Immutable by Design
LIBUX uses a read-only root filesystem with atomic updates and automatic rollback, eliminating entire classes of attacks and ensuring system integrity at all times.
Read-Only Root
The root filesystem is mounted read-only using dm-verity. No runtime modifications are permitted to system files.
Atomic Updates
OS updates are applied atomically using A/B partition scheme. The system is either fully updated or unchanged — never partially modified.
Automatic Rollback
If a new OS version fails health checks during boot, LIBUX automatically rolls back to the last known-good state.
Verified System State
dm-verity cryptographically verifies every block of the root filesystem at read time, detecting any unauthorized modification.
Minimal Attack Surface
Immutable infrastructure removes entire classes of attacks that rely on modifying system files, installing persistent malware, or tampering with binaries.
Snapshot Recovery
Full system snapshots enable rapid recovery from any state. Bare-metal and VM restoration from verified snapshots in minutes.
Atomic Update Process
Traditional vs Immutable
Traditional Mutable OS
- Any process can modify system files
- Malware can persist across reboots
- Updates can leave partial state
- Drift accumulates over time
- Hard to audit what changed
- Recovery requires manual intervention
LIBUX Immutable OS
- Root filesystem is read-only (dm-verity)
- No persistence for malware or tampering
- Atomic updates — all or nothing
- System state is always verified
- Complete audit trail of all changes
- Automatic rollback on failure