Overview
Comprehensive guide to the immutable Linux OS with atomic updates.
Welcome to the Shanios technical documentation. This wiki provides comprehensive information about Shanios's architecture, installation, configuration, and daily use.
Shanios is an immutable Linux desktop built on Arch Linux. The OS core is permanently read-only — nothing running on your machine can modify it, not even root. It always keeps two complete, bootable copies of the OS on disk. You run on one; updates are prepared on the other. When you're ready, reboot into the new one. If anything goes wrong, reboot back. It ships in three desktop editions today — GNOME, KDE Plasma, and COSMIC — plus a Kiosk profile for single-purpose deployments and a headless Server profile. It works out of the box with no post-install tweaking required.
At the time of writing, the current stable release is 2026.05.18: GNOME edition ~5.4 GB · KDE Plasma edition ~7.6 GB · COSMIC edition ~5.2 GB · Kiosk edition ~4.8 GB · Server edition ~3.5 GB · all SHA256 + GPG signed
Five Core Ideas
- Immutability: The root filesystem is read-only at runtime. Neither accidental commands nor malware can corrupt the OS — it always boots to a known-good state. Even a process running as root cannot modify core system files during a live session.
- Atomic updates via blue-green deployment: Two complete system images (
@blueand@green) are maintained at all times. Updates are written to the inactive image; you boot into it only when it's ready. The previous image remains as an instant rollback target. If the new copy can't boot at all, systemd-boot detects the failure and reverts automatically. - Selective persistence: Your data, configuration, Flatpak apps, containers, and service credentials all live in separate Btrfs subvolumes that survive every update and rollback untouched.
- Defence-in-depth security: Six Linux Security Modules run simultaneously (
lsm=landlock,lockdown,yama,integrity,apparmor,bpf), LUKS2 argon2id encryption, TPM2 auto-unlock, Secure Boot, Intel ME kernel modules blacklisted by default, and every OS image SHA256+GPG verified before deployment. - Zero telemetry: No usage data, crash reports, analytics, or tracking of any kind — ever.
Built in India 🇮🇳 by Shrinivas Vishnu Kumbhar. Indian-language support (Devanagari, Tamil, Telugu, and more) is a first-class feature.
New to Shanios? Visit shani.dev for a general introduction, download links, and feature overview. This wiki focuses on technical implementation and usage details.
Editions
| Edition | Size | Best For |
|---|---|---|
| GNOME | ~5.4 GB | Most users — Windows/macOS switchers, office work, students, OEM deployments |
| KDE Plasma | ~7.6 GB | Gamers and power users — full gaming stack pre-installed, virt-manager, full KDE suite |
| COSMIC | ~5.2 GB | Modern desktop — tiling, keyboard-driven, System76's Cosmic DE |
| Kiosk | ~4.8 GB | Single-purpose deployments — digital signage, kiosks, locked-down environments |
| Server | ~3.5 GB | Headless servers — minimal footprint, no desktop environment |
Quick Links
- What is Shanios? — core concepts explained
- Getting Started — download, verify, install, first boot
- Migrating from Traditional Linux — workflow mapping
- What's Included — full software stack
- System Updates — update and rollback
- Security Features — full security model
- Troubleshooting — common issues and solutions
- FAQ — frequently asked questions
Current Release
Stable: 2026.05.18 · Channels: latest, stable
All images are SHA256 checksummed and GPG-signed. Verify downloads using the signatures at downloads.shani.dev.
Project Repositories
| Repo | Purpose |
|---|---|
| shani-platform | Fleet management server (FastAPI) |
| shani-fleet | Fleet agent (heartbeat, commands) |
| shani-insights | Workforce analytics server |
| shani-deploy | Transactional deployment scripts |
| shani-builder | Build environment + package publisher |
| shani-install-media | ISO/image build pipeline |
| shani-pkgbuilds | Package build scripts |
| shani-keyring | Pacman trust root |
| shani-repo | Published package repository |
| shani-settings | Filesystem overlay |
| os-installer-config | Installer scripts |
| shani-website | Marketing site |
| shani-docs | Documentation (this site) |
| shani-wiki | Technical wiki |
| shani-blog | Engineering blog |
How to Use This Wiki
| Section | What you'll find |
|---|---|
| Introduction | What Shanios is, how it works, and getting started |
| Concepts | Architecture deep-dives: immutability, blue-green, persistence, atomic updates |
| Installation | Requirements, pre-install checklist, installation steps, first boot |
| Software & Apps | App stores (Flatpak, Nix, Snap, Homebrew), containers, gaming, VMs |
| Networking | Bluetooth, SSH, VPN, DNS, firewall, and every networking daemon |
| Security | Polkit tiers, LUKS, TPM, AppArmor, Secure Boot, audit, hardening |
| System | Audio, display, storage, backup, kernel modules, users & groups |
| Updates | How updates work, rollback, configuration management, health checks |
| Architecture | Boot process, Btrfs layout, dracut, build pipeline, fleet deployment |
| Troubleshooting | Diagnosing and fixing common issues |
See Also
- shani.dev — public-facing site with download links and feature overview
- GitHub — source code, issue tracker, releases
shani-settingsrepo — Polkit rules, system overlays, configuration