Immutable distros are great at keeping users safe and sysadmins sane. Users cannot modify the base system – even with super user access. This means the user cannot delete anything vital or install anything dodgy. The only way the base system changes is through updates, and updates are atomic, which means the whole system is updated all at once. Avoiding error-prone partial updates adds an extra level of security and allows for an easy rollback to a prior version if something goes awry. Apps are installed in containerized packages, like Flatpaks, Snaps, or AppImages, which means buggy or malicious code can only affect the user's home directory.

Immutable distros are ideal for schools, hospitals, work stations, and all those places where you need to keep users safe and systems working without interruption. The problem with immutable distros is that they take away the user's ability to tinker, which is an important feature with traditional Linux distros. One would be excused for thinking of immutables as the Linux equivalent of the gray, metal filing cabinets you find in public administration offices: solid, stable, reliable, great value for money environments, but boring and only good for work environments. However, a tool called SysExt [1] offers a solution for users who want the benefits of immutable without losing the option to tinker.

SysExt is a little known and even less documented feature available on all distros with systemd. The name SysExt is a portmanteu of System Extensions and, in a nutshell, this ingenious tool lets you overlay your own content from directories in your home folder onto system directories that otherwise would be out of bounds. This article describes how to get started with SysExt. The examples are based on KDE Linux [2], an immutable distro created by the KDE community, but the procedures are similar for other immutable distros.

[...]