Kylin Desktop V11: immutable root on ostree and Triton neural networks

⚡ The gist in 5 seconds

• Kylin Desktop V11 shipped in August 2025 on kernel 6.6 and got an immutable root with atomic updates via ostree.
• Alongside the UKUI 4.20 desktop on Wayland, an NVIDIA Triton inference server starts with about two dozen neural networks.
• A full install needs a disk of at least 100 GB: on a 50 GB disk the installer allocates only 23 GB to the root and fails with "No space left on device".

🔍 What happened

Kylin Desktop V11 (, "Galactic Kylin") is the primary OS for China's public sector. The V11 branch shipped in August 2025 on kernel 6.6.0-76-generic, and Kylin calls it the first commercial Chinese distribution on this LTS branch. /etc/os-release now shows ID_LIKE=openKylin instead of Ubuntu as in V10, plus KYLIN_RELEASE_ID="2603". The desktop is UKUI 4.20 on Wayland with its own kylin-wlcom compositor built on wlroots. The compositor can block screenshots for individual windows and for the entire screen.

The root is immutable: updates arrive atomically via ostree, apt runs in a separate container, and apps use their own package format. The partitioning confirms it — sda1 (SYSBOOT, /boot), sda5 (SYSROOT, /), sda6 (DATA, /data), from which /home and /root are bind-mounted, and sda7 for swap. The root can be swapped out entirely while user data stays in place. Alongside the desktop, an NVIDIA Triton inference server starts with about two dozen neural networks. The installer, however, is finicky: on a 50 GB disk it allocates only 23 GB to the root and fails with "No space left on device".

The kernel received custom modifications. The EEVDF scheduler (which replaced CFS in 6.6) and sched_ext, which only landed in mainline in 6.12 but was backported to 6.6 here. MPTCP is enabled: a single TCP connection travels over multiple channels simultaneously, with up to an 8x throughput increase claimed. BFQ was improved — large programs launch 5% faster. Under memory pressure, the kernel kills background processes and leaves system ones alone. The release closes 5163 CVEs, 1308 of them rated 7 or higher — figures from Kylin itself.

🧠 Our take

An immutable root, apt in a container, and a proprietary package format are not about convenience for the individual user — they're about manageability of a machine fleet. Our assessment: in the public sector, a guaranteed identical root and a one-command rollback matter more than the freedom to break the system via sudo apt install. The list of supported CPUs — Phytium, Loongson, Hygon, Zhaoxin, Sunway, Kunpeng 920 plus Intel and AMD — says the same: building from a single source tree for x86_64, ARM64, and LoongArch64 is for procurement, not for enthusiasts.

What this changes in practice: Kylin V10 descended from Ubuntu, V11 descends from openKylin, and packages now carry suffixes like -ok1k0.2. It looks like a deliberate move away from someone else's upstream to their own. We see Triton on the desktop as a bet on local inference without the cloud — for organizations that don't want their data leaving the premises, that's a strong argument, even if the specific models aren't named yet.

The winners are hardware vendors on the list: making it onto the support list is effectively clearance for government procurement. The loser is anyone expecting a regular Linux desktop from Kylin: 100 GB for installation, TPM 2.0 in the minimum requirements, and 4 GB of RAM with 8 GB recommended.

⚠️ What we don't know

Weak spots abound. About the "two dozen neural networks" there is no model list, no GPU requirements, and no data on how much memory they consume under the claimed 8 GB. The MPTCP (up to 8x) and BFQ (5%) benchmarks come without methodology. The 5163 CVE figure is a vendor's own claim. All of this comes from a single hands-on review of a live system — no independent runs exist. Separately, check why the system requires TPM 2.0 in its minimum specs and exactly what gets sent out with the inference server running.

Prediction: Within two quarters, at least one of the patches backported to 6.6 (sched_ext or the BFQ improvements) will surface in openKylin. If it doesn't — the work stays inside the commercial branch, and the "open ancestor" is open in name only.

Disclaimer: Details are compiled from a single hands-on review of a live system — one source.

Source: Habr