qdistro

Single-tenant · isolation-first Linux · in development

qdistro

A single-tenant Linux workstation that separates work, personal, and throwaway contexts on one seamless desktop, with a userspace that is readable and modifiable at the source level.

openSUSE Tumbleweed · libweston + Wayland · Python/Qt/QML · GPL-3.0

What qdistro is trying to be

The design shorthand is one owner, many silos, dynamic sessions. One human is the sole tenant and policy authority. Silos isolate data and program state — work, personal, dev, client projects, browser profiles. Sessions attach silos and resources while a task is happening, then release them.

  1. Goal 1
    Tiered isolation, chosen per app

    An isolation ladder from a confined SELinux context, through rootless podman containers and separate uids, up to KVM virtual machines. Isolation strength is chosen per app, within admin policy.

  2. Goal 2
    Seamless windows across every boundary

    Containers and VMs do not present as a separate desktop session. Each silo runs a nested Wayland compositor; its windows arrive over waypipe and land on one desktop, tagged and placed by the admin compositor, with silo identity carried by trusted chrome. Lower tiers ship today; VM windows are experimental.

  3. Goal 3
    Explicit, audited crossings

    Clipboard, file transfer, window handoff, device access, and privilege escalation between silos all route through the admin broker. qsu replaces sudo with single-command, zero-cache approval and a full audit trail.

  4. Goal 4
    A userspace modifiable by humans or LLMs

    The shell, apps, session manager, and policy are plain Python + Qt + QML — no compile step, no opaque binaries. Infrastructure stays commodity C (libweston, PipeWire, systemd, qemu), used as-is, not rewritten.

  5. Goal 5
    An overlay on stock Tumbleweed, not a fork

    qdistro bootstraps on top of a standard openSUSE Tumbleweed install via one idempotent script. Normal package updates and btrfs/Snapper rollback continue to work; everything qdistro adds is an inspectable script or repo.

The full picture: overview · architecture · threat model · honest feature status.

Trying it today: run it in a VM, test it through CI

qdistro is in active development and changes fast. The supported way to try it is inside a libvirt / virt-manager VM — the full-stack test suites run in disposable libvirt VMs. Nested virtualization must be enabled on the host (the VM-based isolation tiers run VMs inside the VM); note that nested virtualization enlarges the hypervisor attack surface and can be a security risk for the host, so use a development machine, not a host whose isolation you rely on. Bare-metal installs follow the same steps but are currently untested. This is a development preview, not a verified release channel — inputs aren't signed or pinned yet. 

# inside a fresh Tumbleweed Minimal/Server VM, as user "admin":
git clone https://codeberg.org/qdistro/qdistro.git
git clone https://codeberg.org/qdistro/qdwin.git
git clone https://codeberg.org/qdistro/qdshell.git
cd qdistro && sudo bash scripts/install/qdistro-bootstrap.sh

To see qdistro working, run the CI GUI tests in a foreground terminal. The GUI gate boots disposable VMs, drives the real compositor, shell, locker, and permission flows, and writes a report with screenshots. Testing this project is agent-driven: the GUI scenarios are markdown playbooks executed by a coding-agent CLI, configured via QCI_AGENT_CMD; without one they are recorded as blocked. 

ci/bin/qci preflight                          # check libvirt + host tools
QCI_AGENT_CMD='your-agent-cli {prompt}' ci/bin/qci gui   # run in foreground

Gate reference, agent-command templating, and triage workflow: ci/README.md. Found something broken? File an issue.

Where things live

qdistro is a set of small, focused repos rather than one monolith. Architecture and component contracts live in the umbrella repo's doc/ directory — the source of truth this site deliberately does not duplicate.

  • qdistroUmbrella — docs, broker, daemons, SDK, admin app, SELinux policy, CI, tests
  • qdwinThe Wayland compositor — a libweston shell plugin (mechanism, no policy)
  • qdshellThe desktop shell — panels, tray, admin overlays (Noctalia QML fork)
  • qdgreeterThe greetd login screen
  • qdlockerScreen locker with fingerprint unlock
  • qdbrowserIdentity-pinned browser integration + extensions
  • qterminatorQt terminal (a port of Terminator)
  • qnotebookPyQt6 markdown wiki editor
  • qfilemanFile manager with cross-silo send-to

From the blog