What it is
An image, not a pile of packages
The OS is the Nix store on a dm-verity /usr. An update writes the slot not in use, and a version that does not come up is given up for the one before.
Where the OS lives →Every home is encrypted
Each person is a systemd-homed account whose home is a LUKS volume. A password or a security key opens it, and a fingerprint unlocks the lock screen.
Signing in →One desktop, PC and phone
derisk is the desktop, the login screen and the setup. The same OS builds as one generic image for Treble phones, over Halium.
Halium GSI →Apps and the web
Flatpaks from Flathub through derisk's own Store, Danube as the browser, and ad blocking from filter lists for every app on the system.
Danube →
