Introducing Margine OS - a creator-focused Bluefin DX downstream (signed CachyOS kernel, tiling, scheduler GUI)

General
1

Introducing Margine OS

Hi everyone. After months of work (I wanted something genuinely stable before sharing it), I’m announcing Margine OS, an atomic Linux distribution. Yes, another one; but I think it earns its place, and I’d like to explain why.

Why Margine

It grew out of a long hunt for “the right distro,” and three projects that struck me as genuinely fresh:

  • CachyOS: how much more responsiveness you can get out of the same hardware. Real new life for older machines.
  • Fedora Atomic (the Silverblue / bootc lineage): shipping the OS itself as a built-and-tested image gives you a level of stability and reproducibility that’s hard to get any other way, without the Debian-style trade-off where “stable” means fighting your own hardware.
  • Bluefin / Universal Blue: If you are here, in this forum, you already know (and a big thanks to uBlue for all your hard work!); the hard part of Linux is usually after install: codecs, that folder of FLACs that won’t play, updates that need a terminal. Bluefin hands you a machine that works from minute one, updates quietly under the hood, and can roll back if something breaks.

What Margine is

Margine builds on Bluefin DX (same atomic model, same “ready out of the box” feel) and changes the things I cared about most:

The Margine desktop

  • CachyOS kernel (BORE scheduler). Pulled from the bieszczaders/kernel-cachyos COPR and re-signed with Margine’s own key so it boots cleanly under Secure Boot.
  • Secure Boot without the pain. The ISO’s GRUB walks you through MOK enrollment, so you keep Secure Boot on instead of disabling it.
  • CPU scheduler from a GUI. Switch between the scx schedulers on the fly, no config files.
  • Touchpad tuning GNOME doesn’t offer. Scroll speed, pinch-zoom and pinch-rotate, via Wayland Scroll Factor with a GUI.
  • Tiling out of the box. A curated, months-vetted set of GNOME extensions. The standout is o-tiling, a heavily-improved, actively-maintained fork of System76’s Pop Shell (which System76 itself is winding down as it moves to COSMIC), with binary-tree tiling, an animated accent-colour focus border and plenty more on top.
  • Gaming when you want it. ujust margine-gaming-native layers Steam, Lutris and RetroArch as native RPMs (full Proton/Wine, MangoHud/GameMode out of the box, Mesa always matching the system); a sandboxed Flatpak variant exists too. Bazzite-style, on the CachyOS base.
  • Reproducible and signed end-to-end. The whole build + test pipeline runs on GitHub Actions; SHA-pinned dependencies, cosign signature + SBOM, ISOs distributed torrent-first via the Internet Archive.
  • Plus a clean three-folder home (data / dev / scratch), full-disk LUKS with optional TPM2 auto-unlock, and an experimental NVIDIA kernel I can’t test myself.

Performance: what we actually measured

The one structural change worth benchmarking is the kernel, so I ran a clean A/B on the same laptop (Framework Laptop 13, Ryzen 5 7640U): switching only the ostree deployment between Margine and stock Bluefin DX. Same userspace, governor pinned to performance, start temperatures matched, median of four runs, all under a background CPU load.

CachyOS/BORE vs stock Fedora kernel, scheduler benchmark (median of runs)
CachyOS/BORE vs stock Fedora kernel, scheduler benchmark (median of runs)1100×520 6.55 KB

CachyOS/BORE vs stock Fedora kernel, scheduler benchmark (median of runs)

Metric Margine (CachyOS/BORE) Stock Fedora Δ
Context-switch latency 4.45 µs/op 7.97 µs/op ~1.8× faster
Context-switch rate 224k ops/s 125k ops/s +79%
Thread throughput 88k events 57k events +54%
Thread latency (avg) 4.1 ms 6.3 ms 55% lower
Wakeup latency (p50) 2.08 ms 2.98 ms 43% lower
Wakeup latency (p99, tail) 12.0 ms 10.7 ms ~11% higher

Honestly, it’s not “wins everything”: CachyOS/BORE is dramatically better in the common case (throughput, median/average latency) and slightly worse at the worst-case tail. That’s the textbook BORE trade-off, and a sign the test wasn’t cherry-picked. Full method, raw data and a reproduce-it-yourself script are in the kernel-performance docs (follow the site link below).

The apps: built for creators

Margine started as a personal distro, and creative work is what I mainly use it for, which is why it’s so opinionated. It ships a hand-picked Flatpak set:

  • Image & design: GIMP, Inkscape, Pinta, Darktable, Loupe
  • Audio: Audacity, Reaper, EasyEffects (system-wide DSP), G4Music
  • Video & streaming: OBS Studio, Showtime
  • Writing & office: LibreOffice, Apostrophe (Markdown), GNOME Text Editor
  • Everyday & utilities: Zen Browser, Thunderbird, Bitwarden, the GNOME suite, plus Flatseal, Warehouse, Mission Center and Déjà Dup

It’s atomic: uninstall what you don’t use. Longer term I may slim the base down and spin the creator set off into its own optional layer.

Links, and a small ask

It’s a personal project, one maintainer, still young. Feedback and criticism are very welcome. And if you have NVIDIA hardware: there’s an experimental NVIDIA kernel I genuinely can’t test (no NVIDIA machine here), so a hand testing it would mean a lot.

2

Hi, I have a tuxedo laptop lying somewhere on which I’d like to try this distro! I remember that there are tuxedo drivers to be installed, do you think that’s possible on this atomic distro? Thanks!

3

Hi! The main catch on Margine is Secure Boot: it ships a custom signed kernel, so the out-of-tree TUXEDO modules won’t load with it on. Disable Secure Boot, then layer the tuxedo-drivers akmod with rpm-ostree (it has to build against the CachyOS kernel). I don’t have TUXEDO hardware to test it on, so no promises on the akmod build, let me know how it goes and I’ll help if it gets stuck. :slightly_smiling_face:

4

Hi there,

I gave it a try and I was able to make it boot only on my Tuxedo AMD laptop. None of my AMD desktops booted the LiveISO.

Both got stuck on black screen after the peripherals got initialized. I still plan to test the rebase process, but that will be something for this weekend.

Please let me know if you need me to test something further on my AMD desktops for the LiveISO part.

5

Thanks a lot for testing, this is exactly the kind of report I need! Good to know that the TUXEDO AMD laptop boots.

The black screen right after peripheral init on the desktops looks like an amdgpu / KMS modesetting issue on those specific GPUs. A few things that would really help me pin it down:

  1. Which AMD GPU is in each desktop that fails? APU or a discrete card? That single detail is the most useful.
  2. At the GRUB menu press e to edit the entry, find the line starting with linux, and:
    • remove quiet and rhgb so you can see where it actually stops, then boot (Ctrl+X). A photo of the last lines on screen would be gold.
    • if it still goes black, try again with nomodeset added to that line. If it boots with nomodeset, it confirms a KMS/amdgpu problem.
    • as a separate test, try amdgpu.dc=0 instead. That fixes black screens on some AMD cards.
  3. At the black screen, try Ctrl+Alt+F3. If you get a text login, the GPU is fine and it is the graphical session failing; if it stays black, it is the driver/KMS. If you reach a console (or can SSH in), journalctl -b -p err and dmesg | grep -i amdgpu would tell me a lot.

if you have time for checking it, I would really appreciate it! Thanks again for the time spent on this

6

Hi,

The Tuxedo laptop is Pulse Gen3, Ryzen 7 7840 with AMD Radeon 780M GPU.

Both desktops are Ryzen 7 8745 with AMD Radeon 780M GPU.

None of the GRUB modifications made a difference, as every time I get stuck with the following error right after I press CTRL+X

8745
87453937×367 202 KB

Hope this helps.

7

Super helpful, thank you. Big clue: your laptop and both desktops all have the same GPU (Radeon 780M), so this is not a GPU compatibility thing. The difference is the platform, those Ryzen 8000 desktop boards and their firmware.

The ACPI BIOS error in your photo (_SB.PCI0.GPP5.RTL8._SOW, AE_ALREADY_EXISTS) is a buggy-BIOS warning about the Realtek NIC. On its own it is harmless, tons of machines log it and boot fine, so it is just the last visible line rather than the actual hang.

Two things would pin this down:

  1. Most useful test: does a stock Bluefin (or plain Fedora) live ISO boot on those same desktops? Margine’s only real difference is that it runs the CachyOS kernel instead of the Fedora one. If stock Bluefin/Fedora boots and Margine does not, it is the CachyOS kernel and I will dig into it. If even stock Fedora black-screens, it is the board/BIOS (likely a BIOS update) and not Margine-specific.
  2. Is it hung or just dark? At the black screen, does Caps Lock toggle the keyboard LED, and can you SSH into the box from another machine? If either works, the system is up and only the display failed; if it is fully frozen, it is a real early hang.

If you have a minute, also try one boot with amd_iommu=off added to the GRUB line. That sometimes gets these newer AMD desktop platforms past an early stall.

No rush. The Bluefin/Fedora comparison in particular tells us whether this is mine to fix or a firmware issue on those boards.

8

Hi,

downloaded the latest Bluefin live ISO and successfully booted it. When I try Margine live ISO and get the error message, keyboard do not seem to work, e.g., cannot switch to other consoles. My keyboard do not have CAPS / NUM lock led indicators so to me it seems the system is hanging

Gave it a good 10 min staying on that screen and tried to connect from the other one but alas, no dice, no ping either. The amd_iommu=off also did not made any difference.

8745
87451685×1278 107 KB

Tried to rebase and initially it looked good - I was able to see the login screen. I tried to login and the system froze. The second time I got the same behavior. Third time the system went back to the console with few disk write errors.

Now it’s dead dead, I cannot get to the GRUB - will retry a clean this weekend. I’m not worried about it, this is my test machine and nothing valuable was there =]

9

Thank you, this is the most useful report I’ve had. Bluefin booting while Margine hard-hangs on the same box pins it to our kernel, not your hardware, and the dead keyboard plus no ping means a real hang, not a blank screen.

A clean reinstall will likely hang the same way. If you have time to do it, would be more useful:

  1. From the BIOS: your RAM amount and the iGPU “UMA Frame Buffer / VRAM” setting (Auto or a fixed size), on both the failing desktop and the laptop that works. This is my top suspect, since the 780M takes its VRAM from system RAM.
  2. Next boot, with quiet/rhgb removed, add ignore_loglevel earlyprintk=efi,keep and photograph the very last line before it freezes (the ACPI RTL8 line is harmless, ignore it).
  3. One at a time, try modprobe.blacklist=amd_sfh then pcie_aspm=off. does either get further?

Thanks again, and sorry it bricked the box.

Message UPDATE:

I’m currently building a Margine ISO with the stock Fedora kernel to check whether it boots normally on your devices. I think this is a more practical way to investigate the issue than continually changing the boot parameters of the current live ISO.

This should tell us whether the problem is caused by Margine’s changes compared with Bluefin or by the CachyOS kernel itself.

I’ll let you know when it’s ready and send you an Internet Archive download link.

Thanks again for your precious help !

10

Hi,

The laptop is using Auto in the BIOS, while the other one is having UMA_SPECIFIED as 8GB.

I’m currently on step 2 and now I see some progress (will upload pictures a bit later) and the keyboard works (I can do CTRL + ALT + DEL for example), but I have noticed interesting trend - about every 30 seconds there is new output that something is starting or a state is reached. I will let it run and take pictures.

so far the last two lines are about rdac and alua device handler registered (~ 700 sec in).

Keep you posted.

Update:

those 2 lines were the last and the system hang. I let it run for a few more minutes, but no new output and keyboard was not working anymore.

No change when I modify the BIOS to have the GPU set to AUTO or UMA_AUTO.

1
11920×1096 629 KB

2
21920×1092 622 KB

this is from Beelink SER8 with 32Gb RAM.

11

Thanks, that log is exactly what I needed. It is not RAM/UMA (32 GB, and the UMA setting changed nothing), and it is not really hung at first: it is crawling about 30x too slow (every systemd step ~30 s apart) before wedging in the initramfs around 700 s. That uniform slowdown is the classic AMD idle/C-state signature, so this points at the kernel.

The decisive test is ready: the exact same Margine, but with the stock Fedora kernel instead of CachyOS. If it boots normally on your SER8, the CachyOS kernel is confirmed as the cause.

here the iso:

If you have time, before installing it, on the normal ISO, beyond the amd_sfh / pcie_aspm I already mentioned, try these one at a time (they target the slowdown): processor.max_cstate=1 (most likely), idle=nomwait, and remove console=ttyS0,115200n8 from the boot line (our ISO bakes a serial console Bluefin’s does not; on a mini-PC with no real UART it can stall every kernel message).

12

Hi,

Good news!

First I tested the original live ISO with:

  • processor.max_cstate=1 and removing console=ttyS0,115200n8 - all good, booted to GUI
  • removingy just console=ttyS0,115200n8 - all good, booted to GUI, no slowness, no nothing! YAY!

ser8-margine
ser8-margine1413×720 93.8 KB

For the Fedora liveISO:

  • booting directly - NOK, same issue as with the original ISO, slow, no keyboard after a while, then hang, the whole 9 yards
  • editing the GRUB to remove console=ttyS0,115200n8 - all good, booted to GUI, no slowness, no nothing!

ser8-fedora
ser8-fedora1361×782 98.7 KB

I can say we have found the culprit.

13

Hi,

It hit a new problem with Flatpak - none of the apps are starting and flatpak complains about missing access to the repository at /var/lib/flatpak/repo.

Trying sudo flatpak update messed up the system in the middle of the package updates and entered black screen with no output. Switching to other TTY does nothing.

flatpak
flatpak1957×1221 184 KB

Update: adding error messages

from margine-validate-margine-system

== 8. Default Flatpak applications (Bug 9 guardrail) ==
  ✓ preinstall file present: /usr/share/flatpak/preinstall.d/margine-defaults.preinstall (42 apps declared)
  ✗ FAIL: app.zen_browser.zen NOT installed
  ✗ FAIL: com.bitwarden.desktop NOT installed
  ✗ FAIL: com.github.neithern.g4music NOT installed
...
skipping about 75 lines of the same
...
  ✗ FAIL: BAKE app NOT installed: org.gnome.DejaDup — kickstart %post bake silently failed AND preinstall fallback hasn't caught it yet
  ✗ FAIL: BAKE app NOT installed: org.gnome.Firmware — kickstart %post bake silently failed AND preinstall fallback hasn't caught it yet
  ✗ FAIL: BAKE app NOT installed: it.mijorus.smile — kickstart %post bake silently failed AND preinstall fallback hasn't caught it yet

flatpak-preinstall service status

cyberoto@ser8:~$ systemctl status flatpak-preinstall.service 
× flatpak-preinstall.service - Preinstall Flatpaks
     Loaded: loaded (/usr/lib/systemd/system/flatpak-preinstall.service; enabled; preset: disabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: failed (Result: exit-code) since Thu 2026-06-25 21:15:25 CEST; 5min ago
 Invocation: 9e9f2e80cc9e48c1ba6d5c3f7bca61ff
       Docs: man:flatpak-preinstall(1)
    Process: 6929 ExecStart=/usr/bin/flatpak preinstall -y (code=exited, status=1/FAILURE)
   Main PID: 6929 (code=exited, status=1/FAILURE)
   Mem peak: 10.7M
        CPU: 313ms

Jun 25 21:15:25 ser8 systemd[1]: flatpak-preinstall.service: Scheduled restart job, restart counter is at 3.
Jun 25 21:15:25 ser8 systemd[1]: flatpak-preinstall.service: Start request repeated too quickly.
Jun 25 21:15:25 ser8 systemd[1]: flatpak-preinstall.service: Failed with result 'exit-code'.
Jun 25 21:15:25 ser8 systemd[1]: Failed to start flatpak-preinstall.service - Preinstall Flatpaks.

journalctl error

Jun 25 21:13:51 ser8 systemd[2351]: SELinux access check scon=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcon=system_u:object_r:systemd_unit_file_t:>
Jun 25 21:13:53 ser8 systemd[1]: Failed to start flatpak-preinstall.service - Preinstall Flatpaks.
░░ Subject: A start job for unit flatpak-preinstall.service has failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit flatpak-preinstall.service has finished with a failure.
░░ 
░░ The job identifier is 472 and the job result is failed.
Jun 25 21:14:00 ser8 gdm-password][3798]: gkr-pam: unable to locate daemon control file

flatpak update

Required runtime for com.obsproject.Studio/x86_64/stable (runtime/org.freedesktop.Platform/x86_64/25.08) found in remote flathub
Required runtime for org.inkscape.Inkscape/x86_64/stable (runtime/org.gnome.Platform/x86_64/50) found in remote flathub

com.obsproject.Studio permissions:
    ipc                   network               fallback-x11       pulseaudio       wayland      x11      devices
    file access [1]       dbus access [2]

    [1] host, xdg-run/pipewire-0
    [2] org.a11y.Bus, org.freedesktop.Flatpak, org.freedesktop.Notifications, org.kde.StatusNotifierWatcher

fm.reaper.Reaper permissions:
    ipc      network      pulseaudio      x11     devices     file access [1]     tags [2]

    [1] home, xdg-run/pipewire-0
    [2] proprietary

org.gimp.GIMP permissions:
    ipc            network       fallback-x11       wayland       devices       file access [1]      dbus access [2]
    tags [3]

    [1] /tmp, host, xdg-config/GIMP:create, xdg-config/gtk-3.0, xdg-run/gvfs, xdg-run/gvfsd
    [2] com.canonical.AppMenu.Registrar, org.freedesktop.FileManager1, org.gnome.Shell.Screenshot, org.gtk.vfs.*, org.kde.kwin.Screenshot
    [3] GTK+3, stable

io.github.kolunmi.Bazaar permissions:
    ipc        network                fallback-x11           wayland                      x11
    dri        file access [1]        dbus access [2]        system dbus access [3]

    [1] /var/lib/flatpak, /var/tmp, xdg-data/flatpak, ~/.var/app
    [2] org.freedesktop.Flatpak
    [3] org.freedesktop.Accounts, org.freedesktop.Flatpak.SystemHelper

org.darktable.Darktable permissions:
    ipc                      network                  fallback-x11              wayland                        devices
    file access [1]          dbus access [2]          bus ownership [3]         system dbus access [4]

    [1] host, xdg-run/gvfs, xdg-run/gvfsd
    [2] org.freedesktop.secrets, org.gtk.vfs.*
    [3] org.darktable.service
    [4] org.freedesktop.ColorManager

org.inkscape.Inkscape permissions:
    ipc      network      wayland      x11     dri     file access [1]     dbus access [2]

    [1] host, xdg-config/gtk-3.0, xdg-run/gvfs, xdg-run/gvfsd
    [2] org.gtk.vfs.*


        ID                                                Branch                 Op            Remote             Download
 1. [✗] io.github.kolunmi.Bazaar.Locale                   stable                 i             flathub                1.0 kB / 1.6 MB
 2. [✗] org.darktable.Darktable.Locale                    stable                 i             flathub                1.0 kB / 9.9 MB
 3. [✗] org.freedesktop.Platform.GL.default               25.08                  i             flathub                1.0 kB / 142.6 MB
 4. [✗] org.freedesktop.Platform.GL.default               25.08-extra            i             flathub                1.0 kB / 142.6 MB
 5. [✗] org.freedesktop.Platform.Locale                   25.08                  i             flathub                1.0 kB / 379.1 MB
 6. [✗] org.freedesktop.Platform.codecs-extra             25.08-extra            i             flathub                1.0 kB / 14.4 MB
 7. [✗] org.freedesktop.Platform                          25.08                  i             flathub                1.1 kB / 252.7 MB
 8. [ ] com.obsproject.Studio                             stable                 i             flathub            < 202.8 MB
 9. [ ] fm.reaper.Reaper                                  stable                 i             flathub             < 14.7 MB
10. [ ] org.gnome.Platform.Locale                         50                     i             flathub            < 386.1 MB (partial)
11. [ ] org.gnome.Platform                                50                     i             flathub            < 408.5 MB
12. [ ] org.gimp.GIMP                                     stable                 i             flathub             < 99.6 MB
13. [ ] io.github.kolunmi.Bazaar                          stable                 i             flathub              < 8.7 MB
14. [ ] org.darktable.Darktable                           stable                 i             flathub             < 70.2 MB
15. [ ] org.inkscape.Inkscape.Locale                      stable                 i             flathub             < 15.2 MB (partial)
16. [ ] org.inkscape.Inkscape                             stable                 i             flathub             < 98.0 MB

Warning: opendir(refs/remotes): No such file or directory
Warning: opendir(refs/remotes): No such file or directory
Warning: opendir(refs/remotes): No such file or directory
Warning: opendir(refs/remotes): No such file or directory
Warning: opendir(refs/remotes): No such file or directory
Warning: opendir(refs/remotes): No such file or directory
error: Failed to install org.freedesktop.Platform: opendir(refs/remotes): No such file or directory
14

Hi, here I am again !

So, my suspects about the cachyos kernel were wrong, it simply works fine, all was caused by this stupid injection of the parameter console=ttyS0 that was making the kernel busy wait on a phantom serial port on these AMD ports…

Thanks again for helping me identify the problem !

Second, the Flatpak error. That opendir(refs/remotes) failure and the failing preinstall were an install-time bug: the way the installer pre-seeded /var/lib/flatpak left the system repo half-initialized (no Flathub remote, missing repo metadata, plus a wrong SELinux label), so nothing could resolve and flatpak update could take the session down. I have root-caused it, aligned that step with how Bluefin and Bazzite do it, and added a CI gate that now runs a full automated install and verifies /var/lib/flatpak end to end, so this class of bug cannot ship again.

Both fixes are baked into the latest official ISO (20260626), on the download page: https://margine.the-empty.place

If you get a chance to do a clean install from 20260626, let me know whether both the boot and the apps come up cleanly. Thanks a lot, this was hugely helpful. :handshake:

15

Hi,

Boots without any modifications to the GRUB, but still no dice with flatpaks. I also see more errors in journalctl logs.

Please find all errors from:

  • journalctl
Jun 28 12:56:46 margine systemd-modules-load[228]: Failed to find module 'zfs'
Jun 28 12:56:51 margine systemd[1]: [🡕] systemd-tmpfiles-setup-dev.service: Found ordering cycle: systemd-sysusers.service/start after margine-seed-etc-passwd.service/start after local-fs-pre.target/start after systemd-tmpfiles-se>
Jun 28 12:56:51 margine systemd-modules-load[723]: Failed to find module 'zfs'
Jun 28 12:56:51 margine systemd-udevd[778]: /usr/lib/udev/rules.d/10-switch.rules:4 Failed to resolve group 'nintendo_switch', ignoring: Unknown group
Jun 28 12:56:51 margine systemd-udevd[778]: /usr/lib/udev/rules.d/50-zsa.rules:3 Failed to resolve group 'plugdev', ignoring: Unknown group
...
...
Jun 28 12:56:51 margine systemd-udevd[778]: /usr/lib/udev/rules.d/70-u2f.rules:34 Failed to resolve group 'plugdev', ignoring: Unknown group
...
...
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from search access on the directory mount. For complete SELinux messages run: sealert -l 2fb04554-ca48-4905-ae8e-9a91f754d192
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from read access on the file group. For complete SELinux messages run: sealert -l 0a0fb0bf-596a-49ed-8cb8-1e369fbeb085
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from open access on the file /etc/group. For complete SELinux messages run: sealert -l eae2ded7-572c-4c86-a5ca-25a8d0ca3e44
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from getattr access on the file /etc/group. For complete SELinux messages run: sealert -l 38eba3e5-7a24-478c-8c62-b0b65bec298a
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from read access on the directory userdb. For complete SELinux messages run: sealert -l 7f749b64-73cd-404a-9801-ef6c7eecd574
Jun 28 12:57:01 margine setroubleshoot[1784]: failed to retrieve rpm info for path '/run/systemd/userdb':
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from open access on the directory /run/systemd/userdb. For complete SELinux messages run: sealert -l 1122b6c2-2479-4825-b0c3-f3265d1926da
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from getattr access on the directory /run/systemd/userdb. For complete SELinux messages run: sealert -l c67076db-5ba2-4eb7-aa29-38aa98b91531
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from search access on the directory userdb. For complete SELinux messages run: sealert -l 07309794-28bc-40ad-9fbe-f4c1ab7cbe90
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from write access on the sock_file io.systemd.Home. For complete SELinux messages run: sealert -l 47ff07a6-c304-4524-b47f-8e85b14dbd4d
Jun 28 12:57:01 margine setroubleshoot[1784]: failed to retrieve rpm info for path '/run/systemd/userdb/io.systemd.Home':
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from connectto access on the unix_stream_socket /run/systemd/userdb/io.systemd.Home. For complete SELinux messages run: sealert -l 95f255b9-a2e2-4ff1-acc2-6>
Jun 28 12:57:01 margine setroubleshoot[1784]: failed to retrieve rpm info for path '/run/systemd/userdb/io.systemd.Machine':
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from connectto access on the unix_stream_socket /run/systemd/userdb/io.systemd.Machine. For complete SELinux messages run: sealert -l f14a17fb-a790-421f-919>
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from read access on the lnk_file io.systemd.DropIn. For complete SELinux messages run: sealert -l 3d93dec7-5884-41a3-9d98-cab3d9816ab5
Jun 28 12:57:01 margine setroubleshoot[1784]: failed to retrieve rpm info for path '/run/systemd/userdb/io.systemd.Multiplexer':
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from connectto access on the unix_stream_socket /run/systemd/userdb/io.systemd.Multiplexer. For complete SELinux messages run: sealert -l 4381ecc7-7287-4416>
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from connectto access on the unix_stream_socket /run/systemd/userdb/io.systemd.Multiplexer. For complete SELinux messages run: sealert -l 4381ecc7-7287-4416>
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from read access on the file swaps. For complete SELinux messages run: sealert -l 192aa2ed-cb0b-4328-b374-2b0bb0807ba7
Jun 28 12:57:01 margine setroubleshoot[1784]: failed to retrieve rpm info for path '/proc/swaps':
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from open access on the file /proc/swaps. For complete SELinux messages run: sealert -l f23cf8f7-6769-4e75-9901-7a6f5f4b9e72
Jun 28 12:57:01 margine setroubleshoot[1784]: SELinux is preventing lsblk from getattr access on the file /proc/swaps. For complete SELinux messages run: sealert -l d4885321-7b00-4714-9eb3-0b2a54efad9e
Jun 28 12:57:04 margine systemd[1]: Failed to start flatpak-preinstall.service - Preinstall Flatpaks.
Jun 28 12:57:05 margine dbus-broker-launch[2867]: Access denied to service directory '/var/lib/flatpak/exports/share/dbus-1/services'
Jun 28 12:57:05 margine systemd[2784]: SELinux access check scon=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcon=system_u:object_r:systemd_unit_file_t:s0 tclass=service perm=status state=enforcing function=reply_unit_path path=/usr/li>
Jun 28 12:57:06 margine SetroubleshootPrivileged.py[1824]: failed to retrieve rpm info for path '/etc/selinux/targeted/active/modules/100/virt':
Jun 28 12:57:07 margine setroubleshoot[1784]: SELinux is preventing daemon-init from create access on the directory libvirt. For complete SELinux messages run: sealert -l 850722ac-bcea-4a4a-90fd-3b653a226f6a
Jun 28 12:57:07 margine setroubleshoot[1784]: SELinux is preventing daemon-init from add_name access on the directory libvirt. For complete SELinux messages run: sealert -l b6986502-bc60-4bc7-9dfe-186a26885386
Jun 28 12:57:08 margine setroubleshoot[1784]: SELinux is preventing daemon-init from create access on the directory libvirt. For complete SELinux messages run: sealert -l ae30626e-6d6b-46d3-89b7-13606d73afb5
Jun 28 12:58:14 ser8.lan gdm-password][4359]: gkr-pam: unable to locate daemon control file
Jun 28 12:58:15 ser8.lan dbus-broker-launch[4390]: Access denied to service directory '/var/lib/flatpak/exports/share/dbus-1/services'
Jun 28 12:59:04 ser8.lan systemd[1]: Failed to start flatpak-preinstall.service - Preinstall Flatpaks.
Jun 28 13:01:05 ser8.lan systemd[1]: Failed to start flatpak-preinstall.service - Preinstall Flatpaks.
Jun 28 13:03:05 ser8.lan systemd[1]: Failed to start flatpak-preinstall.service - Preinstall Flatpaks.
Jun 28 13:05:05 ser8.lan systemd[1]: Failed to start flatpak-preinstall.service - Preinstall Flatpaks.
  • margine-collect-diagnostics
mkdir: cannot create directory ‘/usr/diagnostics’: Read-only file system
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/os-release.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/uname.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/date-utc.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/rpm-ostree-status.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/rpm-ostree-status-v.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/rpm-ostree-status-json.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/ostree-admin-status.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt-root.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt-usr.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt-var.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt-var-home.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt-sysroot.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt-boot.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/findmnt-boot-efi.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/lsblk-f.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/crypttab.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/systemctl-failed.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/journal-warnings.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/flatpak-list.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/flatpak-remotes.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/toolbox-list.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/distrobox-list.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/uupd-state.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/pci-graphics-audio.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/kernel-media-modules.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/hardware-media-rpms.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/pipewire-services.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/pactl-info.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/wpctl-status.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/ffmpeg-hwaccels.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/gst-va.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/glxinfo-B.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/eglinfo-B.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/vulkaninfo-summary.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/vainfo.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/clinfo.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/rocminfo.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/darktable-cltest.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/hardware-media-journal.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/flatpak-gaming-apps.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/steam-flatpak-info.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/gaming-host-rpms.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/gaming-commands.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/gaming-vulkan-layers.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/gaming-split-lock.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/gsettings-interface.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/xdg-user-dirs.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/gtk-bookmarks.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/folder-icon-metadata.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/font-matches.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/mokutil-sb-state.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/bootctl-status.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/systemd-cryptenroll-tpm2-list.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/dracut-conf-files.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/rpm-kernel-cachy.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 25: /usr/diagnostics/20260628T111227Z/repo-files.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/btrfs-filesystem-show.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/btrfs-filesystem-usage-sysroot.txt: No such file or directory
/usr/bin/margine-collect-diagnostics: line 14: /usr/diagnostics/20260628T111227Z/btrfs-subvolume-list.txt: No such file or directory
tar: /usr/diagnostics: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
tar (child): /usr/diagnostics/20260628T111227Z.tar.gz: Cannot open: No such file or directory
tar (child): Error is not recoverable: exiting now
Diagnostics directory: /usr/diagnostics/20260628T111227Z
Diagnostics archive: /usr/diagnostics/20260628T111227Z.tar.gz
Treat this bundle as local diagnostic data; it may contain hostnames, usernames, paths, and journal excerpts.
  • margine-validate-margine-system (other than flatpak ones)
== 3. System users and groups (Bug 6 post-rebase guardrail) ==
  /etc/passwd entries: 66  /etc/group entries: 104
  ✓ /etc/passwd has system users (66 >= 30)
  ✓ /etc/group has system groups (104 >= 50)
  ✓ group 'audio' resolves
  ✓ group 'disk' resolves
  ✓ group 'kvm' resolves
  ✓ group 'tty' resolves
  ✓ group 'utmp' resolves
  ✓ group 'tss' resolves
  ✓ group 'dbus' resolves
  ✓ group 'polkitd' resolves
  wheel-group admin users: cyberoto
  ✗ FAIL: user 'cyberoto' is NOT in group 'docker' — bluefin-dx-groups.service may have failed at boot. Manual fix: sudo usermod -aG docker cyberoto && relogin
  ✗ FAIL: user 'cyberoto' is NOT in group 'incus-admin' — bluefin-dx-groups.service may have failed at boot. Manual fix: sudo usermod -aG incus-admin cyberoto && relogin
  ✗ FAIL: user 'cyberoto' is NOT in group 'libvirt' — bluefin-dx-groups.service may have failed at boot. Manual fix: sudo usermod -aG libvirt cyberoto && relogin

I hope this helps further.

16

Hi CyberOto,

sorry for the delayed reply. Over the past few days, I’ve been trying to vibe code a small application for build the ISO directly on my home PC, so I can speed up the debugging process and avoid having to go through the whole GitHub Actions build, ISO creation, Internet Archive upload, and download cycle every time.

I can now build a new ISO in just a few minutes and test it directly on my own PC before sending it to you. This should greatly reduce the risk of asking you to test builds that contain new issues or broken components… sorry for that

regarding this Flatpaks-missing-on-a-clean-install issue: I think I’ve found it and fixed.
The Flatpaks were being baked into the wrong location on the target system, so
they didn’t show up on first boot. They now land in the correct per-deployment
checkout (byte-for-byte in line with Bluefin/Aurora), and it’s verified end-to-end
in CI real headless install, then assert all ~37 Flatpaks are actually on the
installed disk.

Once I publish the new ISO with the fix I’ll link it here.

Thanks again for all! :handshake:

17

Hi CyberOto,

the new ISO is here !:

https://archive.org/details/margine-live-iso-20260705

Message UPDATE:

From now on, if you run into any new issues, please consider opening an issue here on GitHub:

Quite a few people are using Margine now, and I need a single place to collect all reports instead of jumping back and forth between different blogs and comment sections.

Thanks again!