Skip to main content

Bluefin Server

Amargasaurus cazaui

Bluefin Server Amargasaurus artwork, with a long neck and paired neck spines
Jacob Schnurr · Project Bluefin artwork
Dicraeosauridae silhouette size comparison, including Amargasaurus and a human figure
Slate Weasel · Public domain
Headless image

No desktop to capture. Install and boot run in Lima e2e.

Lima e2e installer and boot verification ↗

Upstream README · Artwork source · Artwork license · QA verification run

An image-based Linux server OS built like a container, composed from freedesktop-sdk.

Bluefin Server targets the same workload space as Flatcar Container Linux, Fedora CoreOS, and Talos. Built with BuildStream 2, its userspace, kernel, and boot chain compose from freedesktop-sdk (FSDK 26.08, systemd v261) components. No other distribution binaries ship in the base image; third-party userspace extensions (such as Flatcar System Extension Bakery images) require systemd-sysext merge --force per systemd-sysext-extensions.md.

It is DDI first and diskless-first: one build generates a verity-sealed /usr, signed UKIs, an OS DDI pulled into RAM over HTTP, and an offline USB installer. Rebooting updates diskless nodes; disk installation is optional.

The only thing worse than a nightmare is a factory of nightmares that makes other nightmares

Release status: Alpha​

Bluefin Server is currently in Alpha:

  • Trust model: Every boot enforces Secure Boot (signed systemd-boot, signed UKIs, dm-verity /usr pinned by usrhash= on the command line). Releases include a GPG-signed SHA256SUMS manifest verified by systemd-sysupdate and initrd pull.
  • Suitability: Alpha builds are intended for evaluation, testing, and factory validation. Not yet recommended for production workloads.
  • Roadmap: Completed criteria and remaining gates toward 1.0 are tracked in docs/MVP_1_0_READINESS.md.

Architecture​

  • Diskless boot — Netboot UKI pulls bluefin-server_<ver>.raw into RAM with rd.systemd.pull (verify=signature), mounts a dm-verity erofs /usr, and runs from tmpfs. Nodes update by rebooting into a newer image, flagging /run/reboot-required when an updated image is offered.
  • Optional disk install with A/B rollback — A running diskless node installs itself via ddi-installer.md (systemd-sysinstall copies /usr into slot A). First disk boot creates slot B and an xfs root. systemd-sysupdate fills the inactive slot and reboots nightly (Kubernetes nodes defer reboots to kured); UKI boot counting automatically rolls back failed boots. Updates can be held via /run/reboot-lock or /etc/reboot-lock.
  • Secure Boot by default — Signed boot chain with lockdown=integrity. Booty serves UEFI HTTP boot assets and per-node Ignition configs.
  • Declarative provisioning — Pass an ignition.config credential (or bluefin-node.ign next to the UKI); Ignition runs in the initrd on every boot. Configs must be idempotent.
  • Opt-in sysexts — k0s, kubeadm, homelab automation, OpenZFS, and NVIDIA drivers/CDI ship as separate systemd-sysext images outside the base /usr.

Remote diagnostics: OpenSSH is installed for diagnostics but disabled by default via presets. Start manually with systemctl start sshd when access is required. See docs/skills/factory-integration.md.

Downloads​

Each push to main publishes an immutable GitHub Release (v<YY.MM.run>) and an OCI artifact at ghcr.io/projectbluefin/bluefin-server:<ver>.

FileUse case
bluefin-server-netboot_<ver>.esp.rawFlash to USB for diskless HTTP boot (pulls OS into RAM).
bluefin-server-installer_<ver>.rawFlash to USB for offline systemd-sysinstall to disk.
bluefin-server_<ver>.rawOS DDI served by Booty for network boot at scale.

Verify downloads against the GPG-signed SHA256SUMS using files/os/sysupdate-keys/import-pubring.gpg; see docs/skills/systemd-sysupdate-verification.md.

USB installation​

Write bluefin-server-installer_<ver>.raw to a USB drive, configure UEFI Secure Boot Setup Mode, and boot the stick. Enroll Bluefin keys when prompted, select the target disk, and confirm. After reboot, set the console root password. Unattended installs, firmware warnings, and recovery details are in docs/skills/usb-installer.md.

Quick start​

Local builds require podman and just. BuildStream runs containerized inside the FSDK bst2 image:

just validate        # resolve element dependency graph
just export-image    # build release set into dist/diskless/
just dogfood-check   # headless QEMU diskless boot with Secure Boot
just dogfood-install # diskless boot, install to disk, verify rollback (QEMU)

Documentation index​

Start here to explore architecture and operations guides in docs/skills/:

GuideScope
ddi-installer.mdBoot, installation, and A/B sysupdate lifecycle
usb-installer.mdOffline USB installer, interactive prompts, and unattended installs
booty-integration.mdUEFI HTTP boot, iPXE chainloading, and network boot provisioning
diskless-troubleshooting.mdRAM sizing, initrd failure modes, and Ignition debugging
systemd-sysext-extensions.mdSystem extensions, bakery compatibility, and version locking
kubeadm-sysext.mdKubeadm worker and single-node control-plane extensions
k0s-sysext-ops.mdK0s cluster operations, tokens, and troubleshooting
homelab-profile.mdHomelab Ignition templates, mDNS cluster join, and add-ons
nvidia-sysext.mdNVIDIA open kernel modules and Container Toolkit CDI extensions
systemd-sysupdate-verification.mdRelease signatures, sysupdate policies, and SBOM attestations
secure-boot-keys.mdKey enrollment, signing workflows, and shim integration
gap-analysis-distros.mdComparison to Flatcar, Fedora CoreOS, Ubuntu, and Talos

Complete manifest and developer commands are listed in AGENTS.md and CONTRIBUTING.md.

Security and release trust​

  • Signed boot chain: ESP key enrollment runs on first boot. The installer halts if Secure Boot is disabled unless explicitly overridden; see docs/skills/secure-boot-keys.md.
  • Signed manifests & updates: Builds emit signed SHA256SUMS manifests. Updates and initrd pulls verify signatures automatically (Verify=yes).
  • Attestations: Releases publish SLSA provenance and SPDX SBOM attestations. Report vulnerabilities per SECURITY.md.

Further reading​

License​

Apache-2.0.

Downloads & Image Versions​

Major components in latest server release (v26.10.1234)
Kernel7.2.6
NVIDIA595.104.02
systemd261.2
fsdk26.08.2
ZFS2.4.4
k0s1.36.4
Bluefin Server deploys and installs via raw Discoverable Disk Images (DDI) and UEFI UKI binaries rather than an Anaconda ISO installer. Download installer and netboot artifacts below.

Usage​

Systems active per day.

Bluefin Server :stable: accumulating dataBluefin Server :testing: accumulating dataBluefin Server :unknown: accumulating data

Bluefin Server daily active systems unavailable

No raptors reporting in, life finds a way

Release Assets & Attestations​

v26.10.1234DDI + UKI
Oct 18, 2026
Supply chain & attestation:GPG-signed SHA256SUMS manifest & in-toto SLSA / SPDX SBOM published with release.
Asset fileSizeAction
argo-workflows_26.10.1234.raw.zst127.3 KiBDownload
bluefin-server-26.10.1234.efi71.9 MiBDownload
bluefin-server-installer_26.10.1234.raw1.2 GiBDownload
bluefin-server-netboot_26.10.1234.efi71.9 MiBDownload
bluefin-server-netboot_26.10.1234.esp.raw261.0 MiBDownload
bluefin-server_26.10.1234.raw449.6 MiBDownload
bluefin-server_26.10.1234.spdx.json104.6 KiBDownload
bluefin-server_26.10.1234_15056a63-5a1d-90cd-bd1d-2a226c9c6aba.usr.raw178.6 MiBDownload
bluefin-server_26.10.1234_f1c4e334-b179-195c-43bd-18249a7dd0de.usr-verity.raw1.4 MiBDownload
docker_26.10.1234.raw.zst110.2 MiBDownload
home-server-cluster.bu14.0 KiBDownload
home-server.bu7.1 KiBDownload
homebrew-integration_26.10.1234.raw.zst10.9 MiBDownload
homebrew_26.10.1234.raw.zst351.3 MiBDownload
homelab-control-plane.bu9.3 KiBDownload
homelab-control-plane.ign5.6 KiBDownload
homelab-k0s-control-plane.bu9.2 KiBDownload
homelab-k0s-control-plane.ign5.5 KiBDownload
homelab-k0s-node.bu3.3 KiBDownload
homelab-k0s-node.ign2.1 KiBDownload
homelab-node.bu3.0 KiBDownload
homelab-node.ign2.1 KiBDownload
homelab_26.10.1234.raw.zst2.7 MiBDownload
k0s-1.36.4-k0s.1.raw.zst168.6 MiBDownload
kubeadm_26.10.1234.raw.zst101.3 MiBDownload
kubestellar_26.10.1234.raw.zst11.0 KiBDownload
mcp_26.10.1234.raw.zst2.6 KiBDownload
nvidia-container-toolkit-1.20.1.raw.zst6.3 MiBDownload
nvidia-open-595_26.10.1234.raw.zst181.6 MiBDownload
podman_26.10.1234.raw.zst33.4 MiBDownload
SHA256SUMS2.9 KiBDownload
SHA256SUMS.gpg566 BDownload
zfs_26.10.1234.raw.zst4.1 MiBDownload
v26.10.1230DDI + UKI
Oct 18, 2026
Supply chain & attestation:GPG-signed SHA256SUMS manifest & in-toto SLSA / SPDX SBOM published with release.
Asset fileSizeAction
argo-workflows_26.10.1230.raw.zst127.3 KiBDownload
bluefin-server-26.10.1230.efi71.9 MiBDownload
bluefin-server-installer_26.10.1230.raw1.2 GiBDownload
bluefin-server-netboot_26.10.1230.efi71.9 MiBDownload
bluefin-server-netboot_26.10.1230.esp.raw261.0 MiBDownload
bluefin-server_26.10.1230.raw449.6 MiBDownload
bluefin-server_26.10.1230.spdx.json104.6 KiBDownload
bluefin-server_26.10.1230_ab8ce788-821c-f8af-0090-b4cefefac7da.usr.raw178.6 MiBDownload
bluefin-server_26.10.1230_ee17a1c6-cbb9-51f7-3dde-bb526cecd039.usr-verity.raw1.4 MiBDownload
docker_26.10.1230.raw.zst110.2 MiBDownload
home-server-cluster.bu14.0 KiBDownload
home-server.bu7.1 KiBDownload
homebrew-integration_26.10.1230.raw.zst10.9 MiBDownload
homebrew_26.10.1230.raw.zst351.3 MiBDownload
homelab-control-plane.bu9.3 KiBDownload
homelab-control-plane.ign5.6 KiBDownload
homelab-k0s-control-plane.bu9.2 KiBDownload
homelab-k0s-control-plane.ign5.5 KiBDownload
homelab-k0s-node.bu3.3 KiBDownload
homelab-k0s-node.ign2.1 KiBDownload
homelab-node.bu3.0 KiBDownload
homelab-node.ign2.1 KiBDownload
homelab_26.10.1230.raw.zst2.7 MiBDownload
k0s-1.36.4-k0s.1.raw.zst168.6 MiBDownload
kubeadm_26.10.1230.raw.zst101.3 MiBDownload
kubestellar_26.10.1230.raw.zst11.0 KiBDownload
mcp_26.10.1230.raw.zst2.6 KiBDownload
nvidia-container-toolkit-1.20.1.raw.zst6.3 MiBDownload
nvidia-open-595_26.10.1230.raw.zst181.6 MiBDownload
podman_26.10.1230.raw.zst33.4 MiBDownload
SHA256SUMS2.9 KiBDownload
SHA256SUMS.gpg566 BDownload
zfs_26.10.1230.raw.zst4.1 MiBDownload
v26.10.1220DDI + UKI
Oct 18, 2026
Supply chain & attestation:GPG-signed SHA256SUMS manifest & in-toto SLSA / SPDX SBOM published with release.
Asset fileSizeAction
argo-workflows_26.10.1220.raw.zst127.4 KiBDownload
bluefin-server-26.10.1220.efi76.0 MiBDownload
bluefin-server-installer_26.10.1220.raw1.2 GiBDownload
bluefin-server-netboot_26.10.1220.efi76.0 MiBDownload
bluefin-server-netboot_26.10.1220.esp.raw261.0 MiBDownload
bluefin-server_26.10.1220.raw472.5 MiBDownload
bluefin-server_26.10.1220.spdx.json104.6 KiBDownload
bluefin-server_26.10.1220_1d73c8f9-ad68-4362-29cd-cac9e12f5eab.usr.raw201.5 MiBDownload
bluefin-server_26.10.1220_4eabdefb-f3cb-ba71-be2c-e87e6f3c9a72.usr-verity.raw1.6 MiBDownload
docker_26.10.1220.raw.zst110.2 MiBDownload
home-server-cluster.bu14.0 KiBDownload
home-server.bu7.1 KiBDownload
homebrew-integration_26.10.1220.raw.zst10.9 MiBDownload
homebrew_26.10.1220.raw.zst351.3 MiBDownload
homelab-control-plane.bu9.3 KiBDownload
homelab-control-plane.ign5.6 KiBDownload
homelab-k0s-control-plane.bu9.2 KiBDownload
homelab-k0s-control-plane.ign5.5 KiBDownload
homelab-k0s-node.bu3.3 KiBDownload
homelab-k0s-node.ign2.1 KiBDownload
homelab-node.bu3.0 KiBDownload
homelab-node.ign2.1 KiBDownload
homelab_26.10.1220.raw.zst2.7 MiBDownload
k0s-1.36.4-k0s.1.raw.zst168.6 MiBDownload
kubeadm_26.10.1220.raw.zst101.3 MiBDownload
kubestellar_26.10.1220.raw.zst11.0 KiBDownload
mcp_26.10.1220.raw.zst2.6 KiBDownload
nvidia-container-toolkit-1.20.1.raw.zst6.3 MiBDownload
nvidia-open-595_26.10.1220.raw.zst181.6 MiBDownload
podman_26.10.1220.raw.zst33.4 MiBDownload
SHA256SUMS2.9 KiBDownload
SHA256SUMS.gpg566 BDownload
zfs_26.10.1220.raw.zst4.1 MiBDownload
v26.10.1217DDI + UKI
Oct 17, 2026
Supply chain & attestation:GPG-signed SHA256SUMS manifest & in-toto SLSA / SPDX SBOM published with release.
Asset fileSizeAction
argo-workflows_26.10.1217.raw.zst127.4 KiBDownload
bluefin-server-26.10.1217.efi89.1 MiBDownload
bluefin-server-installer_26.10.1217.raw1.2 GiBDownload
bluefin-server-netboot_26.10.1217.efi89.1 MiBDownload
bluefin-server-netboot_26.10.1217.esp.raw261.0 MiBDownload
bluefin-server_26.10.1217.raw476.4 MiBDownload
bluefin-server_26.10.1217.spdx.json104.6 KiBDownload
bluefin-server_26.10.1217_18a2e2fc-222a-4bf3-6b17-35d7018adfb4.usr-verity.raw1.6 MiBDownload
bluefin-server_26.10.1217_289fc26e-3292-c9f7-5de1-cc0118b8e0ba.usr.raw205.4 MiBDownload
docker_26.10.1217.raw.zst110.2 MiBDownload
home-server-cluster.bu14.0 KiBDownload
home-server.bu7.1 KiBDownload
homebrew-integration_26.10.1217.raw.zst10.9 MiBDownload
homebrew_26.10.1217.raw.zst351.3 MiBDownload
homelab-control-plane.bu9.3 KiBDownload
homelab-control-plane.ign5.6 KiBDownload
homelab-k0s-control-plane.bu9.2 KiBDownload
homelab-k0s-control-plane.ign5.5 KiBDownload
homelab-k0s-node.bu3.3 KiBDownload
homelab-k0s-node.ign2.1 KiBDownload
homelab-node.bu3.0 KiBDownload
homelab-node.ign2.1 KiBDownload
homelab_26.10.1217.raw.zst2.7 MiBDownload
k0s-1.36.4-k0s.1.raw.zst168.6 MiBDownload
kubeadm_26.10.1217.raw.zst101.3 MiBDownload
kubestellar_26.10.1217.raw.zst11.0 KiBDownload
mcp_26.10.1217.raw.zst2.6 KiBDownload
nvidia-container-toolkit-1.20.1.raw.zst6.3 MiBDownload
nvidia-open-595_26.10.1217.raw.zst181.6 MiBDownload
podman_26.10.1217.raw.zst33.4 MiBDownload
SHA256SUMS2.9 KiBDownload
SHA256SUMS.gpg566 BDownload
zfs_26.10.1217.raw.zst4.1 MiBDownload