Cairn Linux steady rolling linux

1. Stable, and still rolling

   Cairn doesn't take packages the moment Arch publishes them. cairn-update moves your system to a dated snapshot of the Arch repositories from 7 days earlier, so every package has spent a week in Arch first. Every Cairn machine on the same date has exactly the same packages, so partial upgrades can't happen.

   • Need a security fix today? cairn-update --now jumps to today's packages.
   • Before upgrading, it shows the Arch news posted since your current snapshot.
   • Runs the LTS kernel (linux-lts).
2. Hardened by default

   The security work is done before you log in, and tuned so Flatpak, browser sandboxes and the NVIDIA driver still work.

   • AppArmor enabled at boot, with about 160 profiles.
   • An nftables firewall that drops unsolicited incoming connections.
   • A hardened kernel command line and kernel sysctl settings.
   • A locked root account; admin tasks go through sudo.
   • Optional LUKS2 full-disk encryption, with /boot inside it.
   • Privacy-minded networking: randomised Wi‑Fi MAC addresses and IPv6 privacy addresses.

   See the details

   Kernel command line:

   lsm=landlock,lockdown,yama,integrity,apparmor,bpf slab_nomerge
   init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1
   randomize_kstack_offset=on vsyscall=none debugfs=off

   The sysctl file (/etc/sysctl.d/90-cairn-hardening.conf) hides kernel pointers and the kernel log, disables unprivileged BPF and kexec, restricts ptrace to a process's own children, adds symlink, hardlink and FIFO protections and more address-space randomisation, turns off ICMP redirects and source routing, and drops core dumps. Rare network protocols and obsolete filesystems can't be auto-loaded. Also installed: usbguard, sbctl for Secure Boot keys, fwupd for firmware updates and tpm2-tools.

   Left out on purpose: the linux-hardened kernel and disabling unprivileged user namespaces, because both break Flatpak and browser sandboxes. Kernel lockdown mode is also off, because it blocks the NVIDIA driver.

3. A bad update is one reboot away from fixed

   The system lives on btrfs. snapper and snap-pac take a snapshot before and after every package change, and grub-btrfs lists those snapshots in the boot menu. If an update breaks something, reboot, pick the snapshot from before it, and run sudo snapper rollback to keep it.

   The installer also takes a "Fresh install" snapshot, so you can always get back to day one.

4. Your software, your desktop

   You get all of the Arch repositories through pacman, plus Flatpak with Flathub, browsable in Discover on KDE. Plasma is the default and installs offline; GNOME, XFCE, Cinnamon, MATE, Budgie, LXQt and COSMIC are one choice away in the installer. See the desktops.

Memory

About 570 MB at the login screen and about 950 MB with Plasma logged in. Swap lives in compressed RAM (zram).

Graphics

Intel and AMD through Mesa and Vulkan. NVIDIA GTX 16xx and newer through the open kernel driver; older NVIDIA cards use the installer's "nouveau" choice.

Firmware

Boots on UEFI and legacy BIOS. Firmware updates through fwupd.

Everyday hardware

Printing (CUPS), Bluetooth, and PipeWire audio work out of the box.

Virtual machines

Guest tools for VirtualBox, VMware, QEMU and Hyper‑V are included. Each one only starts on its own hypervisor.

Software

Every Arch repository, including multilib, plus Flathub. Firefox, Dolphin, Kate, Konsole and Okular come with Plasma.

04131ce1cf6ff6bea1f8acf2a24e88a45dbae5deb05a484fd384b1db6fdd46c9

lsblk
sudo dd if=cairn-2026.10.24-x86_64.iso of=/dev/sdX bs=4M status=progress oflag=sync

# Linux, with the .sha256 file in the same folder
sha256sum -c cairn-2026.10.24-x86_64.iso.sha256

# Windows PowerShell: compare with the checksum above
Get-FileHash .\cairn-2026.10.24-x86_64.iso -Algorithm SHA256

Turn off Secure Boot in your PC's firmware settings before booting the stick. The ISO isn't signed. Once Cairn is installed, you can sign it with your own keys using sbctl.

1. Install

   Boot from the USB stick and the Plasma live desktop starts. Double-click Install Cairn. The guided installer runs in a terminal window and asks for the disk, encryption, your user, time zone, language, keyboard, desktop and NVIDIA driver. It then copies the system to disk, sets up btrfs, zram swap and GRUB, and takes a "Fresh install" snapshot.

   The installer uses the whole disk, so back up anything on it first.

2. Update with cairn-update

   After the first boot, run cairn-update once to download the package databases. After that, run it whenever you want to update.

   cairn-update            # go to the snapshot from 7 days ago
   cairn-update --now      # today's packages, for an urgent security fix
   cairn-update --status   # which snapshot you're on
   cairn-update --news     # Arch news since your snapshot

3. Install apps

   Open Discover to browse apps, including Flatpaks from Flathub. In a terminal, use pacman for anything in the Arch repositories, or flatpak for Flathub.

   sudo pacman -S gimp
   flatpak install flathub org.mozilla.Thunderbird

4. Roll back a bad update

   1. Reboot, and open the snapshots entry in the GRUB menu.
   2. Pick the "pre" snapshot taken just before the update, and boot it.
   3. If everything works, make it permanent with sudo snapper rollback and reboot.

   Run snapper list at any time to see every snapshot and what took it.