreen mode Exit fullscreen mode

Reboot the system again. Then, check the current congestion control algorithm with:

sysctl net.ipv4.tcp_congestion_control
Enter fullscreen mode Exit fullscreen mode

4. Enable ptrace_scope = 1

This is necessary to get a complete sandboxing in Chromium-base browsers. It's enabled by default in Ubuntu, Arch, and openSUSE (from my request 😄).

I wrote about this in detail here.

Check Your Current ptrace_scope Value 

cat /proc/sys/kernel/yama/ptrace_scope
Enter fullscreen mode Exit fullscreen mode

Enable ptrace_scope = 1

If it's not enable yet (returns 0 from the above command), copying the default config file and edit it:

sudo cp /usr/lib/sysctl.d/10-default-yama-scope.conf /etc/sysctl.d/
Enter fullscreen mode Exit fullscreen mode 
sudo nano /etc/sysctl.d/10-default-yama-scope.conf
Enter fullscreen mode Exit fullscreen mode

Changing the last line from kernel.yama.ptrace_scope = 0 to kernel.yama.ptrace_scope = 1.

Then, reboot.

5. Changing the Default ZRAM Configuration

It's a good thing that Fedora enabled ZRAM by default, but I find it's too conservative, especially for a system that doesn't have a lot of RAM.

So, I make it 1.5x the amount of my physical RAM. And I also set the swap-priority = 100, as ZRAM doesn't use [slowish]disk as a swap medium; therefore, I want to swap (compress the data on RAM) ASAP, so it won't use a ton of CPU time all at once when the system already has very little resource left to do anything, if at all.

Creating a New Configuration File

Fedora uses zram-generator to manage its ZRAM configuration. First, we'll create a directory for a new rule that will override the default configuration:

sudo mkdir -p /etc/systemd/zram-generator.conf.d
Enter fullscreen mode Exit fullscreen mode

Then, create a config file:

sudo nano /etc/systemd/zram-generator.conf.d/zram-generator.conf
Enter fullscreen mode Exit fullscreen mode

Inside the file:

[zram0]
zram-size = ram * 1.5
compression-algorithm = zstd
swap-priority = 100
Enter fullscreen mode Exit fullscreen mode

Adding Some Secret Sauce

Thanks to the optimization effort to improve system responsiveness under memory pressure, particularly for desktops with compressed swap in RAM by Pop!_OS, I use this secret sauce with all my Linux systems too!

Editing /etc/sysctl.conf File 

sudo nano /etc/sysctl.conf
Enter fullscreen mode Exit fullscreen mode

Adding these lines:

vm.page-cluster=0
vm.swappiness=180
vm.watermark_boost_factor=0
vm.watermark_scale_factor=125
Enter fullscreen mode Exit fullscreen mode

Then, reboot the system.

6. Enable RPM Fusion for Nonfree Codecs

You might have heard from some strange people telling you to use Flatpak apps.

The problem is not media consumption, which can be done through Flatpak or a Distrobox container, like I wrote here in detail, but it's the ability to browse your media files in the first place. This is your file manager's responsibility, not your media player's.

And that one piece of software is not available in Flatpak format; see GNOME Files issue #318.

Therefore, in order to have most of your media files showing their thumbnails in your file manager, like they are on our phones universally, you need to add RPM Fusion into your system. There's no other way.

To install RPM Fusion on your system, please refer to the official RPM Fusion doc specifically for OSTree system here!

7. Removing All the Apps From Fedora’s Flatpak and Disable the Repo Entirely From the App Store

Fedora's Flatpak repo disabled

This can be done through GNOME Software GUI, as shown in the screenshot above. You can reinstall these apps from Flathub if necessary.

In my honest opinion, Fedora's Flatpak is useless and has no real value for end-users. It's a painful, wasteful step that Fedora users have to do after the installation. For example, see this recent drama.

It should be noted that, contrary to Flathub, Fedora's Flatpak has the same limitation regarding proprietary codecs as Fedora's native RPM packages. Therefore, remove it from your system, it has zero benefit.

8. Removing All the Unused Apps From the Default Image (Base System)

What if you want to remove some apps from the base immutable image? For example, I don't use Firefox and don't want to support its nutjobs in any way. Here's how to remove it:

sudo rpm-ostree override remove firefox firefox-langpacks
Enter fullscreen mode Exit fullscreen mode

Then, reboot the system.

Now, you can simply check your image status with:

rpm-ostree status
Enter fullscreen mode Exit fullscreen mode

This one command can help you identify most issues or feature parity with other systems that use the same image. This is why it's so easy to debug.

You can also layer any packages you want if they need to be installed on the system level. You will most likely want to install distrobox for example:

sudo rpm-ostree install distrobox
Enter fullscreen mode Exit fullscreen mode

Only install packages using this method when it's necessary.

9. Enable the System’s Auto-Update

GNOME Software

Please note that enabling the automatic software updates option in GNOME Software will NOT automatically update your system.

And unfortunately, there's no mention of the automatic update anywhere on the official docs.

Here's how to make your system automatically downloads and stages updates without you ever having to do anything:

Set AutomaticUpdatePolicy in /etc/rpm-ostreed.conf

Change the policy to stage:

sudo nano /etc/rpm-ostreed.conf
Enter fullscreen mode Exit fullscreen mode 
AutomaticUpdatePolicy=stage
Enter fullscreen mode Exit fullscreen mode

Reload rpm-ostree 

sudo rpm-ostree reload
Enter fullscreen mode Exit fullscreen mode

Enable rpm-ostreed-automatic.timer 

sudo systemctl enable rpm-ostreed-automatic.timer --now
Enter fullscreen mode Exit fullscreen mode

You can check the automatic update status with:

rpm-ostree status
Enter fullscreen mode Exit fullscreen mode

If enabled correctly, it should return something like this:

AutomaticUpdates: stage; rpm-ostreed-automatic.timer: last run 3h 4min ago
Enter fullscreen mode Exit fullscreen mode

Cover Photo by Alexandru Acea on Unsplash

Top comments (0)