Hey everyone! You know, a funny thing happened to me on the way home today. I ran out of content, that’s what! So I decided that I like pain, so let’s install Alpine Linux as a desktop environment!

For those who don’t know, Alpine Linux is a distribution that prides itself in being incredibly minimalist. There’s no graphical installer, they don’t include the core GNU utilities, and they also use the BSD equivalent of sudo doas.

As a result of being incredibly stripped down, Alpine is generally used in the development of containers, but who told you you couldn’t use it as a desktop OS? I want to, gosh darn it! I want to perpetuate the meme and clown all those FSF zealots!

“I use Alpine, a distro that doesn’t include the GNU coreutils, or any other GNU code. It’s Linux, but it’s not GNU+Linux.”

Luke Smith, Schooling a Beta GNUtard on Linux

In all seriousness, I got a nasty idea in my head. A constant meme is perpetuated by online Linux circles is begging people to use things like Void Linux or Gentoo. And when I began to consider the systemd-free distributions. The fact of the matter is it is far easier to use systemd than to use something like openrc (Alpine’s alternative) and many applications are built around it. The documentation is way better and it sees very active development.

That being said, on a security perspective, systemd does too many things, more than what most desktop users or admins need on a daily basis. This isn’t to systemd is inherently bad. Controversy on the internet travels quickly and lives a long time, and there are still people who resist this to this day for the wrong reasons. The beauty of open-source is you have the choice not to use it.

First, I’m not using Gentoo, because I am not waiting 16 hours for a minor update to compile. Binary distributions all the way!

Second, with distributions like Devuan, Void, and Artix, it’s difficult to pinpoint how widely used these distributions actually are and whether they get the love and attention your operating system needs (No offense, but I might look at them in the future).

Alpine Linux is the only distribution that fits most people’s needs in this regard. It’s a minimal, binary distribution with biannual releases, but there’s a surprising number of packages in its repositories to get some work done. You can still browse the web, watch videos, or edit documents; practically anything you could do on desktop Linux is available to you. Except for:

  • Gaming (at least optimally)
  • GPU acceleration that isn’t integrated (Nvidia only supports glibc not musl, AMD requires Gentoo hacks)
  • Running in a virtual machine as a desktop OS. I can’t get spice-vdagent to work and good luck with VirtualBox
  • Programs that require systemd

Installing Alpine

If you are using Alpine on a virtual machine as a desktop user, I strongly recommend picking the standard ISO. While you might be tempted to pick the virtualized install, it’s so stripped down, you won’t be able to use copy/paste or drag/drop with Spice or have any other major kernel features out of the box.

  1. On boot, hit Enter to proceed with booting
  2. Login as root. There’s no passphrase.
  3. We’re going to run setup-alpine. This is a command-line installer for Alpine Linux.

setup-alpine

Alpine’s command-line installer actually bridges together multiple other scripts that automate the process of building your system. I have them as headings here as a bit of insight to what’s happening.

setup-keymap

  • Select your keyboard layout by country code. Mine is us.
  • Select your keyboard variant. Mine is us.

setup-hostname

  • Enter system hostname. For a desktop user, the default of localhost is fine, but you can change this whatever you want.
  • Next, we need to connect to the network by selecting an interface. I always use wired eth0, but Alpine’s kernel should have the priorietary blobs necessary to get Wi-Fi to work.
  • Choose dhcp (default) for a dynamic IP.
  • Additional configuration?

usermod & passwd

Create a passphrase for your root user. Don’t worry about this one, because we’re going to lock the root user later.

setup-timezone

  • Press ? to see what timezones are available and pick the one that’s applicable for you.
  • I live in the US, so I’m going to pick America/
  • Next, the installer will ask for a sub-timezone. This is the area you live in.
  • I live in the East Coast, so I’m going to pick New_York.

setup-proxy

I don’t use a proxy, but you can configure one here (Default: none).

setup-apkrepos

Alpine will now show various mirrors for their repositories. You can select a number here for a specific one, press f to choose the fastest, or press r for a random one.

Standard user

I’m going to set up a standard user account, where I can do my daily activities. I’m going to pick user, but you can put whatever you want here; it’s your username.

Next, it will ask for your passphrase and make this passphrase a good one.

setup-sshd

I’m not going to be using SSH, but you can set it up here.

setup-disk

  • Choose the desired volume. Mine is vda.
  • Choose your desired volume type. If you are using a virtual machine, you can select the default of sys. However if you are using a physical computer, I strongly recommend choosing cryptsys, which is the encrypted LUKS install, which will protect your computer in the event of seizure or theft.
  • Type in your passphrase at the prompts.

Post-Installation

Now we can reboot into our new system using reboot. Now enter in your encryption passphrase if you have one, since you’ll need to do this when you boot up. First, we’re going to log to our root user and get our stuff set up.

APK Updates

Alpine uses the apk package manager (Alpine Package Keeper), which is pretty basic, so you need to hold its hand a little bit.

  • apk update to update the package list.
  • apk upgrade --available to install any upgrades.
  • apk add <package> to install a package.
  • apk del <package> to uninstall a package.

I prefer to use vim instead of vi, but you can do whatever works for you.

Rootless User With doas

By default, Alpine does not install sudo, but we’re going to opt for doas, as it is more minimal. Remember, I chose user as my username, so you need to choose your username.

adduser user wheel
apk add doas

Now, we need to logout of our root user and into our user account, now with freshly minted doas privileges by typing exit.

On logging into the user account, we now have reduced privileges and we are able to run commands with doas. Now we need to lock the root account, so nobody can just abuse it.

doas passwd -l root

Installing a Desktop Environment

As Alpine is largely used on servers, we need to add the community repository to gain access to desktop packages. With doas, we can edit the line with the community mirror.

doas vim /etc/apk/repositories
doas apk update

You’ll know it worked when the package count leapt from ~4000 to ~17000.

Alpine does not have a wide selection of desktop environments, but they support:

  • GNOME
  • KDE Plasma
  • Sway

I’m going to pick GNOME as GNOME on Alpine doesn’t require using Xorg, since we should all be moving to Wayland. To be clear, installing GNOME, KDE, or Xfce doesn’t install a minimal package; it installs some other things too.

Run the following command to setup your desktop. We also need NetworkManager, . Afterwards, we’re going to reboot and start those new services.

doas setup-desktop [gnome]
doas apk add bash bash-completion networkmanager-wifi
doas reboot

Niceties

The following are things I have tested out.

Debloating GNOME

Let’s debloat GNOME.

doas apk del firefox
doas apk add evince eog nautilus alacritty vlc

Flatpak

Now let’s setup Flatpak with some of the packages we need, which provides a whole host of apps that never would be in Alpine’s repos anyway.

doas apk add flatpak
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
flatpak install flathub org.mozilla.firefox

Pipewire

There’s no sound out of the box, so let’s install PipeWire.

doas addgroup user audio
doas addgroup user video
# If you installed a desktop environment
doas apk del pulseaudio 
doas apk add pipewire wireplumber pipewire-pulse

AppArmor

There’s no mandatory access controls in Alpine, so we need to install it ourselves.

doas apk add apparmor apparmor-utils apparmor-profiles

Next we need to review our Linux security modules (LSM).

cat /sys/kernel/security/lsm

Then we’re going to edit the boot configuration to override the default LSM files. It’s important you copy /sys/kernel/security/lsm and put whatever you saw there, with

doas vim /boot/extlinux.conf

lsm=landlock,yama,apparmor

Now start AppArmor on boot:

doas rc-service apparmor start
doas rc-update add apparmor boot

Finally, verify AppArmor is working.

doas aa-status

If this is good, then set all available profiles into enforce mode. If you use any of these applications, set them into complain mode if they give you problems or write your own configuration.

doas aa-enforce /etc/apparmor.d/*

Spice Agent

I haven’t figured out how to get Spice working properly on Alpine. If someone knows, let me know down in the comments on YouTube or Odysee.