---
title: "System"
description: "How Federated CoreDesktop sets up your system: tiling, the shell, the firewall, Snapper snapshots, GPU drivers, mDNS, printing, open-port audits and sensible defaults."
sections:
  - type: hero
    compact: true
    eyebrow: "Sensible defaults, all of them explained"
    title: "What CoreDesktop sets up for you."
    subhead: "A flexible tiling GNOME desktop, a better shell, a firewall that's actually on, snapshots before every update, and a handful of small fixes that add up."
    tiles: ["Tiling", "Firewall", "Snapshots"]

  - type: text
    kicker: "Tiling"
    headline: "Flexible tiling, all from the keyboard."
    body: |
      You end up with a [GNOME](https://www.gnome.org) system with a flexible tiling setup that works on any screen and really shines on widescreens. Hold <kbd>Super</kbd> (the Windows key or equivalent) and use the arrow keys to move windows around the screen.

      To change the tiling, use the icon in the top right of your screen. You can set it up however you want.

  - type: text
    kicker: "Shell"
    headline: "A better terminal, without the setup."
    body: |
      Your `~/.bashrc` sources `~/.local/share/coredesktop/shell/bashrc`, which sets up:

      - the **starship** prompt (your own `~/.config/starship.toml` wins if you have one)
      - **zoxide**: `z {part of a path}` jumps to a directory you've used before
      - **fzf** key bindings: <kbd>Ctrl</kbd>+<kbd>R</kbd> searches history, <kbd>Ctrl</kbd>+<kbd>T</kbd> inserts a file path
      - **eza** for `ls`, `ll`, `la` and `lt`
      - the aliases and functions in [shell/](https://gitea.federated.computer/Federated_Computer/coredesktop/src/branch/main/shell)

      Anything you add to `~/.bashrc` after the CoreDesktop line overrides it.

  - type: text
    kicker: "Firewall"
    headline: "ufw is on, and Docker can't get around it."
    body: |
      Incoming connections are blocked except SSH (22), mDNS (5353/udp), LocalSend (53317) and anything arriving over Tailscale.

      Docker normally publishes container ports around ufw, so **ufw-docker** is installed too. To let a container's port through, or to open a port for something else, such as a dev server you want to reach from another machine:

      ```
      sudo ufw-docker allow {container} {port}
      sudo ufw allow {port}/tcp
      sudo ufw status
      ```

      To see every open port and who can reach it, run [audit](/utilities/#audit).

  - type: text
    id: snapshots
    kicker: "Snapshots"
    headline: "Roll back a bad update."
    body: |
      If `/` is btrfs (the archinstall default), Snapper takes a snapshot of `/` before every `update` and keeps the last 5. `/home` is a separate subvolume and isn't included, so rolling back never touches your files. `sudo snapper -c root list` shows the snapshots.

      These snapshots can't be picked from the boot menu. To roll back, boot the [Arch ISO](https://archlinux.org/download/) and replace the `@` subvolume with a snapshot:

      ```
      mount -o subvolid=5 /dev/{root partition} /mnt
      mv /mnt/@ /mnt/@.broken
      btrfs subvolume snapshot /mnt/@.snapshots/{number}/snapshot /mnt/@
      reboot
      ```

      If the disk is encrypted, open it with `cryptsetup open` first and mount the opened device. Once the system works again, free the space the broken root used:

      ```
      sudo mount -o subvolid=5 /dev/{root partition} /mnt
      sudo btrfs subvolume delete /mnt/@.broken
      sudo umount /mnt
      ```

  - type: features
    kicker: "Hardware & network"
    headline: "Drivers, printing and your LAN."
    items:
      - label: "GPU drivers"
        body: "The Vulkan driver for Intel and AMD GPUs. For NVIDIA, if archinstall's proprietary driver wasn't chosen: the open kernel modules for GTX 16xx / RTX 20xx and newer, or the 580xx legacy driver back to the GTX 900 series. Reboot afterwards."
      - label: "mDNS"
        body: "Reach machines on your LAN as `machine.local`, e.g. `ssh machine.local`. Avahi and nss-mdns are set up ahead of systemd-resolved, so the two don't conflict."
      - label: "Printing"
        body: "The CUPS printing service is turned on. This may need more work to just work with other CoreDesktop machines."

  - type: checklist
    kicker: "System defaults"
    headline: "Small fixes that add up."
    items:
      - "SSH connections notice a dropped link within a minute instead of hanging (override per host in `~/.ssh/config`)."
      - "Logins allow 10 wrong passwords before locking the account for 2 minutes. Arch's default is 3 tries, then 10 minutes."
      - "Shutdown waits at most 10 seconds for a service that won't stop, instead of 90."
      - "If memory runs out, systemd-oomd closes the app causing it, instead of the whole desktop freezing."
      - "Boot no longer waits for the network."
      - "Commands run over SSH (`ssh {machine} {command}`) can find tools in `~/.local/bin` and mise."

  - type: callout
    text: "On a machine without systemd-resolved, set up mDNS yourself with `bash ~/.local/share/coredesktop/fixmdns.sh`. See the [Arch wiki](https://wiki.archlinux.org/title/Avahi#Hostname_resolution) for more."

  - type: final-cta
    headline: "Keep it all current with one command."
    body: "`update` snapshots first, then updates everything, and tells you what failed."
    ctas:
      - label: "How updates work"
        url: "/utilities/#update"
        style: primary
---