Distribution and kernel changes that reach self-hosters.
nspawn 3.0.0 puts a Docker Engine API on the host at /run/nspawn/api.sock, so tools that speak Docker can manage systemd-nspawn machines, and 3.2.1 adds arm64 packages marked experimental. The socket ships off and takes two commands to enable, an optional drop-in answers on /run/docker.sock, and the project warns that any user with org.nspawn.manage is root on the host.
cp, mv and rm are the last GNU utilities to go; sq and sqv arrive in the main archive beside gpg, and the OpenSSH packages split to shed a Kerberos patch upstream never took.
M4 is the first Apple silicon where the WFI instruction loses register state, a spec violation baked in from the factory. Yureka Lilian's write-up covers the fix, now merged into mainline Linux and m1n1, that boots M4 machines with all cores.
Asahi's Sven Peter sent the initial device trees for the M4 MacBook Pro, iMac, MacBook Air and Mac mini, plus the A18 Pro MacBook Neo: enough to boot the kernel, not yet enough to use the machines.
A draft pull request proposes a new systemd component that lets session services reliably identify running apps and read their permissions over Varlink, built for the Flatpak 2.0 effort.
The DINUM's SécurixOS is an alpha NixOS build for secure workstations: ANSSI hardening, a custom kernel, FIDO2 login and disk unlock, TPM2 and centralised Secure Boot, and age or Vault for secrets. It is MIT, it is not a fork, and it is not for everyone yet.
A v14 series from IBM's Shrikanth Hegde merged into tip's sched/core this morning: when steal time says the host is contended, a guest folds its work onto a preferred subset of vCPUs — one core at a time, checked every second, never below one core — with no cross-guest communication.
The Linux-mobile project revealed its new name at its own conference after an 18-month search: Nura, an abbreviation of Nuraghe — the Sardinian granite towers that have stood for three millennia — with a new .eco home and a refined logo. Same OS, same maintainers.
A GNOME OS developer's proposal for the gap between Flatpak and the tools that refuse to be sandboxed: developer utilities shipped as signed, verity-checked disk images, mounted in a namespace and prepended to your PATH. It is a funded prototype, not a product.
A GNOME Shell extension for btrfs machines that turns snapper's snapshots into a top-bar menu: browse, compare, restore single files, roll back, and hand you the root command instead of taking it.
An early alpha for the M4 Mac mini from two developers who forked from Asahi over its LLM policy: KDE on Wayland, working GPU acceleration, and Assisted-By trailers on the kernel commits.
The HID++ support merged for 7.3 is coming back out: the receiver cannot say which device sent an event, and userspace settings fight the new defaults. The revert is queued for the 7.3 fixes branch.
PVE 9.2 for arm64 shares the codebase and release cycle with x86-64; the hands-on reports agree the platform works and the tools around it still lag.
Upcoming ISOs shift from Xorg to the maintained X11 fork, with no near-term Wayland plans. The last distro to try this lost a maintainer over it.
The upgrade notes for 262 are mostly a breaking-change list: services that neither catch nor block `ReloadSignal=` now fail to start, and TPM-sealed credentials are pinned to the SRK.
A 46-patch RFC keeps KVM guests executing on shielded physical CPUs through a host kexec, under a small privileged layer that services their exits while no host kernel and no VMM exist.
Ubuntu 26.10 gives critical desktop services a lower OOM score and disables systemd-oomd's session kill, so memory pressure takes out applications instead of the desktop session.
