Hermetic by Default: Why I Split My Fedora Atomic Workspace into Two Containers

Thu, 12 Nov 2026 00:00:00 +0000

Why I switched to Fedora Atomic #

I recently moved my main machine to Fedora Atomic (Silverblue). The main reason? As hermetic a work environment as possible. Long before the switch I already ran applications and commands in containers whenever I could — the Google Photos Takeout migration is a good example, where I ran a random GitHub script inside a Docker container and nobody knows why…

On an immutable host this stops being a nice habit and becomes the natural way of working. You can’t just dnf install whatever you want into the system — well, you can with rpm-ostree layering, but every layered package is a small crack in the immutability. Containers, on the other hand, are the intended unit of change here.

Security on devintrap.

Hermetic by Default: Why I Split My Fedora Atomic Workspace into Two Containers

Why I switched to Fedora Atomic #