2026-09-30 –, Galerie
The image based Linux vision is clear: immutable system images, declarative composition, no imperative package installation at runtime. But what happens when you need dozens of independently deployable application modules on the same device, each owned by a different team in a large enterprise, each on its own release cadence, while keeping the root filesystem untouched?
We built a modular deployment system for production Linux devices that takes the image based philosophy to its logical conclusion: every module is a read only ext4 filesystem image, built deterministically at build time, deployed to its own A/B partition with zero installation, and managed entirely through systemd transient services. No unit files on the rootfs. No package manager on the device. No post deploy scripts. The image is the truth.
On the packaging side, we use deterministic ext4 creation with constant timestamps to produce (mostly) reproducible images regardless of build environment. This reproducibility directly enables efficient delta based OTA: because the on device image is read only and byte identical to what was built, we can chunk-diff against it and deliver only changed blocks critical for constrained networks.
On the runtime side, a oneshot service mounts each module and starts it via systemd-run as a transient service inheriting automatic restart, cgroup resource control, and clean lifecycle semantics without ever writing a .service file to disk. We deliberately rejected the alternative of modules shipping their own unit files precisely because it violates the principle that deployment must not modify the root filesystem. Transient services give us the systemd machinery we need while preserving an immutable rootfs compatible with dm-verity.
Modules are fully isolated: separate uid/gid, sandboxed filesystem access, dedicated persistent storage, and communication exclusively through a formal interface (gRPC unix domain sockets in our case). Each module treats every other module as a remote server: no hard startup dependencies, no shared state, no assumption that any other module is even present on the same device
The talk will cover:
- Applying image based Linux principles at the application module level, not just the OS
- Packaging modules as (mostly) reproducible, read only ext4 images with deterministic tooling
- How image based module packaging enables per-module automated testing: deploying test harnesses as modules themselves, composing versioned module sets for deterministic integration testing, and unlocking independent CI/CD pipelines per team
- Why deb/rpm, Flatpak, and AppImage each fail for independently deployable A/B modules
- Delta-based OTA delivery that exploits immutable images for chunk-level diffing
- systemd transient services as a module lifecycle manager: all the benefits of systemd, none of the rootfs side effects
- Per-module sandboxing, cgroup isolation, and gRPC-only IPC
- Lessons from production: independently updating 40+ modules without device reboot
Corin Rypkema is an engineering manager & technical lead at Amazon integrating immutable, read only OS images across thousands of embedded devices at scale. With ten years in security focused embedded systems, Corin has deep expertise deploying secure boot, TPM, and cryptographic systems in production environments, solving the operational, process, and integration challenges of bringing these foundational technologies to enterprise device fleets.
Gopal has a bachelors in Computer Engineering and a Masters in Computer Science and has been in the embedded systems industry as software engineer for over 16 years. Currently, Gopal is a Senior Embedded Software Engineer at Amazon working on grocery technology.