Deepin is the top Linux distribution from China, devoted to providing a beautiful, easy-to-use, safe, and reliable operating system for global users. (Global Ranking)
In the previous article, we have made a complete introduction to the birth and features of Linglong, which was shown for the first time.
In the next articles in this series, we will display more content about the Linglong package format. This article focuses on the problems of traditional package management, and how we create the "Linglong solution" based on the mainstream universal independent package formats.
Problems with traditional package management
First, the maintenance cost for different platforms is high. Since deb and rpm are two completely separate package formats, developers need to build and maintain packages separately.
Second, compatibility issues can hardly be solved. Both dpkg and rpm are strongly-dependent package management systems and allow complex cross dependencies (or circular dependencies) between components, which makes maintenance a matter of great expertise. A little carelessness will lead to a complete system failure that cannot be repaired. And system upgrades often result in broken dependencies, leading to compatibility issues.
Third, security needs to be improved. The permissions of traditional package formats are loosely controlled. Apps may damage the system through the Hook system, which cannot be effectively managed and controlled.
Fourth, they have insufficient reliability. There is no redundant recovery design and a lack of verification mechanism. Once the package management system fails, the system can hardly be repaired.
Existing solutions
To solve the above problems, there is already a solution in the Linux industry - universal independent package formats, such as Flatpak and Snap, which are dedicated to achieving the aim that applications with one format can run on all Linux distributions.
To achieve this goal, applications are isolated from the system, running in an independent operating environment instead of that provided by the operating system. In addition, universal independent package formats are also trying to enhance security. Usually, they use a "sandbox" to isolate applications from host devices, preventing viruses carried by malicious programs from infecting the entire system.
However, this solution also has some problems: to make applications independent of the operating system, dependencies are encapsulated into a separate operating environment, which inevitably leads to a larger system. And to ensure versatility, a larger operating environment is required, which occupies more disk space. This problem also exists for applications. Applications need to add unique dependencies to themself, which makes the package size larger than that of traditional package formats and degrades the performance.
In addition, its security and compatibility also need to be strengthened. For example, as new technical solutions such as user namespace are immature, "sandbox" has to be started with root privileges, which results in many security vulnerabilities.
Linglong solution
Linglong is born for better compatibility and security, dedicated to solving various compatibility problems caused by complex package formats and cross dependencies under Linux, as well as to reducing the security risks caused by decentralized control of permissions.
In terms of technical solutions, taking the excellent ideas from the mainstream universal independent package formats, Linglong manages applications, runtime, and system environments in layers, separates running dependencies of apps, and builts a universal runtime. To support deep optimization of runtime in Linux distributions, it provides a complete mechanism as well, so as to avoid too large size and bad performance.
What is more, the "sandbox" containerization mechanism is used to run applications, which isolates applications from the system to prevent system damage.
In addition, root privileges of the "sandbox" are restricted by default to prevent applications from getting root privileges and damaging the system and to avoid privilege elevation vulnerabilities from underlying.
In terms of software distribution, Linglong supports incremental online distribution by using ostree as the underlying implementation mechanism, and supports offline distribution in a bundle format as well.
In the next two articles, we will further explain the Linglong components and its permission management mechanism, so stay tuned!