Das-OS/README.md

Das OS

A light, friendly Void Linux–based desktop with Xfce and a Ukrainian touch, plus a console server edition

🇺🇦 Українська версія

💡 Purpose

Void Linux is fast, simple and independent: runit instead of systemd, and its own xbps package manager. Out of the box, though, it is a bare system, and getting it ready for daily use takes hours of setup. Das OS builds a live ISO that boots straight into a configured Xfce desktop and installs it with a graphical installer. It has its own look, a Ukrainian interface and keyboard layout, the usual desktop apps and Btrfs snapshots that let a broken update be undone. Everything Das OS adds comes from its own xbps packages, so the setup can be reproduced and updated like any other package. A second, console-only ISO installs a server with SSH, a firewall, fail2ban and Docker set up, on the same Btrfs layout with snapshots.

📃 Features

• Live ISO that boots on UEFI and BIOS straight into the desktop
• Graphical installer (Calamares) set up for Void and runit
• Snapshots and rollback: hourly Btrfs snapshots, bootable from the GRUB menu
• System update with a snapshot taken before it: a window, a tray icon and a terminal mode
• Welcome window at the first login: language, home folders, updates and help
• Server image: a console live ISO with a text installer, SSH, firewall, fail2ban and Docker
• Command-line helpers for everyday admin tasks: services (dsv), users (duser), firewall (dfw) and system settings (dsys)
• Das OS look: light and dark themes, generated window frames, wallpapers and logo
• Desktop defaults for Xfce that don't overwrite stock files
• Own package repository built by xbps-src from in-tree templates
• Containerised build that runs on any Linux host with Docker, and QEMU scripts for testing

⭐ Advantages

• Void underneath – a fast runit boot, the xbps package manager and fresh software, with none of the manual setup.
• Safe updates – das-update takes a snapshot before every update, the system can return to any snapshot, and personal files in /home are never part of a rollback.
• Light – no systemd, plus Xfce, LightDM and PipeWire, so it runs well on older laptops too.
• Nothing hidden – all customisations ship as ordinary xbps packages, so xbps-query -f das-settings shows exactly what changed.
• Users keep control – defaults live in /etc/xdg/das, so a user's own settings always take precedence and upgrades never reset them.
• One base for desktop and server – both images share the packages, the disk layout, snapshots and das-update, so a server is updated and rolled back the same way as a laptop.
• Builds anywhere – the build runs in a Void container, so the host can be Mint, Ubuntu or Fedora.

📱 Screenshots

Live desktop	Terminal and window frames	Boot menu (UEFI)
Light wallpaper	Dark wallpaper	Window frames: light and dark, active and inactive
Installer	Disk setup with Btrfs	Snapshots in the boot menu
Welcome window	System update	Server installer

📌 Using

Live ISO

The live system logs in to the desktop on its own, with no installation needed.

• Boots on UEFI (GRUB) and on legacy BIOS (isolinux), both with a Das OS splash screen.
• The graphics disabled entry boots with nomodeset for machines whose screen stays black, and the RAM entry copies the whole system to memory.
• User live, password live, with sudo that needs no password. The user is created at boot and exists only in the live session.
• Ukrainian interface (uk_UA.UTF-8) and the Kyiv time zone by default. Keyboard layouts are us,ua, switched with Alt+Shift.
• Includes NetworkManager, Bluetooth, PipeWire sound and Firefox with the Ukrainian language pack. Services run under runit: dbus, elogind, polkitd, NetworkManager, bluetoothd, lightdm.
• Includes guest tools for QEMU/SPICE and VirtualBox.
• The Install Das OS icon on the desktop and in the menu starts the installer.

Graphical installer

Calamares installs Das OS in a few steps: language and time zone, keyboard, disk, user.

• The interface is in Ukrainian by default, with the Kyiv time zone and Das OS branding and slides.
• The disk can be erased automatically or partitioned by hand. Btrfs is the default, ext4 and XFS are also available. On UEFI machines it creates a 512 MiB EFI partition.
• It copies the clean live image (/dev/mapper/live-base), without the live user and its boot-time settings.
• After copying, it builds locales for the chosen language, keeps only the guest tools of the hypervisor it runs in (none on real hardware), sets up snapshots, builds the initramfs and installs GRUB.
• When it finishes, it removes itself and the packages that only it needed.
• Disk encryption is not offered yet.

Snapshots and rollback

Btrfs snapshots keep the system recoverable after a bad update.

• The installer creates the subvolumes @ (root), @home, @snapshots, @var_log and @var_cache_xbps. Root snapshots don't include personal files, logs or the package cache.
• snapper makes a Fresh install snapshot right after installation and an hourly snapshot (cron). It keeps the last 5 hourly, 7 daily and 2 weekly ones.
• grub-btrfs adds every snapshot to the Das OS snapshots submenu in GRUB and updates it as snapshots appear.
• A snapshot is read-only. When it boots, the das-snapshot-overlay dracut module puts a writable overlay in RAM on top, so the full desktop works. Changes made there are lost at shutdown.
• sudo snapper-rollback <number> makes the snapshot the new root (the old one is kept as @<date>). The change takes effect after a reboot. It works both from the running system and from a booted snapshot.
• Members of wheel can list snapshots without sudo: snapper list.

System update

das-update installs updates between a pair of snapshots, so a bad update can be undone from the boot menu.

• Before updating, it creates a snapper pre snapshot, then runs xbps-install -Su (updating xbps itself first when needed), then creates the paired post snapshot, also when the update failed.
• If the pre snapshot cannot be created, nothing is installed. Without Btrfs (ext4, XFS) it updates without a snapshot and says so.
• When it finishes, it shows the snapshot number and how to roll back to it, and asks for a reboot when the kernel, glibc, runit or other core packages were updated.
• The System update window lists the packages with the installed and new versions and shows the xbps output. The privileged part runs through pkexec (polkit action ua.org.das.update).
• In the background it checks for updates 2 minutes after login and then every 6 hours, without root. The tray icon and a notification appear only when updates are available. A click opens the window, and a right click opens a menu with Check now. The check is off in the live session.
• das-update --cli does the same in a terminal (servers, ssh). It asks before installing (-y skips the question) and runs itself again through sudo. Without a display it works in the terminal even without --cli.
• The command itself is the das-update package without GTK, the window and the tray icon are /usr/libexec/das/das-update-gui from das-tools.

Welcome window

das-welcome opens at the first login and gathers the first steps in one place.

• In the live session it offers to install Das OS.
• The interface language can be chosen when the system has more than one locale built. It is stored in AccountsService and ~/.dmrc and takes effect at the next login.
• If the home folders still have English names (Documents, Downloads…), it offers to rename them to the system language, together with user-dirs.dirs and the file manager bookmarks. Folders the user moved, and those whose new name is already taken, are left alone.
• It links to the system update, Xfce settings and help.
• It opens by itself only once. The Show at login check box keeps it opening at every login.

Server image

A console-only live ISO that installs a Das OS server with SSH, a firewall and Docker ready to use.

• dasos-server-<version>-x86_64.iso boots on UEFI and BIOS with a login on the screen and on the serial console (ttyS0, 115200), so it also works through IPMI, VPS consoles and qemu -nographic. Log in as live with the password live, then run sudo das-server-install.
• The installer asks in Ukrainian or English: the disk, server name, administrator and password, an SSH key (and whether password logins stay allowed), time zone, console layout, language and network (dhcpcd or NetworkManager). das-server-install --config FILE installs without questions, see /usr/share/examples/das-server-installer/install.conf.
• It uses the same GPT and Btrfs layout as the desktop installer, so snapshots, the Das OS snapshots boot menu and snapper-rollback work the same way. GRUB is installed for UEFI (also at the fallback path) or BIOS, on the serial console too when the installer was started there.
• The administrator gets sudo through wheel and is in the docker and socklog groups. root has no password.
• The installed system runs sshd, chronyd, nftables, fail2ban, docker, socklog and the chosen network service.
• nftables lets in only SSH, ICMP and DHCPv6 (/etc/nftables.conf), more ports are opened with dfw. The rules live in their own table inet das, so reloading them keeps the Docker and fail2ban rules. Ports that containers publish pass through Docker's own rules.
• fail2ban bans addresses that keep failing SSH logins, reading the socklog log. sshd doesn't accept root password logins.
• Tools: Docker with Compose, lazydocker, lazygit, Midnight Commander, tmux, htop, Python 3, curl, das-update --cli, the helpers and xtools (xi, xq, xrs). There are no graphical libraries, and no firmware for NVIDIA graphics or sound cards (/etc/xbps.d/das-server.conf keeps updates from bringing it back).

Command-line helpers

Short commands for tasks that systemd distributions handle with systemctl, hostnamectl and the like, and that Void leaves to manual editing.

• They answer in Ukrainian or English, run themselves again through sudo when they need root and have bash completion. In a terminal they ask for whatever is missing, and with all arguments given they work in scripts.
• dsv manages runit services: list (enabled or not, state, PID, uptime), enable and disable (at boot and right now), start, stop, restart, status and logs [-f] (the service's own svlogd log or its lines in socklog).
• dsv new creates a service for your own program: the command, user, working directory and environment variables go to /etc/sv/NAME, with a log in /var/log/NAME. It then starts the service and checks that it stays up. dsv rm deletes such a service and refuses to touch services from packages.
• duser manages accounts: add with the same groups as the desktop installer (--admin adds wheel, docker and socklog), a password and an SSH key; passwd, lock and unlock (a locked account can't log in with a key either), key add|list|rm for authorized_keys, groups NAME +GROUP -GROUP and del. It won't delete or lock out the current user, and it won't delete the only administrator.
• dfw opens ports in the server firewall: dfw allow 80/tcp, dfw allow https 8000-8010/tcp, dfw deny 80/tcp. The ports are kept in /etc/nftables.d/dfw.nft and checked with nft -c before loading, and only the inet das table is reloaded. dfw status also lists the ports Docker containers publish and the addresses fail2ban has banned. SSH always stays open.
• dsys replaces hostnamectl, timedatectl and localectl: info (time sync, language, console, addresses), hostname, timezone (part of the name will do: dsys timezone Kyiv), locale (builds the glibc locale if needed) and keymap (with a Cyrillic console font for Cyrillic layouts).
• They come in the das-helpers package and are on the desktop too. Both images also include xtools-minimal from Void for package work: xi installs, xrs searches, xq shows package details and xcheckrestart finds programs to restart after an update.

Das OS look

A modern minimal style with a blue and yellow eight-petal star from Ukrainian embroidery.

• The GTK themes DasOS and DasOS-Dark build on adw-gtk3 and add the Das OS accent colours. They also style the Xfce panel, which adw-gtk3 leaves black.
• The xfwm4 window frames (rounded corners, round buttons, a red close button on hover) are generated as PNG files by xfwm4gen (Go) from a single palette.
• Light and dark wallpapers show the star over a rushnyk-style embroidered ribbon. The same star is the Das OS logo and the menu button.
• Fonts are Inter for the interface and JetBrains Mono in the terminal. Icons are Papirus and the cursor theme is Adwaita.

Desktop defaults

The das-settings package configures Xfce without touching files owned by other packages.

• /etc/profile.d/das-xdg.sh puts /etc/xdg/das before /etc/xdg, and xfconf reads the Das OS defaults from there.
• One bottom panel holds the Whisker menu, window buttons, tray, keyboard layout, volume, notifications, clock and a show-desktop button.
• At the first login, das-session-init sets the wallpaper on every connected monitor, because Xfce stores wallpapers per monitor name.
• LightDM uses the GTK greeter with the Das OS theme and wallpaper.
• Home folders get names in the session language. xdg-user-dirs 0.20 looks for its translations only in the first XDG_DATA_DIRS entry that has a locale directory, the empty /usr/local/share/locale, so it created English folders. /etc/X11/xinit/xinitrc.d/50-das-user-dirs creates them before the Xfce session with a lookup path that finds the translations.

Own package repository

Every Das OS file is installed and updated by xbps.

• srcpkgs/das-theme contains the themes, xfwm4 frames, wallpapers and logo.
• srcpkgs/das-settings contains the Xfce, LightDM and session defaults.
• srcpkgs/das-tools contains das-welcome and the update window and tray icon (Go, GTK 3 through gotk3) with their menu and autostart entries. Its subpackage das-update is the update command and polkit action, without GTK.
• srcpkgs/das-snapshots contains the snapper configuration, das-snapper-setup and the dracut module for booting snapshots.
• srcpkgs/das-installer contains the Calamares settings and branding, srcpkgs/das-server-installer the console installer. The steps both share (mount-source, postinstall) are in srcpkgs/das-install-common. They exist only on the live ISOs.
• srcpkgs/das-server is the server metapackage with the nftables, fail2ban, sshd and Docker defaults. srcpkgs/das-helpers contains dsv, duser, dfw and dsys.
• srcpkgs/calamares, srcpkgs/adw-gtk3 and srcpkgs/font-jetbrains-mono package upstream releases that Void does not have.
• make packages lays the templates over a shallow clone of void-packages and builds them with xbps-src into out/hostdir/binpkgs. The ISO build installs them from there.

Containerised build

The whole build runs in a Docker container, so only Docker and QEMU are needed on the host.

1. make packages builds the local xbps repository.
2. make iso builds the packages and then the ISO with void-mklive, using the profile in live/ (package list, services, root file system overlay). make iso-server does the same for the server profile in server/.
3. make qemu boots the newest ISO with UEFI. make qemu-bios uses legacy BIOS, and make qemu-disk also attaches a 20 GB virtual disk to install on. make qemu-server boots the server ISO with the disk on a serial console in the terminal (Ctrl-A X quits).

🚀 Building the application

Requirements: Linux with Docker (the user must be in the docker group), QEMU and OVMF for testing, and Go 1.24+ with the GTK 3 development files for make test. About 10 GB of free disk space.

make iso                 # build packages and the live ISO (the first run downloads ~2 GB)
make qemu                # boot it in QEMU with UEFI
make iso-server          # build packages and the server ISO
make qemu-server         # boot it on a serial console with a disk to install on
make test                # run Go tests
make clean               # remove build output, keep the download cache

The ISOs appear in out/iso/dasos-<version>-x86_64.iso and out/iso/dasos-server-<version>-x86_64.iso. Write them to a USB stick with dd or Ventoy.

Note: Das OS is an early version (0.5.0). The developer profile and signed repository hosting are planned for upcoming stages. Until the repository is hosted, an installed system gets updates from Void only. Das OS is based on Void Linux but is not affiliated with it.

Made by -=:dAs:=-