Release notes: StrongLinux 1.0 (Aria)
Highlights
- Two editions. Server is a hardened system with an optional OpenStack
2026.1 (Gazpacho) cloud. Desktop is a GNOME 51 workstation with no OpenStack at all.
- OpenStack built from the official source (opendev.org), one virtualenv
per service in /opt/openstack/<service>, and signed .deb packages. No containers, no Ubuntu Cloud Archive packages.
- strongctl deploys, verifies and updates the cloud, from all-in-one to
multi-node high availability.
- Secure by default: TLS on every API, AppArmor in enforce mode for the
daemons, the new OpenStack RBAC roles turned on, CIS level 1 hardening and an SBOM for every package.
Base
- Ubuntu 24.04 LTS (noble): Ubuntu kernel and Ubuntu repositories for the base system.
os-release:ID=stronglinux,ID_LIKE="ubuntu debian",VERSION="1.0 (Aria)".- Signed apt repository (RSA 4096) with the
stronglinux-1.0,-updates,
-security and -proposed channels.
OpenStack 2026.1 (Server edition)
| Service | Version |
|---|---|
| Keystone (identity) | 29.1.1 |
| Glance (images) | 32.0.1 |
| Placement | 15.0.1 |
| Nova (compute, KVM/QEMU) | 33.0.3 |
| Neutron (networking, ML2/OVN) | 28.0.3 |
| Cinder (LVM/iSCSI volumes, backup) | 28.0.1 |
| Horizon (dashboard) | 25.7.4 |
| Heat (orchestration) | 26.0.3 |
| Barbican (secrets) | 22.0.1 |
openstack client | 9.0.1 |
| Tempest | 47.0.0 |
Versions follow the stable/2026.1 branch, with each project's commit pinned in release.yaml. The release also ships the StrongStack API Server (stable/2026.1), the backend of the StrongStack panel, published by HAProxy with TLS on port 9999.
More than 72 thousand unit and functional tests from the projects run on every build.
strongctl
init,bootstrap,deploy,verify,upgrade,secretsandstatus.- Profiles: all-in-one, controller, compute, network and storage.
- High availability: 3 controllers with Galera, clustered RabbitMQ, OVN NB/SB
on RAFT, HAProxy and Keepalived (VIP).
- Password vault with ansible-vault and an internal CA for API TLS.
upgrade: rolling bug-fix update within the 2026.1 series, with online
migrations. Changing series is refused.
Desktop
- GNOME 51.1 built from source in
/opt/stronglinux/gnome, without replacing
Ubuntu's GLib or GTK.
- GDM, Files, Console, Text Editor, Settings, Dash to Dock and desktop icons.
- NetworkManager handles networking.
Security
- Hardening (
stronglinux-hardening): sysctl, SSH with strong algorithms only,
auditd, PAM with faillock, password history and quality, and unneeded kernel modules blocked.
- Scans of the Server edition: Lynis 75 (stock Ubuntu 24.04: 62) and OpenSCAP
CIS level 1: 78.2 (stock Ubuntu: 68.6).
- AppArmor in enforce mode for the OpenStack daemons; rootwrap without
/usr/local. - Daily tracking of OSSA advisories and Python dependencies (pip-audit), with
automatic rebuilds.
- CycloneDX SBOM per package, signed together with the images.
Known issues
- Attaching Cinder volumes and running backups needs a physical host or a VM
with working iSCSI. It does not work inside containers.
- Without hardware acceleration (a VM without nested KVM), instances run under
emulation (TCG), which is much slower.
Updating from candidates
If you installed a candidate, update with apt update && apt upgrade. On a cloud, first run apt install --only-upgrade strongctl, then strongctl upgrade.