The Immutable Linux OS That Never Breaks

System Requirements

• Storage: 32 GB minimum for blue-green dual-image architecture (64 GB recommended)
• Memory: 4 GB RAM minimum (8 GB recommended)
• Processor: 64-bit x86 CPU with virtualization support (Intel VT-x or AMD-V)
• Graphics: Intel, AMD, or NVIDIA (all drivers included)
• Installation Media: 8 GB or larger USB drive

Note: The blue-green architecture requires two complete system images, which is why minimum storage is higher than typical Linux distributions. This dual-image design is what makes atomic updates and instant recovery possible.

What's Included

• Base System: Arch Linux foundation with bleeding-edge software and Btrfs filesystem
• Applications: Vivaldi Browser, OnlyOffice, Gear Lever (AppImage manager)
• Containers: Podman, LXC, systemd-nspawn, Distrobox, Pods (GUI)
• Android: Waydroid pre-installed and configured
• Hardware: Graphics drivers, CUPS (printing), SANE (scanning) with auto-detection
• Desktop: GNOME or KDE Plasma (chosen at download, not installation)
• Storage: Btrfs filesystem with intelligent subvolumes for optimal performance
• Architecture: Blue-green dual system images with shared user data
• Security: AppArmor profiles, firewalld, optional LUKS2 full-disk encryption

Pre-Installation: BIOS/UEFI Setup

Configure firmware before installing (access via F2, F10, Del, or Esc at startup):

• Disable Fast Boot
• Disable Secure Boot (required for installation—can be re-enabled after enrolling Shanios keys)
• Set SATA mode to AHCI
• Enable UEFI boot (disable legacy/CSM)
• Enable virtualization (Intel VT-x or AMD-V)

Note: If you want to use Secure Boot, you can re-enable it after installation and enroll the Shanios signing key using MOK (Machine Owner Key) management.

Creating Installation Media

Write ISO to USB using Balena Etcher (recommended, cross-platform), Rufus (Windows), or dd (Linux/Mac).

Important: Do not use Ventoy—it has known compatibility issues with Shanios's immutable architecture and bootloader configuration.

Installation Steps

1. Boot from USB (press F12, F2, or Del during startup)
2. Select "Install Shanios" from boot menu
3. Choose language, timezone, and keyboard layout
4. Select disk and partitioning scheme (automatic recommended)
5. Enable LUKS2 full-disk encryption if desired (recommended for laptops)
6. Wait for installation to complete (10-15 minutes)
7. Reboot when prompted (remove USB drive)

Note: Desktop environment (GNOME or KDE Plasma) is determined by which ISO you downloaded.

Initial Setup (First Boot)

On first boot, the Initial Setup wizard will guide you through:

• Creating your user account (username and password)
• Configuring network connections
• Setting up privacy and location services
• Finalizing system preferences

This approach allows the base system to install quickly while personalizing your setup on first boot.

System Updates

Immutable system updates:

sudo shani-deploy

Updates apply atomically to the inactive image. After reboot, you boot into the updated system. If needed, you can select the previous image from the boot menu.

Application updates:

flatpak update

Firmware updates:

fwupdmgr update

Delivered via LVFS using fwupd.

Important: Always use shani-deploy for system updates to preserve immutability.

Common Tasks

Task	Command / Instructions
Install applications	flatpak install flathub <app-id> or use Software Center
Gaming	flatpak install flathub com.valvesoftware.Steam flatpak install flathub com.heroicgameslauncher.hgl flatpak install flathub net.lutris.Lutris
Windows apps (Wine)	flatpak install flathub com.usebottles.bottles
Containers (Podman)	podman run -it --rm ubuntu:22.04 bash (rootless, Docker-compatible)
Compose-style workflows	podman compose up -d
Development environments	distrobox create --name ubuntu --image ubuntu:22.04
System containers (LXC)	lxc launch images:ubuntu/22.04 ubuntu-lxc
Lightweight OS containers	systemd-nspawn -M arch (managed via machinectl)
Android apps	Launch Waydroid from Applications menu and complete initial setup

Important Notes

• Dual booting: Not recommended—other OSes may break the bootloader
• Package management: Use Flatpak, containers, or AppImages
• System modifications: Root filesystem is immutable—use proper channels
• Secure Boot: Can be enabled after installation by enrolling MOK keys (password: shanios)

Enabling Secure Boot (Optional)

Shanios supports Secure Boot using a signed bootloader and a Machine Owner Key (MOK). Secure Boot ensures that only trusted, signed components are loaded during system startup.

Automatic MOK enrollment:

• If Secure Boot was enabled during installation, the system will prompt you on the first reboot to enroll the MOK key.
• When the MOK Manager appears, select"Enroll MOK" and enter the password shanios.
• If you do not want to use Secure Boot, choose "Continue boot".
• If Secure Boot was already enabled or the MOK key was previously enrolled, no further action is required.

Manual Secure Boot enablement: Follow the steps below if Secure Boot was disabled during installation and you want to enable it afterward:

1. Import the MOK key (you will be asked to set a one-time password):
   sudo mokutil --import /etc/secureboot/keys/MOK.der
2. Enter and remember the password you set
3. Reboot the system
4. When the MOK Manager appears, select "Enroll MOK"
5. Confirm enrollment and enter the password
6. Reboot when prompted
7. Enable Secure Boot in BIOS/UEFI settings if it is still disabled

After enrollment, the firmware will trust the Shanios bootloader and the system will boot normally with Secure Boot enabled. You can list the enrolled keys with:

sudo mokutil --list-enrolled

If no MOK prompt appeared at boot, you can repeat the import step and reboot again; the MOK Manager will trigger only when a key is pending enrollment.

Need Help?

Visit comprehensive documentation or join Telegram community for support.