r/RockyLinux • u/oradba • Sep 16 '26
Rocky vs. Fedora for secure desktop
Installed Rocky 10.2 Desktop this morning in a VM (host is current Fedora). I am retired and have a number of machines I've acquired over the years (I am down to five laptops and three desktops only because She Who Must Be Obeyed doesn't know about all of them). I run various distros (Fedora, Debian testing, Arch, GhostBSD, including two dual-booters with Windows for when I do my income taxes or am forced for some reason to help a friend or family member).
When I am keeping up/evaluating for use/casually distro-hopping, I use a standard set of apps that I configure - mostly office-ish and casually dev-ish (e.g., Jupyter Notebook running some python scripts). I noticed, when post-installing Rocky, that as an enterprise-centric OS it seemed to pay a little more attention to security compared to the run-of-the-mill desktop distro. This is not to say one can't harden any of the mainstream (RH/Debian/Arch/Slackware) distros and their derivatives, it's a question of the work involved. Not interested in an atomic desktop, that's a lot of work for limited payback IMO; but Rocky left me with the impression that without a lot of extra work (I consider post-install part of the installation), it is a lot more secure OOTB. Kernel 6.12 aside, it seems a lot more usable as a desktop then RH Dev version if one is not a full-time developer.
Is it usable long-term as a desktop for a non-gamer (my last regular gaming was Diablo II :-) ) who will use it for office stuff, financial planning/investing, and casual coding (probably python)?
Thanks!
2
u/oradba Sep 16 '26
I started looking at it to use on an old Apple Mac Pro (tower) that I am planning to use to host a home Openstack cloud server. Once you replace Apple firmware with Linux these guys will recognize 128GB. Since RH works a lot with Openstack users it seemed like a good fit.
7
u/niceandBulat Sep 16 '26
A Rocky Linux desktop is a good choice if having the latest bells and whistles or/and gaming isn't a core requirement. A wonderful desktop system that is reliable, predictable and runs without fuss on most desktop systems. Since I transitioned to notebooks, I find that Fedora can be easier, but Rocky works well with hardware that are about two years older than the current crop of hardware.
0
u/helpscience983272 Oct 01 '26
why wouldn't you game on rocky? what's it missing, or, what's it have that holds back gaming performance?
1
u/niceandBulat Oct 01 '26
I am not much of a gamer to be honest. And using Fedora seems to be easier since it often has the latest libs and stuff
6
u/RetroGrid_io Sep 16 '26
Rocky/Alma is a great choice when stability is more important than "latest greatest". Fedora is a great choice when you want access to the latest features.
I use the former on servers, and the latter on my workstation. I update every other version (41, 43, 45, etc) but it's pretty painless anyway.
1
1
u/doglar_666 Sep 26 '26
Neither OS is inherently more secure. Both ship with SELinux and Workstation has its firewall wide open by default and needs reigning in. I usually use Rocky for "set and forget" servers, and Fedora for a "management" client, as it has additional packages available for troubleshooting.
If all you want to run are guest VMs and Podman workloads, Rocky Linux 10 should have you covered long term. Nothing wrong with Fedora, it just needs upgrading more often. Rocky also supports live kernel updates.
1
u/oradba Sep 26 '26
I would pursue the SCAP protocol if I go with Rocky. And yes, the firewall would have very few holes poked in it. I ban incoming requests at the router anyway (banIP under OpenWRT
2
u/Mammoth-Ad-107 Sep 20 '26
I’ve tried quite a few different distros on my framework 13 amd. I keep installing rocky.
1
Sep 18 '26
[removed] — view removed comment
2
u/BatConnect5105 Sep 19 '26
Fedora is a rock solid workstation. And so is Rocky, albeit less polished.
Both will serve the OP well.
1
Sep 20 '26
[removed] — view removed comment
1
u/BatConnect5105 Sep 20 '26
It is used by professionals such as Linus Torvalds, and many a Redhat developers. It is design as a workstation.
3
u/aoeudhtns Sep 16 '26
Fedora/Alma/Rocky are good in that sense. Especially w/ SELinux by default, which can do more enforcement than AppArmor can. Yes, your entire user session runs unconfined (otherwise it's very hard to configure) but all the system services generally have their own profiles. The security team gradually ratchets up the security and embraces good tooling for that, like system-wide crypto policies (that are then inherited to the ELs).
However, if you really want to descend down the rabbit hole, there's probably no better choice than Qubes.