Say the name "Chromium" out loud in Linux circles, and you will soon see what a mob looks like. Many people don't like how much of the web rests on one engine led by Google, and they prefer to keep it away from their systems.
Now we have Domicile, a new Rust-based Wayland compositor that uses a patched build of Chromium to draw the entire desktop as a web page.
Apps still run natively, and each Wayland window goes straight into Chromium's rendering system and shows up inside that page as an element. A window and a website can then sit side by side and be arranged the same way.
Domicile: Overview ⭐
Some Domicile mockups as shown on the homepage.
Domicile is not a drop-in desktop like GNOME or KDE Plasma. It leaves the bar, the window layout, and the look to a shell, and that shell itself is a web page you have to write yourself.
Native app windows and websites both sit on that page, and because CSS decides where each one goes, layouts like tiling or floating take only a few lines of styling.
You can even swap the shell without closing a single window because loading a new one resets only the state held in the shell's own page. A single page can span every monitor, and shells are built from packages that anyone can publish on npm, whether it is a whole desktop, a bar, or a launcher.
The compositor still handles the lock screen, tray icons, notifications, and screen sharing, while the shell decides how they look. The built-in browser runs Manifest V3 Chrome extensions, but some of them behave differently than they do in Chrome.
Apps need Wayland support to run. Electron, SDL, and Qt apps start in Wayland mode, but X11-only ones will not run. Xwayland, the compatibility layer that lets X11 apps work on Wayland desktops, is something Domicile does not include.
The project is provided under the MIT license, and the Chromium files it modifies stick to Chromium's licenses. One more thing, and this could be a dealbreaker for some of you, the project is AI-assisted.
Manganese, the element?
0:00
/0:04
Not quite. Manganese is the ready-made shell that comes with Domicile, and it works as a complete tiling desktop out of the box. Its keybindings follow Sway's on the Super key, and you get ten workspaces along with tabs, stacks, splits, floating windows, and a scratchpad.
Websites open as windows too, sitting next to native apps in the same layout, while extensions from the Chrome Web Store show up as buttons in the top bar.
It comes with a Settings app, clipboard history, launcher, screenshots tool, notifications, and a lock screen. Since every part of it is its own package, you can add a new item to the bar or replace the launcher while the rest stays as it is.
Getting started
Packages exist for Fedora, openSUSE, Debian, Ubuntu, and Arch Linux, plus an AUR package for Arch users. For NixOS, or Nix on any distro, you can use the project's flake.
It runs only on x86_64, and the project has no ARM builds.
A monolithic package carries Manganese, the login session, the domicile command, and the React packages that shells build against. After installing, you point a config file at the shell you want, then log out and pick "Domicile" on the login screen.
kitty is a GPLv3-licensed, GPU-based terminal emulator for Linux and macOS that uses OpenGL for rendering and is written in C, Python, and Go.
It can organize work into tabs and windows across seven layouts, supports small terminal programs called kittens that can be used to extend it, and can be controlled from the shell.
v0.50, its newest release, can bring back your open windows after a logout on Linux and macOS.
Kitty 0.50
kitty now saves every OS window, tab, and window with its scrollback when a session ends and restores them at the next launch. You turn it on in kitty.conf with the restore_session_after_logout setting.
On Linux, this needs a desktop portal with v3 of the inhibit interface, and while Linux stores the state unencrypted and readable only by you, a macOS system would encrypt it with a dedicated key in the keychain.
Docked windows are new too, and they let you pin a window to the edge of another window or a tab. They sit outside the layout and are meant for things like a status bar or a file tree. A window dock goes wherever its window goes, and a tab dock stays until the last regular window in that tab closes.
There are also the three new cursor trail shaders called cursor-trail-railgun, cursor-trail-torpedo, and cursor-trail-pixiedust. When in use, these emit particles off the moving cursor, giving you a Neovide-like trail. They need cursor trails turned on, and shaders can also be triggered with key presses now.
Wayland users can now use a touchscreen to click with a tap, scroll with a swipe, and select text by holding a finger in place before dragging to select the rest of it. Window decorations on GNOME and similar compositors also look native and use the desktop's titlebar font and button layout (as shown above).
The release also fixes a flaw that let a malicious request bypass remote control password authentication, along with several memory safety bugs.
Some tests
I ran kitty 0.50 on Ubuntu 26.10 with GNOME 51 on Wayland, all running inside a virtual machine.
map f1 launch --type=tab-dock --dock-edge=bottom --dock-size=1 --dock-skip-focus watch -n1 date
map f2 launch --type=window-dock --dock-edge=left --dock-size=25% top
I pressed F1 first. A one-row strip showed up at the bottom of the window and stayed there. I had pointed it at watch -n1 date, but all I got was a shell prompt.
F2 was next. It opened a top panel on the left edge, and the shell made room for it. I kept pressing it, and each press added another panel beside the first, three in total.
Opening a new tab using Ctrl+Shift+T gave me a clean slate, with the earlier view going to the background.
Next, I tested one of the three new cursor trail shaders. I added cursor_trail 1 and custom_shaders cursor-trail-pixiedust to my config and restarted kitty. Whenever the cursor jumped across the window, it left a trail of small white specks behind it.
Installation
You can use the following cURL command to get kitty:
curl -L https://sw.kovidgoyal.net/kitty/installer.sh | sh /dev/stdin
It is also available in the repositories of most major Linux distros, but these tend to run behind when it comes to new releases. Here's a list to give you a quick start:
Sharing a login with a teammate often means pasting it into a chat, dropping it in a spreadsheet, or pinning a note somewhere everyone can see.
That works until a password changes, someone leaves the team, or your credentials get leaked thanks to an employee's hasty story post on social media.
Passbolt is built for exactly that problem. You might remember it from our Linux password managers list, where it was listed as the go-to for businesses and teams.
💡
If you were looking for solutions that are tailored for individuals, then Proton Pass (partner link) and AliasVault are good picks to consider.
No password woes?
Passbolt is the creation of Passbolt SA, a company based in Luxembourg. It lets teams store and share logins and other secrets, making them accessible from one place, reducing the chances of team members being served expired or exposed credentials.
Underneath, it uses OpenPGP for encryption, and you log in with two things, a private key and a passphrase. Every person with access to a secret gets their own separately encrypted copy of it.
To use it in a browser, you will need to install its extension, which takes care of the security-sensitive operations and auto-fills logins on websites.
But there's something you need to know.
The Community Edition is open source, available on GitHub under the AGPL-3.0 license, and so are the browser extension, the mobile apps, and the Docker and Helm setups.
Then there are the paid plans. Pro and Enterprise are the self-hosted ones, and Cloud Business, Cloud Sovereign, and Cloud Enterprise are hosted by Passbolt. They add things like SSO, account recovery, and activity logs on top of what the Community Edition offers.
Passbolt says the Pro and Enterprise editions use the AGPL license too. Its GitHub organization lists no separate repositories for them. Pro also needs a subscription key to run, and you lose updates and support once the subscription ends.
Trying the Passbolt Cloud
I signed up for the Cloud Business trial by filling out a form with my full name, email address, organization name, and the workspace URL I wanted all my content stored under.
Passbolt also asks you to give consent to it storing and processing this personal information in line with its privacy policy.
Once submitted, I was notified that an email with instructions was on its way.
I followed the link in it, after which a configuration page took over, running through a few steps before it let me get in without setting a password. Passbolt then nudged me to install its browser extension.
The browser extension
Seeing that I was on Vivaldi, it automatically showed me a download button to get the Chromium version of the extension installed. Before adding it, I went through the permissions it asked for.
It requests a broad set, covering reading and changing all my data on all websites, modifying the data I copy and paste, and managing my downloads.
After reviewing the permissions the extension required and accepting them, I was taken into the passphrase and security token configuration phase, where I had to pick a passphrase, followed by a security token made up of a color and three characters.
Managing entries
Now that I was logged in, I started adding new entries. They are created from the blue "Create" button at the top-left, and the types are diverse, including Passwords, TOTPs, Custom Fields, Pin Codes, and Notes. I started populating Passbolt with some social media-related logins.
The new entry form for passwords offers a lot of customizability. I could set the name, URI, username, and password, along with a color and an icon for the entry.
The generator is very useful too, letting me set the length, pick the character types to include, and even switch to passphrases for more flexibility when creating new accounts.
When I saved an entry, Passbolt asked for my passphrase, with the security token I had picked sitting right next to the field. It can also remember the passphrase for a while, with choices running from 5 minutes to staying remembered until I log out.
Sharing, exporting, and deleting can be done in batches as well. You just select the entries and pick an option from the toolbar above the list, and when you delete, Passbolt cautions that the entry is removed permanently and cannot be recovered.
Autofilling passwords
Next, I checked out the autofill feature through the browser extension. When I went to log in to Threads, it said no passwords were found for the current page and did not suggest the saved credential. I had to search for it manually, and only then did it fill in the login form once I clicked "Use on this page."
That came down to the entry's URI, which I had saved as threads.net while the login page sat on threads.com.
I could also add new entries from the extension and browse through the filters, groups, and tags from my account.
Collaborating with others
I then tried my hand at the highlight of the tool, collaborating with other team members.
For this, I went into the "Manage Users & Groups" menu accessible via the gear button on top-right and invited a colleague for collaboration (shown as P).
He received an invitation email, and once he was set up, I gave him access to a specific folder I had created (Passbolt Collaboration Test), filled with credentials I had imported.
To do that, I used the "Share" option found by right-clicking on the folder, where I typed his name into the field, giving him the read permission.
P could access the folder without much fuss, and with the permission he had, he could not edit any entries but could copy the username, password, URI, and permalink for an entry.
From the same Users & Groups menu from earlier, I could also promote him from User to Admin, giving him control over the workspace's users and settings, or suspend his account when needed.
Interested?
To try Passbolt Cloud, you sign up with your name, email, organization name, and a workspace URL. The 7-day trial starts automatically without Passbolt pestering you for your credit card info.
After that, paid options include Cloud Business, which costs $5.4 per user per month on a monthly plan, or $4.9 if you go yearly. Cloud Sovereign is $8 per user per month billed annually, and both need at least 10 users.
You can also get a custom quote tailored to your setup via Cloud Enterprise.
If you would rather host it yourself, the Community Edition is free with no cap on users, and you can install it on Debian, Ubuntu, Docker, Kubernetes, Red Hat, AlmaLinux, and more.
Pro adds extras like SSO and LDAP provisioning, and it costs $4.9 per user per month billed annually for a minimum of 10 users.
Browser extensions are also available for Chromium browsers like Chrome, Brave, Edge, and Vivaldi, as well as Firefox and Safari. There are apps for iOS and Android too, and the only desktop app is for Windows ☹️.
As an alternative, Linux users can make use of the CLI tool Passbolt offers.
Fedora 45 arrived about two weeks late, but it’s packed. You get Linux 7.2, GNOME 51, and Plasma 6.7, plus kmscon replacing the old text console and a QR code that now leads to a page for kernel panics.
Could Ubuntu go immutable? Canonical has restarted Ubuntu Core Desktop, a snap-based system that stays locked down, and a dedicated team is now working on it. Both it and a proposed LTS firmware package are still early.
Ubuntu and many other distros turned hibernation off by default years ago, partly because it was slow. Linux Mint is bringing it back, with a few useful tweaks..
KDE Linux will load the ntsync kernel module by default. It gives Wine and Proton a closer match to Windows sync primitives, which can substantially boost performance.
A ministry merger ended Denmark’s Collabora pilot before its evaluation, Collabora says. It adds that the result shouldn’t count against the suite, and it says the first phase worked well.
France’s National Assembly has backed a tax of 5.5 euro cents per gigabyte delivered to French internet subscribers. VideoLAN, the nonprofit behind VLC, says it could cost over €1 million a year.
Nitrux is warning users that nitrux.org is an unaffiliated, AI-generated site using its name and logo.
Serious about using Ubuntu Linux on servers? Mastering Ubuntu Server book has now been updated for Ubuntu 26.04 LTS. The new version is available on Amazon.
This bestseller book is written by Jay LaCroix, of LearnLinuxTV and Ken VanDine, Staff Engineer at Ubuntu. From the Linux fundamentals to Ansible, MicroK8s and even Local AI with Lemonade, the book covers it all.
There are two trends I am noticing. More European countries are opting for open source software in public institutions.
Latest in this list is the news that schools in six German states can now sign up for a Nextcloud-based cloud run by IONOS in German data centers. The four-year contract is open to other states later, and schools aren’t required to join.
The next trend is to use AI for creating open source alternatives to mainstream software as a service platforms like Adobe and Microsoft. Take the example of Puter’s new everything repo that offers more than 50 open source web apps, under MIT, that you can use in the browser or self-host.
🧮 Linux Tips, Tutorials, and Learnings
You don’t need a full VPN app for occasional use on Linux. Vivaldi with Proton VPN, Firefox’s built-in VPN, and Opera all offer free browser-only options.
Here's a collection of projects that let you run Linux directly on Apple Silicon Macs. My pick would be Fedora Asahi Remix, which works best, with nearly everything functional on M1 and M2 machines, while M3 support is still new.
👷 Homelab and Hardware Corner
You can give every container in your homelab its own name instead of an IP and port by using Tailscale Services.
In other news, Raspberry Pi has yet again raised prices, this time on its 16GB Raspberry Pi 5, which goes up $80 to $385. The 16GB Compute Module 5 also sees a $40 hike.
✨ Apps and Projects Highlights
Remember Wubi? Libertix brings that idea back, letting you install Linux Mint or Zorin from inside Windows without a USB drive.
The "Hide tabs and sidebar" option on Firefox merges the top tab bar into a slim vertical ribbon along your screen's edge. Hiding the top tabs frees up valuable vertical space, expanding your main view while keeping any open tabs reachable via a quick hover.
To turn it on, right-click the top toolbar, pick "Customize Toolbar," and drop the Sidebar button onto your bar. Click the new icon, right-click inside the sidebar, choose "Customize Sidebar," and enable the "Hide tabs and sidebar" option to collapse everything instantly.
🎋 Fun in the FOSSverse
Our Shortform Showdown puzzle will have you identify a series of short forms or abbreviations for commonly used Linux tools, commands, and concepts.
GRUB is King.
📆 Trivia Bit: In 1952, CBS used UNIVAC to forecast the presidential race. Its early call gave Eisenhower 438 electoral votes to Adlai Stevenson’s 93, but the team held it back because the result looked implausible. Eisenhower ultimately won 442 to 89.
🧑🤝🧑 From the Community: The thread by Pro FOSSer Ernest about who uses AI and what one understands about it is still going strong. Do you have anything to add to the conversation?
Every Linux user has done the three-step dance at least once. You want to swap two files, so you move the first one to a temporary name, move the second one into its place, and then move the temporary file back.
Ever felt that this is a bit... clumsy? And for a moment, one of your files simply doesn't exist. That doesn't feel right!
Since version 9.5, GNU coreutils has a better way: mv --exchange.
In this article, I'll show you what it does, how to check if your system has it, where it actually helps, and the mistake I made the first time I used it on directories.
The old way: three moves and a temporary name
Let's say you have two configuration files, nginx.conf and nginx.conf.new, and you want the new one to take the place of the old one while keeping the old one around.
The classic approach looks like this with the mv command:
There is a gap. Between the first and second command, nginx.conf doesn't exist. If a service reads it at that exact moment, it finds nothing (and trust me, one day that will happen).
It can fail halfway. If the second command fails, you are left with a temporary file and a half-finished swap to clean up by hand.
The exchange option does this in a single command:
mv --exchange nginx.conf nginx.conf.new
Swap files with mv --exchange
The --exchange option tells mv to swap the two paths in a single operation. On Linux, it uses the kernel's renameat2() system call with the RENAME_EXCHANGE flag, so the swap is atomic: at any moment, both names exist and point to a file.
You need version 9.5 or newer. Careful here: version numbers are not decimals. They are compared part by part, so 9.11 (nine point eleven) is newer than 9.5. You can also check whether the option is listed in the help:
mv --help | grep exchange
If this prints nothing, your mv doesn't have the option yet. I'll talk about which distributions ship it later in this article.
Swap two files
Let's create two small files to test:
echo "config A" > a.conf
echo "config B" > b.conf
Now swap them:
mv --exchange a.conf b.conf
Check the result:
cat a.conf b.conf
config B
config A
That's it. The contents traded places in one command, and no temporary file was involved.
Swap two directories (and the mistake I made)
It works for directories too, which is where it really shines. But the first time I tried it, it failed:
mv: cannot exchange 'release-old' and 'release-new/release-old': Unknown error -1
Look at the second path in the error: release-new/release-old. When the last argument is an existing directory, mv assumes you want to move things into it, just like a regular mv. So it tried to swap release-old with a path inside release-new that doesn't exist.
The fix is the -T (--no-target-directory) option, which tells mv to treat the last argument as a plain name instead of a destination folder:
mv -T --exchange release-old release-new
ls release-old release-new
release-new:
v1
release-old:
v2
Now the whole directory trees were swapped, no matter how many files they contain, because only the names changed.
Where it actually helps
Here are a few situations where I find mv --exchange useful:
Rolling out a new configuration. Swap the new config into place and keep the old one under the other name, ready for a quick rollback with the same command.
Switching release directories. If you deploy a new version of a site into a separate folder, you can swap it with the live folder in one step (remember the -T).
Undoing a swap. Running the same command again swaps the files back.
Limitations you should know
mv --exchange is not magic, and a few things can trip you up.
Both paths must be on the same filesystem
The swap only works when both files live on the same filesystem. If you try to exchange a file on one filesystem with a file in a tmpfs mount like /dev/shm, the kernel refuses the operation:
mv --exchange b.conf /dev/shm/x.conf
mv: cannot exchange 'b.conf' and '/dev/shm/x.conf': Unknown error -1
The message is not very helpful (it is the same "Unknown error -1" we saw in the directory mistake above), so it's worth knowing the real reason: the kernel can't swap names across two different filesystems.
Regular mv gets around this by copying the file and deleting the original, but that can't be done atomically, so --exchange doesn't even try.
The filesystem must support it
The underlying system call needs filesystem support. Common Linux filesystems such as ext4, Btrfs, XFS and tmpfs support it.
Conclusion
mv --exchange is one of those small additions that removes a whole category of fiddly, error-prone shell work. If you are on a recent distribution like NixOS, Fedora or Debian 13, it is already on your system.
Next time you reach for a temporary file name to swap two things, try mv --exchange instead. Just remember to add -T when you swap directories.
✍️
Igor Giamoniano is a developer and teacher from São Paulo, Brazil. He contributes to the Brazilian Portuguese translation of the Linux kernel documentation and runs Coisa de Dev, where he teaches Linux and programming to a Brazilian audience. You can find his open source work on GitHub.
systemd, the init system and service manager that most mainstream Linux distributions use, has merged support for writing its programs in Rust. It landed on the main branch through a pull request of 19 commits.
The pull request replaces an earlier proposal and follows rules the maintainers agreed upon at a recent hackfest in Berlin.
The first program to use it is systemd-keyring-setup, and it adds X.509 certificates to kernel keyrings, such as the dm-verity and fs-verity ones, at boot before locking them down.
With the approach they are following, Rust stays optional, and systemd can still be built without it.
The Rust code's scope is limited to new standalone programs that nothing else depends on, while everything builds with meson, excluding cargo from the equation. Only the core and libc crates are allowed, and that rules out the standard library and alloc.
Programs would use systemd's own Box and Vec types, and a failed allocation would return an error instead of panicking. A Rust program must also behave like its C counterparts, with a test checking this for programs that declare the same command.
Building Rust programs involves having rustc 1.85, bindgen 0.71.1, and meson 1.4.0 or newer.
Distributions that build systemd with every feature enabled, such as Arch and openSUSE OBS, will have to install the Rust toolchain or turn Rust support off.
The shared library problem
The library that systemd's programs share, libsystemd-shared, stays in C for now. Putting Rust in it would need proper shared library support from Rust itself, and the language still has no stable ABI.
Rust programs use that C library the same way C programs do, and putting Rust inside it would duplicate the same code across the library and many of systemd’s binaries.
Filesystem access is another hurdle, since systemd looks up paths through file descriptors to keep that step secure and does not accept Rust's standard path handling for its sensitive components. It would like Rust to support that approach as well.
systemd still wants Rust in its core and says it is open to work with the Rust community to get there.
A wave of rust
systemd is not the only part of the Linux stack making room for Rust.
The memory-safe language entered the Linux kernel with 6.1 as an exploratory effort, with the kernel maintainers declaring late last year that the experiment was over.
Ubuntu has been taking the same route with its core tools since some time now, when sudo-rs and uutils coreutils became the default experiences.
All that strongly suggests that the adoption of Rust will only accelerate as we go into a very busy 2027.
Google is switching off Gemini, Gemini Notebook, Gemini in Classroom, and Search for K-12 student accounts by default. They stay off until a school admin turns them on, and each service can be manually enabled on its own.
As you already know, Google has built AI into it. They say that AI Mode and AI Overviews will guide students through problems step by step in school accounts. That leaves schools that want no AI without Google Search.
Google's VP for Education, Chris Phillips, told The New York Times (paywalled) that students at such a school would be shown a notice from the school saying Search is unavailable.
Some more details
Just a placeholder image of Google Classroom.
Starting 2027, schools whose admins turn on AI will get two Search options, one similar to the consumer version with AI overviews and chats available and the other built around Guided Learning, the student version of Gemini.
It would work as a study coach that asks students questions and breaks problems into steps instead of simply handing over answers. Google's post promises schools more details are coming over the next few months before any of this rolls out.
The August changes
Gemini in Classroom opened to students of all ages in August, and the Gemini tab was on by default at schools that already allowed students to use Gemini, while schools that had it off for students kept it off.
Before that, Gemini had only been on for students 18 and older, and admins who wanted it turned off for under-18 users could place them in a separate unit and disable access there.
The change announced now reverses that default.
Two of the largest districts in the U.S. have already acted before this came about, with New York City announcing a ban on student-facing generative AI tools for preschool through eighth grade and Los Angeles Unified blocking them on district-issued devices.
Germans do it differently
A four-year framework contract awarded to IONOS after a recent public procurement process lets schools in Berlin, Hamburg, Hesse, Bremen, North Rhine-Westphalia, and Rhineland-Palatinate opt into a cloud built on Nextcloud's open source software.
No school or school authority is mandated to use it, and the tender specifically asks for software released under an open source license approved by the OSI, citing digital sovereignty and the freedom to change providers.
The distinction that I am trying to make here is that a school in the U.S. that wants Search from Google will have to take its AI along once the changes roll out, whereas the German framework lets schools opt in or stay out.
