Traditional Linux distributions update package by package: the package manager downloads new versions of individual programs and libraries and replaces files in place on your running system. It works, it is flexible, and it has a weakness: no two machines end up quite the same, and an update interrupted halfway can leave a system broken.

A growing group of systems take the opposite approach: GNOME OS, SteamOS, Fedora’s Atomic desktops, and others update the whole operating system as a single image. This guide explains how that works. For the broader idea, see our immutable distributions explainer.

The core idea

An image-based system ships the OS as a complete, versioned image, built and tested by the distribution. Updating means:

1. Download the new image (or the parts that changed)
2. Verify its signature
3. Install it beside the running system, not over it
4. Switch to it at the next boot
5. Keep the previous version to fall back to

The system partition is usually read-only while running. Your data in /home and configuration in /etc (or /var) live separately and carry over between versions.

A/B partitions

The simplest design keeps two system partitions, A and B:

	Partition A	Partition B
Before update	Running (v1)	Old or empty
During update	Running (v1)	New image written (v2)
After reboot	Kept as fallback	Running (v2)

If v2 fails to boot, the bootloader returns to A automatically. Android, ChromeOS, and SteamOS all use variations of this. The cost is disk space: two copies of the OS.

systemd-sysupdate

systemd-sysupdate is systemd’s tool for this job, and the update mechanism behind GNOME OS. It is built from small transfer definitions that say where new versions come from and where they go:

# /usr/lib/sysupdate.d/50-root.transfer
[Transfer]
Verify=yes

[Source]
Type=url-file
Path=https://example.org/os/
MatchPattern=os_@v.root.raw.xz

[Target]
Type=partition
Path=auto
MatchPattern=os_@v
MatchPartitionType=root

@v is the version placeholder. sysupdate finds newer versions at the source, verifies them, writes them to an unused partition slot, and leaves the bootloader to pick the newest working version. Commands:

systemd-sysupdate list       # available and installed versions
systemd-sysupdate update     # install the newest version
updatectl update             # the friendlier front end on recent systemd

Today GNOME OS downloads a full image of about 2GB per update; delta updates, which download only what changed, are planned.

Related pieces fit together: systemd-boot with boot counting (to detect a failed boot and fall back; see our systemd-boot vs GRUB guide), dm-verity to verify the read-only image at runtime, and systemd-sysext to layer extra files on top of the base image.

OSTree and bootc

Fedora Silverblue, Kinoite, and the other Fedora Atomic desktops use OSTree (via rpm-ostree), a different design:

• The OS is stored as a content-addressed tree of files, similar to how Git stores a repository
• An update downloads only changed files and creates a new deployment alongside the old one, using hard links to share unchanged files
• No second partition is needed; both versions live in the same filesystem
• rpm-ostree rollback returns to the previous deployment

bootc builds on this by using container images as the OS format: you describe the OS in a Containerfile, build it with standard container tools, and machines update by pulling a new image. Fedora, CentOS Stream, and RHEL image mode use it.

	A/B with sysupdate	OSTree / bootc
Storage	Two partitions	One filesystem, shared files
Download	Full image (deltas planned)	Changed files or layers
Used by	GNOME OS, many appliances	Fedora Atomic, RHEL image mode
Customising	System extensions	Package layering, custom container images

Installing software

Because the OS is read-only, you install software differently:

• Desktop apps from Flatpak, sandboxed and independent of the OS version; see Flatpak permissions
• Command-line and development tools in containers with Toolbx or Distrobox
• Package layering on OSTree systems for the few things that must be in the OS, at the cost of slower updates
• System extensions on sysupdate systems

Trade-offs

Advantages:

• Updates are atomic: you get the old system or the new one, never half of each
• Rollback is built in
• Every machine on a version is identical, which makes bugs reproducible
• A read-only, signed OS is harder to tamper with

Disadvantages:

• Less flexibility to change the OS itself
• Updates often need a reboot to take effect
• Some software, such as kernel modules or tools that expect to write to /usr, needs workarounds
• More disk space for the second copy or retained deployments

For a desktop where you mostly use apps, a browser, and maybe containers, the trade-off is increasingly attractive. For a heavily customised system, a traditional package manager is still more comfortable.

Frequently Asked Questions

What is an image-based update?

Instead of upgrading individual packages in place, the system downloads a complete, tested image of the operating system and switches to it, usually at the next boot. Every machine on the same version runs exactly the same files.

What are A/B partitions?

Two copies of the system partition. You run from one while the update is written to the other. On reboot the bootloader switches to the new copy; if it fails to boot, the system falls back to the old one. Android, ChromeOS, and SteamOS all work this way.

What is systemd-sysupdate?

A systemd component that downloads and installs new versions of OS images, partitions, or files, verifying them cryptographically. It is configured with transfer files in /usr/lib/sysupdate.d or /etc/sysupdate.d and is used by GNOME OS. updatectl is its user-facing command on recent systemd.

How is OSTree different?

OSTree, used by Fedora Silverblue and other Fedora Atomic desktops, stores the OS as a content-addressed tree of files, like Git for operating systems. Updates only download changed files and deploy a new tree alongside the old one, without needing separate partitions.

Can I install software on an image-based system?

Yes, but not usually with the package manager into the OS itself. Desktop apps come from Flatpak, command-line tools from containers such as Toolbx or Distrobox, and some systems allow layering extra packages or system extensions on top of the image.

Are image-based updates more secure?

They can be. The OS is read-only, so malware cannot quietly modify system files, and images can be signed and verified as a whole. Combined with Secure Boot and measured boot, the system can prove it is running an unmodified image.