Skip to content

Instantly share code, notes, and snippets.

@ilyaigpetrov

ilyaigpetrov/_кратко-об-alpine-linux-2025.md

Last active June 25, 2026 03:27
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ilyaigpetrov/c6a05e50114dd34ce01fdfb18f228d90 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ilyaigpetrov/c6a05e50114dd34ce01fdfb18f228d90 to your computer and use it in GitHub Desktop.
Download ZIP
Кратко об Alpine Linux на 10.2025 | #Alpine #СПО #Линукс #WithoutSystemd #Кратко #RU
Raw
_кратко-об-alpine-linux-2025.md

Кратко об Alpine Linux на 10.2025

О дистрибутиве

Сайт: https://alpinelinux.org.
Мотто: «Small. Simple. Secure.»
Кредо: «Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox».
О себе / About: «independent, non-commercial, general purpose Linux distribution designed for power users who appreciate security, simplicity and resource efficiency», /about.
Подробнее о себе: https://wiki.alpinelinux.org/wiki/Alpine_Linux:Overview.
Страничка в DistroWatch: https://distrowatch.com/alpine.
Происхождение: Норвегия.
Команда: Natanael Copa⁠ (основатель и сопровождающий).

Alpine находит применение в контейнерах, встраиваемых (embedded) системах, сетевом оборудовании, серверах, одноплатниках и в качестве нетребовальной ОС для продвинутых пользователей.

Prior Art / Существующие обзоры:

Предупреждение: у меня довольно мало опыта с этим дистрибутивом.

Особенности

  1. Легковесный. Вместо общепринятых в популярных дистрибутивах утилит и др. программ используются менее требовательные альтернативы:
    • glibc (GPL) → musl (MIT)
    • coreutils (LGPL) → BusyBox (GPL)
    • systemd (LGPL) → OpenRC (BSD)
    • Bash (GPL) → Busybox Ash shell (GPL)
    • sudo (ISC-style) → doas (ISC)
  2. Из-за нестандартного набора ПО не является строгим GNU/Linux[not-gnu] и, бывает, имеет проблемы совместимости c этой ОС. Бинарники должны быть скомпилированы под musl, либо запускаться через слой совместимости gcompat -- см. [not-glib].
  3. Собственный пакетный менеждер APK (Alpine Package Keeper, GPL, на C).
    11.2025 ожидается выпуск Alpine 3.23.0, включающий новые apk-tools v3.
    OpenWRT планирует перейти на APK, но, думаю, уже после выхода v3.
    См. [apk].
  4. Акцент на безопасности. По умолчанию включает микрокоды для CPU. Бинарники компилируеются с защитой PIE (не точно). См. [security].
  5. Простой (по внутреннему устройству, принцип KISS).
  6. Минималистичен. Поставляется без предустановленного графического окружения -- см. no-de. Но, несмотря на это, работа из виртуальной консоли, включая установку графической оболочки, настройки системы и прочей подгонки под себя (customization), упрощается благодаря наличию удобных setup-* скриптов: см. https://wiki.alpinelinux.org/wiki/Alpine_setup_scripts.
  7. Поддержка различных архитектур, включая Raspberry Pi: см. https://wiki.alpinelinux.org/wiki/Alpine_Linux:Overview#Architectures.
  8. Проприетарный драйвер NVIDIA не поддерживает Musl, так что используется Nouveau.

Ссылки и сноски

  1. Про несоответствие GNU/Linux:

    1. «The GNU operating system»: https://www.gnu.org/philosophy/categories.html#TheGNUsystem.
    2. «How much of the GNU system is needed for the system to be GNU/Linux?»: https://www.gnu.org/gnu/gnu-linux-faq.html#howmuch.
    3. «Are there complete Linux systems [sic] without GNU?»: https://www.gnu.org/gnu/gnu-linux-faq.html#linuxsyswithoutgnu.
    4. https://en.wikipedia.org/wiki/GNU/Linux_naming_controversy#Composition_of_operating_systems.

  2. Про musl, glibc и бинарную несовместимость:

    1. https://wiki.alpinelinux.org/wiki/Software_management#Running_glibc_programs.

  3. Про пакетный менеджер APK:

    1. Черновик заметки к выпуску Alpine Linux v3.23.0 с apk-tools v3: alpine-draft.
    2. О переходе OpenWRT на APK в выпуске от 06.02.2025:

      OpenWrt 24.10 uses OPKG only, APK packages are not supported. Only main branch was changed to APK.

  4. Про безопасность:

    1. Микрокод: https://wiki.alpinelinux.org/wiki/CPU_Microcode.
    2. Защита PIE:
      • Из /about:

        All userland binaries are compiled as Position Independent Executables (PIE) with stack smashing protection.

      • В версии 3.23.0 запланирована поддержка PIE для статических бинарников (static binaries). См. alpine-draft.

Публикации

— В тг-канале «Декрабизация»: https://t.me/decrabru/59.

Raw
alpine-notes.md

Notes on Alpine

  1. There are no musl binaries for Golang at https://go.dev/dl/. I have found only this community package: https://pkgs.alpinelinux.org/package/edge/community/x86_64/go.
  2. For IPFS on Alpine see: https://gist.github.com/ilyaigpetrov/6a5d25bc6b076f67d44d6c83e2ce6524#alpine-linux.
  3. You can tune setup-scripts by specifying environment variables. Something like $ (export ROOTFS=btrfs; setup-disk) should work. See:
  4. Packages I add right after a fresh install: doas apk add tmux lsblk git vim curl docs w3m gcompat. Optionally you may enable community packages: doas setup-apkrepos -c (from https://wiki.alpinelinux.org/wiki/Repositories#Enabling_the_community_repository). And then install ipfs and a mail client: doas apk add kubo aerc.
  5. For Cyrillic support in the virtual console you may:
# apk add kbd
# setfont /use/share/consolefonts/cyr-sun16.psfu.gz
Raw
chroot-into-a-broken-alpine-linux.md

chroot into a Broken Alpine Linux

  1. Burn the official image to a media and boot from it.
# setup-interfaces -r # Configure network interfaces and connect to the Internet.
# setup-apkrepos -c # Enable community repos for apk and tune it in other ways.
# apk update
# apk upgrade

# blkid # Prints all partitions, their FS types and type of encryption (LUKS).
# # You have to figure out the partition with broken Alpine's root.
# # In my case it's /dev/sdb2.

# apk add cryptsetup
# cryptsetup luksOpen /dev/sdb2 decrypted-root

# apk add lsblk
# lsblk --fs # Will show if the decrypted partition uses LVM2 (logical volume).
# # In my case I have `LVM2_memeber` as a FS type for `decrypted-root`.

# apk add lvm2
# vgscan # In my case it shows a volume group named `vg0`.
# vgchange -ay vg0 # Activates `vg0`.
# lsblk --fs # Now it includes logical volumes with their FS types.
# mkdir /mnt/broken-root
# # We will use original mount util, not the one from busybox.
# apk add mount
# mount /dev/mapper/vg0-lv_root /mnt/broken-root/
# # Make sure it is actually the root of your broken Alpine:
# ls /mnt/broken-root/

# mount -o bind /dev /mnt/broken-root/dev
# mount -t proc none /mnt/broken-root/proc
# mount -o bind /sys /mnt/broken-root/sys
# cp -L /etc/resolv.conf /mnt/broken-root/etc/

# # Optionally: mount the boot partition. In my case it's sdb1 of type vfat: 
# mount /dev/sdb1 /mnt/broken-root/boot # Haven't tested but it should work.
# # Just know that in Alpine there is a tool for creating
# # initramfs images called `mkinitfs` which doesn't require `chroot`ing.

# # Now enter the chroot:
# chroot /mnt/broken-root/ /bin/ash -l

# # Now troubleshoot, figure out and fix the
# # broken parts of your Alpine.
Raw
move-home-on-a-separate-drive.md

Move /home of Alpine Linux on a Separate Drive (BIOS/MBR)

Conditions

  1. Alpine is installed on /dev/sdb and the /home directory is empty (you have no users except root).
  2. /dev/sdb is the main bootable drive with the Alpine distro.
  3. /dev/sda2 is configured to be mounted at /home.
  4. /dev/sda1 is created in case in some future you would want to use it at /boot instead of /dev/sdb1. I understand it's of little sense and not too handy but leave it as demonstration.

HowTo

# apk add lvm2 cryptsetup btrfs-progs parted
# apk add util-linux # Includes lsblk.
# lsblk --fs
NAME              FSTYPE      FSVER LABEL    UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
sda
└─[YOUR_PREVIOUS_PARTITION_SCHEME_IS_SHOWN_HERE]
sdb
├─sdb1            ext4                       bc98124b-50b0-4476-9441-77f6a27f5ce9    208.7M    16% /boot
└─sdb2            crypto_LUKS                ac306b06-9531-4b3f-8dbe-840974aff8bb
  └─root          LVM2_member                6ckeP3-t2Tg-miSt-2jGf-6dvp-jazd-K3Rkwv
    ├─vg0-lv_swap swap                       d6b7828f-20c6-4099-a7f4-9ec90d579370                  [SWAP]
    └─vg0-lv_root xfs                        4e04d03b-84d9-4dfa-9f6e-97e935e66ca1     65.8G    39% /
# fdisk -l /dev/sda # Outputs info about my sda.
Disk /dev/sda: 298.09 GiB, 320072933376 bytes, 625142448 sectors
Disk model: WDC WD3200BEVT-2
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xff84fc5f

Device     Boot  Start       End   Sectors   Size Id Type
[YOUR_PREVIOUS_PARTITIONS_ARE_SHOWN_HERE]
# # Below a spare /dev/sda1 partition is created in case in some future
# # you would wish to make sda the main bootable disk (not sdb).
# # Mind that sda1 is not marked as bootable because /dev/sdb1 is already used for this role.
# # Don't forget to configure the right device boot order in BIOS.
# parted -a optimal /dev/sda
GNU Parted 3.7
Using /dev/sda
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) mklabel msdos
Warning: The existing disk label on /dev/sda will be destroyed and all data on this disk will be lost. Do you want to continue?
Yes/No? Yes
(parted) mkpart primary ext4 0% 300M 
(parted) mkpart primary btrfs 300M 100%
(parted) print
Model: ATA WDC WD3200BEVT-2 (scsi)
Disk /dev/sda: 320GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:

Number  Start   End    Size   Type     File system  Flags
 1      1049kB  300MB  299MB  primary  ext4
 2      300MB   320GB  320GB  primary  btrfs
(parted) quit
Information: You may need to update /etc/fstab.
# cryptsetup luksFormat /dev/sda2
WARNING: Device /dev/sda2 already contains a 'crypto_LUKS' superblock signature.

WARNING!
========
This will overwrite data on /dev/sda2 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /dev/sda2:
Verify passphrase:
# lsblk --fs
NAME              FSTYPE      FSVER LABEL    UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1            ext4                       5639e3a0-5571-40ce-880e-767470351313
└─sda2            crypto_LUKS                7cd15237-5466-45a5-99cd-e2edb6a2eb8e
sdb
├─sdb1            ext4                       bc98124b-50b0-4476-9441-77f6a27f5ce9    208.7M    16% /boot
└─sdb2            crypto_LUKS                ac306b06-9531-4b3f-8dbe-840974aff8bb
  └─root          LVM2_member                6ckeP3-t2Tg-miSt-2jGf-6dvp-jazd-K3Rkwv
    ├─vg0-lv_swap swap                       d6b7828f-20c6-4099-a7f4-9ec90d579370                  [SWAP]
    └─vg0-lv_root xfs                        4e04d03b-84d9-4dfa-9f6e-97e935e66ca1     65.8G    39% /
# cryptsetup luksOpen /dev/sda2 decrypted-home
# # You may name it other way, e.g. `crypt-home`, `lvmcrypt` or just `home`.
Enter passphrase for /dev/sda2:
# lsblk --fs
NAME               FSTYPE      FSVER LABEL    UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1             ext4                       5639e3a0-5571-40ce-880e-767470351313
└─sda2             crypto_LUKS                7cd15237-5466-45a5-99cd-e2edb6a2eb8e
  └─decrypted-home
sdb
├─sdb1             ext4                       bc98124b-50b0-4476-9441-77f6a27f5ce9    208.7M    16% /boot
└─sdb2             crypto_LUKS                ac306b06-9531-4b3f-8dbe-840974aff8bb
  └─root           LVM2_member                6ckeP3-t2Tg-miSt-2jGf-6dvp-jazd-K3Rkwv
    ├─vg0-lv_swap  swap                       d6b7828f-20c6-4099-a7f4-9ec90d579370                  [SWAP]
    └─vg0-lv_root  xfs                        4e04d03b-84d9-4dfa-9f6e-97e935e66ca1     65.8G    39% /
# pvcreate /dev/mapper/decrypted-home
  Physical volume "/dev/mapper/decrypted-home" successfully created.
# vgcreate vg1 /dev/mapper/decrypted-home
# lvcreate -L 4G vg1 -n lv_swap
  Logical volume "lv_swap" created.
# lvcreate -l 100%FREE vg1 -n lv_home
  Logical volume "lv_home" created.
# lsblk --fs
NAME               FSTYPE      FSVER LABEL    UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1             ext4                       5639e3a0-5571-40ce-880e-767470351313
└─sda2             crypto_LUKS                7cd15237-5466-45a5-99cd-e2edb6a2eb8e
  └─decrypted-home LVM2_member                yhw9g3-xq2M-h1U8-gniq-dTZf-j0iW-SBQmM3
    ├─vg1-lv_swap
    └─vg1-lv_home
sdb
├─sdb1             ext4                       bc98124b-50b0-4476-9441-77f6a27f5ce9    208.7M    16% /boot
└─sdb2             crypto_LUKS                ac306b06-9531-4b3f-8dbe-840974aff8bb
  └─root           LVM2_member                6ckeP3-t2Tg-miSt-2jGf-6dvp-jazd-K3Rkwv
    ├─vg0-lv_swap  swap                       d6b7828f-20c6-4099-a7f4-9ec90d579370                  [SWAP]
    └─vg0-lv_root  xfs                        4e04d03b-84d9-4dfa-9f6e-97e935e66ca1     65.8G    39% /
# mkfs.btrfs /dev/vg1/lv_home
btrfs-progs v6.17.1
See https://btrfs.readthedocs.io for more information.

Label:              (null)
UUID:               b68a4bdb-9987-4f55-b513-c3ca600a9d9d
Node size:          16384
Sector size:        4096        (CPU page size: 4096)
Filesystem size:    293.79GiB
Block group profiles:
  Data:             single            8.00MiB
  Metadata:         DUP               1.00GiB
  System:           DUP               8.00MiB
SSD detected:       no
Zoned device:       no
Features:           extref, skinny-metadata, no-holes, free-space-tree
Checksum:           crc32c
Number of devices:  1
Devices:
   ID        SIZE  PATH
    1   293.79GiB  /dev/vg1/lv_home
# dd bs=512 count=4 if=/dev/urandom of=/root/crypt-home-keyfile.bin
4+0 records in
4+0 records out
2048 bytes (2.0KB) copied, 0.000411 seconds, 4.8MB/s
# cryptsetup luksAddKey /dev/sda2 /root/crypt-home-keyfile.bin
Enter any existing passphrase:
# vi /etc/conf.d/dmcrypt
# cat /etc/conf.d/dmcrypt
[...]
## /home with regular keyfile
target=decrypted-home
source='/dev/sda2'
key='/root/crypt-home-keyfile.bin'
[...]
# rc-update add dmcrypt boot
 * service dmcrypt added to runlevel boot
# swapoff /dev/vg1/lv_swap
# vgchange -an
# cryptsetup luksClose decrypted-home
# vi /etc/fstab
# cat /etc/fstab
/dev/vg0/lv_root        /       xfs     rw,relatime,inode64,logbufs=8,logbsize=32k,noquota      0 1
UUID=bc98124b-50b0-4476-9441-77f6a27f5ce9       /boot   ext4    rw,relatime     0 2
/dev/vg1/lv_home        /home   btrfs   defaults        0 3
/dev/vg0/lv_swap        none    swap    defaults        0 0
/dev/vg1/lv_swap        none    swap    defaults        0 0
/dev/cdrom      /media/cdrom    iso9660 noauto,ro 0 0
/dev/usbdisk    /media/usb      vfat    noauto  0 0
tmpfs   /tmp    tmpfs   nosuid,nodev    0       0
# poweroff

Sources

https://wiki.alpinelinux.org/wiki/LVM_on_LUKS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment