The recording of my #AllSystemsGo 2026 talk is up: “Immutable, Fully-Confined Debian Server Images, Even on a Raspberry Pi 3”.

A minimal Debian server built with mkosi and apparmor.d: UKI, A/B updates, dm-verity, a whole-system #AppArmor policy and an immutable /etc from signed confext images. Same image on x86-64 and a Pi 3, with different attacker models.

Video: https://www.youtube.com/watch?v=5Kft4nlDKR8
Slides: https://cfp.all-systems-go.io/all-systems-go-2026/talk/KJNYQ8/

#Debian #mkosi #systemd #Linux #Security

My talk "Immutable, Fully-Confined Debian Server Images, Even on a Raspberry Pi 3" was accepted at @allsystemsgo 2026, in Berlin on 30 September.

A prototype minimal Debian server, immutable down to /etc and with every process confined by #apparmor built on #mkosi and apparmor.d, running on hardware as old as a Pi 3.

https://cfp.all-systems-go.io/all-systems-go-2026/talk/KJNYQ8/

Sometime I release stuff to the world 😄

Here is apparmor.d https://github.com/roddhjav/apparmor.d

A set of over 1500 #apparmor profiles that can be used to confine most Linux base applications and processes

Have a look at it, it is still in development but it looks promising