Why no Linux distro will ever be truly secure (and what I switched to instead)

Published Sep 19, 2026, 4:30 PM EDT Graeme Peacock is a seasoned Linux expert with more than 15 years of hands-on experience. He has worked extensively with Ubuntu, Gentoo, Arch Linux, Qubes, and Fedora, gaining deep proficiency in everything from routine terminal operations to highly customized system builds. Graeme began his journey with Ubuntu, quickly mastering the command line and essential system administration skills. A year later, he moved to Arch Linux, where he spent nearly a decade refining his expertise through the installation and configuration of multiple minimalist systems. After some time, he moved to Gentoo, where he configured and compiled both server and desktop environments using normal and hardened profiles and frequently compiled custom kernels. Graeme moved to Qubes in 2016, where he has remained ever since. Graeme has extensive experience with highly configurable tools such as Vim, Neovim, and Emacs, and he maintains his own complex configurations. He is also highly proficient with Bash, Zsh, and dozens of utilities. Graeme holds a B.S. in software engineering and has a strong passion for programming and web development. He is proficient in Golang, Python, Bash, JavaScript, TypeScript, HTML, and CSS. He also has considerable experience with Docker and is currently working on learning Kubernetes. Linux failed to keep me happy, even after I moved from Ubuntu to Arch, then to Gentoo. I now live comfortably on another little-known OS, one with forward-thinking ideas. Linux cannot provide the security guarantees I need to feel safe. I wanted an entirely new approach. Such a system does not yet exist in a stable state, but I did find an alternative that solves my problems, and it doesn't even require that I give up Linux. Linux has a little problem Ambient authority and bolted-on solutions Credit: Dibakar Ghosh | How-To Geek Linux was never about security; it's a free, open system anyone can use. While it's always evolving, addressing its flaws would require a fundamental shift in architecture and a completely different security model. First, it's a monolithic kernel, which means almost all of its services (like drivers and modules) run in kernel space (aka ring 0)–the applications and code you use run in ring 3, including libc. Ring-0 code has full access to the hardware, barring the TPM and management engine. A bug in ring 0 means total compromise. Linux is massive, with thousands of modules, all running with ring-0 privileges. Another major flaw is its ambient authority-based approach. Used in almost every modern operating system you've heard of, it means a subject (process) receives permissions based on its identity or role. Essentially, when a user launches a process, it inherits user-account privileges, assigned by virtue of its "ambient" environment. Nothing is hidden here, only restricted. Additional permission systems layered on top enforce those restrictions, but a subject is never in the dark. On Linux, discretionary access control (DAC) leaves large parts of the system exposed in most cases. A privilege escalation attack often means full compromise. Many things still require root. Root in a Docker container also typically grants root on the host. This leaves a system only one or two flaws away from complete failure. What's more, Linux has implemented many ways to slow down an attacker over the years, including ASLR, PIE/PIC, stack canaries, chroots, seccomp, NX, and SELinux, all of which patch weaknesses after the fact. Security on Linux is inadequate and an afterthought. My current solution A wrapper around Linux that makes attacks meaningless After a couple of years, I concluded that no amount of tweaking Linux would work. You can use containers or bwrap, but the kernel still exposes the system. Even SELinux won't save you. Linux is an open, complex platform with a layer of rules on top–there will always be loose ends. For now, Qubes is the perfect solution, because it blends the convenience of Linux with a much stronger security architecture. It may be controversial to say, but Qubes uses something like a capability-based security model. In such a system, subjects (e.g., VMs, but traditionally processes) know nothing of their operating environment except what's explicitly granted to them. Like a dark room with only the essential resources passed through a letterbox. Qubes is not a true representation of this model, but the principles of sandboxing apply. In this world, Qubes doesn't care about the problems of Linux, because almost every attack gets contained. When dividing up our lives by risk, like banking and general browsing, we confine malicious compromises to domains that house nothing important, and drastically reduce the danger when transferring money, managing social media accounts, or handling business affairs. For example, I firewalled my email domain to limit access to a single remote provider, and I open attachments in a separate, disconnected virtual machine. What the future holds A pure form of the capability-based security model Qubes was the first generation of "security by compartmentalization" operating systems, but it won't be the last. Spectrum OS is a newcomer that attempts to improve upon some of Qubes' shortcomings, such as resource usage. It differs in that it aims to wrap every application in a microVM, which is much lighter than a traditional VM. It's built on top of Cloud Hypervisor, which can theoretically boot such guests in a mere 100ms. For now, Spectrum OS wraps applications in a full VM. Another future platform is Sculpt OS, an operating system built using the Genode framework, and it is truly capability-based. Instead of using virtual machines, every component in Sculpt OS runs in a mini sandbox, and those sandboxes are hierarchical. Parents spawn child processes, just as a browser spawns a plugin, and each child gets its own dark room. The parent passes in crucial resources and reveals nothing more. A malicious PDF has difficulty compromising a system it knows nothing about. What's more, Sculpt OS boots a microkernel derived from NOVA, and Genode also supports seL4–the latter of which uses a mathematically verified codebase (to varying degrees). Microkernels (the opposite of Linux) move almost all modules out to ring 3, making privilege escalation much harder. Both Spectrum OS and Sculpt OS (Genode) are long-term projects not yet fit for prime time — but Qubes is, and you can use it today. Docker OS Windows, macOS, Linux Brand Docker Price Starting at $9/month Free trial Free version with limited features Docker is an application that makes it easy to develop new apps. Linux is indispensable, so Qubes is the sensible compromise Linux is convenient and will always exist as long as operating systems do, but it's not the best approach to security. If that's one of your goals, then don't fall into the trap of trying to configure your way out of it (like I did); simply stick it in a VM. That gives you the convenience of Linux with the security of a strong sandbox. Qubes just makes this easier for you.