← Back to blog

RakuOS 45 "Chojiro": package layers, Fedora 45, and a new way to keep your apps

November 3, 2026 · Announcements

RakuOS 45 "Chojiro" is here. It moves RakuOS to Fedora 45, and it brings the biggest change to how RakuOS handles your software since we introduced rum: package layers. If you're on the stable channel, your next update moves you to RakuOS 45. Read After updating first.

This is the release

When we started RakuOS, we heard it plenty: letting people install any RPM, right away, on top of an atomic image would be messy. It would break what makes the base atomic in the first place, updates would turn fragile, and sooner or later you'd end up with a system no different from the one you were trying to leave behind. Stick to Flatpaks and containers, or layer your packages and reboot, they said.

And honestly, for a while it was messy. On RakuOS 43 and 44 everything you installed went into one writable overlay on top of /usr. An update could leave a package's files hidden, fixing a bad install meant a reset and a reboot, and moving to a new release or desktop reinstalled everything at boot. rum is how we cleaned that up.

RakuOS 43 and 44 were us proving the pieces work: rum, the overlay, signed kernel modules, switching images from a settings page. RakuOS 45 is where they come together. /usr is read-only and atomic again, every change to it is a transaction you can undo, updates are prepared before you reboot (kernel modules included), every system version keeps its own apps, and switching between KDE, GNOME, COSMIC and the rest takes your apps along and back again. All of it without asking you to build your own image or give up a single RPM.

So to everyone who said it would turn into a mess: you had a point, and thanks for the motivation. Install RakuOS 45 and see for yourself.

Our first code name: Chojiro

RakuOS 45 is the first RakuOS release with a code name. Chojiro is named after Chōjirō, the founder of raku ware, the Japanese pottery RakuOS takes its name from. From now on, every major RakuOS release will carry a code name, each referencing raku ware or origami. You'll see it in About pages, the boot menu and tools like fastfetch: "RakuOS KDE 45 (Chojiro)".

The headline: rum and package layers

On RakuOS 44, everything you install with rum or the Software Center goes into one writable layer on top of the system. On RakuOS 45, rum keeps your software in package layers: separate, versioned layers stacked read-only over the system image. You still install the same way. What changes is everything around it.

RakuOS is fully atomic again, without compromises. The writable layer made RakuOS 43 and 44 a hybrid: an atomic image with a changeable /usr on top. On RakuOS 45, /usr is read-only, and every change to it goes through rum as one transaction that applies completely or not at all, and can be rolled back. You still install any RPM you like, right away, without a reboot and without building your own image. We wrote up the full story, and how it compares to Fedora Atomic, Bazzite, openSUSE Aeon, NixOS and others, in rum in RakuOS 45. In short:

  • Installs work right away, and safely. No reboot, and a failed install changes nothing.
  • Undo any change. rum layer-history lists your last five changes and sudo rum layer-rollback goes back, live. Or open RakuOS System › Deployments › Package layer history and click Go Back to This.
  • A safety net at boot. If a change keeps your desktop from starting, pick RakuOS previous package layers in the boot menu. If your system fails to start twice in a row after a package change, RakuOS goes back to the previous set by itself.
  • Updates are prepared before you reboot. When a new image downloads, your apps are upgraded for it in the background, drivers included, however the update is started: the Software Center, RakuOS System, or sudo bootc upgrade and sudo bootc switch in a terminal. While an update is waiting, the Software Center no longer lists separate package updates, because the update covers them.
  • Every system version keeps its own apps. Rolling back to an earlier system in the boot menu gives you the apps you had with it.
  • Switching desktops or releases keeps your apps. Moving to another edition (KDE to GNOME, say), or later to RakuOS 46, reinstalls your apps for the new image before the reboot, so the first start doesn't have to. Nothing about your apps waits for a reboot any more except a full reset; turning the overlay back on in RakuOS System reinstalls them right away too.
  • Soft resets without a reboot, for one layer or all. sudo rum layer-reset drivers rebuilds just your drivers, sudo rum layer-reset --all (or sudo rakuos reset-overlay --soft) every package layer, right away. If a download fails, nothing changes, and sudo rum layer-rollback undoes it. In RakuOS System, Overlay › Reset Overlay… has Reset All Layers and a Reset button for each layer.
  • Change system packages without building your own image. sudo rum override replace and sudo rum override remove swap or hide a package that comes with RakuOS; sudo rum override reset puts it back.
  • Your layers are protected. Only rum can change them. A script or a stray sudo cp into /usr gets "Read-only file system"; run such tools with sudo rum layer-run <layer> -- <command> instead.
  • Each layer keeps its own package database, so going back restores exactly the packages that went with it. fastfetch still counts the apps you installed with rum. rum origin tells you which layer a package or a file in /usr comes from: rum origin htop or rum origin /usr/bin/htop.

Everything is explained, with commands, in Package Layers.

Also new in RakuOS 45

  • oo7 replaces GNOME Keyring on every desktop, as in Fedora 45. It stores your passwords and secrets and unlocks at login. On KDE, KWallet keeps its secrets in oo7, and existing wallets are copied over once. OpenSSH's ssh-agent now starts at login, so your SSH key asks for its passphrase once per session.
  • DaVinci Resolve, free or Studio, with one command: download the Linux installer from Blackmagic Design and run sudo rakuos setup-davinci-resolve. It installs Resolve into the local package layer with the fixes it needs on RakuOS, and running it again with a newer installer updates it. See DaVinci Resolve.
  • A smarter welcome app: apps that only RPM Fusion or Terra carry (Discord, Telegram, Heroic, Moonlight and a few more) show up once you turn their repository on, instead of failing to install. LM Studio and its local agent app Bionic now install as AppImages straight from LM Studio, kept up to date by the Software Center.
  • A new default wallpaper, Chojiro:, plus five new blue wallpapers (Wave, Glow, Drift, Leaf and Streaks) to pick from.
  • kmscon on every text console (Ctrl+Alt+F2 to F6), with proper fonts and Unicode.
  • Niri 26.04, with Dux 2.0 and a graphical shell switcher; Blueman is gone (thanks, ExistingPerson08).
  • Hyprland 0.57.0, built by RakuOS, with a greeter picker, GloView, a preview share picker, screenshots and lock in Noctalia, and vertical workspace presets (thanks, tofan79).
  • COSMIC 1.11.0, the latest COSMIC desktop, built by RakuOS. The Software Center now uses its native COSMIC version, RakuOS System Settings is in the logo menu, and cosmic-tasks is no longer installed (thanks, John Holt).
  • Kernel: RakuOS's CachyOS-based 7.3.1 kernel, with our signed drivers built for it.
  • Secure Boot: new installs enroll the RakuOS key reliably again, so the blue MOK screen shows on the first boot.

From Fedora 45

RakuOS 45 is built on Fedora 45, so you also get what's new there:

  • GNOME 51 on the GNOME edition and Plasma 6.8 on KDE.
  • RPM 6.1, which rejects packages whose signature it can't verify by default. Packages from your configured repos are checked as always; installing a downloaded .rpm with rum works as before.
  • Repo files and signing keys move to /usr. Fedora's packaged repo definitions now live in /usr/share/dnf5/repos.d and its keys in /usr/share/pki/rpm-gpg, instead of /etc. rum already reads both, and repos you added or edited yourself stay in /etc and still take precedence.
  • A new toolchain: GCC 16.2, binutils 2.47, glibc 2.44, GDB 17.2, LLVM 23, Go 1.27, Python 3.15, Perl 5.44, Lua 5.5 and Erlang/OTP 27.
  • For developers: setuptools 82 removes pkg_resources, so older Python code that imports it needs the python-setuptools80 fallback Fedora provides; Node.js streams install through new nodejs-* selector packages with no single default; and CMake's %cmake macro drops a few non-standard variables such as LIB_SUFFIX.
  • OpenSSL 4.0. RakuOS also ships OpenSSL 3's libraries next to it (openssl3-libs), so apps built for OpenSSL 3, like .NET apps such as Remote Desktop Manager, keep working.
  • Fontconfig 2.18, and chpasswd and newusers now follow the system's PAM password rules.
  • Podman 6, which drops slirp4netns, cgroups v1 and the BoltDB backend.
  • Debugging other users' processes is restricted by default (ptrace); installing debugging tools restores it.
  • NetworkManager supports IPv6-mostly networks by default, and IBus 1.5.35 handles keyboard layouts better on Wayland.
  • Newer defaults for MySQL (9.7), MariaDB (12.3), Ruby on Rails (8.1) and Pandas (3).
  • Two old VPN plugins are retired: NetworkManager-vpnc and NetworkManager-fortisslvpn. Fedora 45's NetworkManager replaces them, so they're removed when you move to RakuOS 45. Fortinet SSL VPNs work with NetworkManager-openconnect, and Cisco IPsec (vpnc) connections with NetworkManager-libreswan. See After updating.

Fedora 45's switch to oo7 and kmscon arrived on RakuOS staging ahead of time, so they're already covered above.

Since RakuOS 44

RakuOS 44 (May 2026, archived announcement) was our first proper stable release. Here's how 45 compares where it matters:

  • Your packages. RakuOS 44 shipped with dnf and kept your apps in a writable overlay, which it preserved across image updates and patched up after each one in the background. RakuOS 45 ships rum, and your apps live in read-only package layers: installs are live and atomic, any change can be undone, and updates are prepared before you reboot instead of reconciled afterwards.
  • Moving to the new release. Going from 43 to 44 rebuilt your packages on the first boot, with the network connected. Going from 44 to 45 does that once more, to move your apps into package layers. From 45 on, a new release is prepared while the update runs, so the first boot of RakuOS 46 won't reinstall anything.
  • Drivers. RakuOS 44 compiled drivers, NVIDIA included, into each image at build time. RakuOS 45 ships them as prebuilt modules signed with the RakuOS key, with the kernel locked down to signed modules only and Secure Boot supported (you enroll the RakuOS key once, on the first boot). The image now ships only the drivers most machines need (NVIDIA on -nvidia images, Broadcom Wi-Fi, the virtual camera); Xbox controllers, racing wheels and other extras install from RakuOS System › Drivers (most need Terra turned on).
  • Security. RakuOS 44 used SELinux. RakuOS 45 uses AppArmor, with lockdown and signed modules as above, and checks the requirements for Easy Anti-Cheat Linux v2 with rakuos eac-check.
  • Desktops. RakuOS 44 shipped GNOME 50, Plasma 6.6, COSMIC 1.0.13 and the CachyOS 7.0 kernel. RakuOS 45 brings GNOME 51, Plasma 6.8, COSMIC 1.11.0 and the 7.3.1 kernel, and adds two editions: niri and Hyprland, each with an ISO.
  • What 44 promised. RakuOS 44 named three things it would work on next. The pure gamescope edition exists now, for gaming PCs and handhelds like the Steam Deck (switch to it from an installed system; it has no ISO yet). The Enterprise Linux editions and the Bigscreen edition are still on the list.

After updating

  1. Keep the network connected on the first start. Moving to RakuOS 45 rebuilds your installed apps for Fedora 45 and moves them into package layers. The boot screen shows "Installing user applications…"; it happens once.
  2. Local .rpm files and your own software: packages you installed from downloaded .rpm files are reinstalled from the copies RakuOS keeps. Scripts or programs you installed straight into /usr before won't carry over; reinstall them with sudo rum layer-run local -- ….
  3. If you used a vpnc or Fortinet SSL VPN, recreate the connection with the replacement plugin: sudo rum install NetworkManager-openconnect for Fortinet, or sudo rum install NetworkManager-libreswan for Cisco IPsec. Fedora's migration guide walks through the settings.
  4. If something you rely on writes into /usr (a patcher, an installer script), run it through rum layer-run, as explained in Package Layers.

If anything goes wrong, pick the previous image in the boot menu, or run sudo bootc rollback and reboot. Going back to RakuOS 44 reinstalls your apps for it once on its first start, which needs the network and only works while the RakuOS 44 repos are still up (see Support and end of life). Then tell us on Discord or at rakuos.org/bugs. For every change, see the RakuOS 45 changelog.

Thanks

To everyone testing on staging and reporting what broke, to our maintainers for the Niri, Hyprland and COSMIC images, and to the Fedora Project for Fedora 45.