Stability on Your Fedora Desktop: Why Silverblue’s rpm‑ostree + Flatpak + Toolbox is the Right Choice

Concrete Problem: How to Update a Desktop Without Breaking It

Most Fedora Workstation users rely on dnf to install new tools, libraries, or drivers. A single mis‑configured package can corrupt the entire system, forcing a reinstall. On a laptop that’s always on the go, you want a way to upgrade the kernel, add a graphics driver, or install a new IDE without risking a boot failure.

The answer in Fedora Silverblue is a three‑layered design:

• Base OS is an immutable ostree image.
• System packages are layered on top with rpm‑ostree install.
• User applications run in Flatpak containers, and dev tools live in Toolbox shells.

1. rpm‑ostree: Atomic, Immutable OS Updates

Silverblue’s root filesystem is read‑only. When you install a new kernel or update the base OS, rpm‑ostree pulls a new image from the Fedora repository and swaps it in atomically. If the new image fails to boot, you can roll back to the previous deployment.

Layering works like this:

sudo rpm-ostree status
# Shows current deployment, pending updates, and any layered packages.

When you add a package:

sudo rpm-ostree install gnome-tweaks
# The package is added to the current deployment.
# It becomes active after a reboot.

Key points:

• Layered packages are stored in the next deployment; old versions stay on disk until the next update.
• Each deployment is immutable, so you never patch a running system.
• Atomicity means you can roll back with sudo rpm-ostree rollback if something goes wrong.

2. Flatpak: Isolated User Applications

Instead of installing apps directly into the host OS, Silverblue recommends Flatpak. Flatpak bundles the application and its runtime, keeping it completely separate from the base image. This isolation prevents user apps from interfering with system packages.

Typical workflow:

flatpak install flathub org.gimp.GIMP
# Installs GIMP and its runtime.
flatpak list
# Lists all installed Flatpaks.

Benefits:

• Apps can be updated independently of the OS.
• Running multiple versions of the same app is possible.
• Risk of breaking the OS is virtually nil.

Limitations:

• Flatpaks need network access to Flathub or a configured remote.
• Proprietary codecs or drivers may not be included by default.

3. Toolbox: Development Without Contamination

When you need to compile code or experiment with new libraries, you don’t want to pollute the immutable host. toolbox creates an OCI container that shares your home directory but runs its own package manager.

Example:

sudo toolbox create mydev
# Creates a container named mydev.
sudo toolbox enter mydev
# Enters the container shell.
sudo dnf install gcc make
# Installs development tools inside the container.

Because the container shares your user space, you can edit files directly from your desktop. The container is lightweight and can be destroyed with sudo toolbox delete mydev when you’re done.

Worked Example: A Full Update Cycle

1. Check current OS and deployment:

   cat /etc/fedora-release
   rpm-ostree status
   

2. Update the base image to the latest Fedora 39 release:

   sudo rpm-ostree upgrade
   # Waits for the new image to download.
   sudo reboot
   

3. Layer a new system package (e.g., gnome-tweak-tool):

   sudo rpm-ostree install gnome-tweak-tool
   sudo reboot
   

4. Install a Flatpak application (e.g., org.gnome.Calculator):

   flatpak install flathub org.gnome.Calculator
   flatpak run org.gnome.Calculator
   

5. Create a toolbox for development:

   sudo toolbox create devbox
   sudo toolbox enter devbox
   sudo dnf install git gcc
   # Work on your code.
   exit
   

After each step, you can verify:

• Base OS version with cat /etc/fedora-release.
• Layered packages with rpm-ostree status.
• Flatpak list with flatpak list.
• Active toolbox containers with toolbox list.

Trade‑Offs and Limitations

• Disk Growth: Every rpm‑ostree install adds a new layer. If you layer dozens of packages, the next deployment can become large, slowing down future updates.
• Package Compatibility: Some RPMs that modify kernel modules or low‑level services may not work on an immutable root. Test in a toolbox first.
• Flatpak Network Dependency: Without internet, you cannot install or update Flatpaks. Consider mirroring a Flathub repo locally if you work in a restricted network.
• Toolbox Isolation: While toolbox containers share user permissions, they don’t provide the full isolation of a virtual machine. Sensitive data should still be handled carefully.

Actionable Checklist for Your Fedora Desktop

1. Confirm you’re on a supported Fedora release: cat /etc/fedora-release.
2. Update the base image: sudo rpm-ostree upgrade and reboot.
3. Layer only essential system packages; keep the number low to avoid large deployments.
4. Use Flatpak for all desktop applications; add flatpak remotes if you need alternate repositories.
5. When you need development tools, spin up a toolbox: sudo toolbox create dev.
6. Periodically prune old deployments: sudo rpm-ostree cleanup -m (requires root).
7. Document your layered packages and toolbox configurations so you can reproduce the setup on a new machine.

By following this pattern, you get the best of both worlds: a rock‑solid OS that never gets corrupted by a rogue package, and the flexibility to install the tools you need in isolated environments.