Monolith is my personal Fedora Atomic desktop image, built with BlueBuild on top of Universal Blue’s main images. It keeps the base close to Fedora Atomic while adding my preferred desktop defaults, system Flatpaks, gaming tools, Tailscale, Brave Origin, and layered Steam support. Every edition runs the CachyOS kernel. Images are rebuilt automatically and published to my Forgejo registry for rebasing or ISO generation.

Pick your edition

Monolith offers GNOME, KDE Plasma, and COSMIC. Choose the standard image for AMD, Intel, or the open-source Nouveau/NVK NVIDIA stack; choose the NVIDIA image for the packaged NVIDIA driver on a Turing-or-newer GPU (GTX 16-series, RTX 20-series, and newer).

Edition	Image	Use this if…
GNOME	gnome	GNOME with the standard Mesa graphics stack.
GNOME — NVIDIA	gnome-nvidia	GNOME with the NVIDIA open driver built for the CachyOS kernel.
KDE	kde	KDE Plasma with the standard Mesa graphics stack.
KDE — NVIDIA	kde-nvidia	KDE Plasma with the NVIDIA open driver built for the CachyOS kernel.
COSMIC	cosmic	COSMIC with the standard Mesa graphics stack.
COSMIC — NVIDIA	cosmic-nvidia	COSMIC with the NVIDIA open driver built for the CachyOS kernel.

All images live under forge.waywardinn.com/monolith-os/. In the commands below, replace <edition> with the image name from the table (for example, gnome or gnome-nvidia).

All other historical editions have been retired. Anyone tracking an image not listed above must choose one of these six images to keep receiving updates:

# Replace gnome with the desired image name from the table.
rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/gnome:latest
systemctl reboot

Rebasing

To rebase an existing atomic Fedora installation to the latest build of your chosen edition:

• First rebase to the unsigned image, to get the proper signing keys and policies installed:

  rpm-ostree rebase ostree-unverified-registry:forge.waywardinn.com/monolith-os/<edition>:latest
  

• Reboot to complete the rebase:

  systemctl reboot
  

• Then rebase to the signed image, like so:

  rpm-ostree rebase ostree-image-signed:docker://forge.waywardinn.com/monolith-os/<edition>:latest
  

• Reboot again to complete the installation

  systemctl reboot
  

The latest tag will automatically point to the latest build. That build will still always use the Fedora version specified in your edition’s recipe (recipes/recipe-<edition>.yml), so you won't get accidentally updated to the next major version.

After the final reboot, run the adoption helper once per user account:

ujust monolith-adopt

Fresh installs don't need it, but rebased systems do: it installs the /etc/skel defaults your pre-existing account never received (notably the topgrade config that points system updates at bootc instead of dnf) and rebuilds the fontconfig cache, which can survive the rebase stale and break emoji rendering. Your old topgrade config, if different, is backed up next to the new one.

Optional software

Run the interactive per-user software manager:

monolith

It groups optional software into Developer CLIs (Tea, Superfile, nak, and ngit) and AI coding tools (Claude Code, Codex CLI, OpenCode, and Herdr). Choose an unchecked item to install it, or choose a checked item to remove it. The manager owns only program files under your home directory, so removal keeps authentication, settings, sessions, and project files. The shorter ujust monolith, ujust software, and the legacy ujust monolith-software names open the same menu.

The underlying command also supports scripting and troubleshooting:

monolith list
monolith install codex herdr
monolith update
monolith remove codex

Secure Boot

Every edition is Secure Boot capable. Because Monolith swaps in the CachyOS kernel (which Fedora doesn't sign), that kernel is signed at build time with Monolith's own key. The NVIDIA editions use the same key for their out-of-tree driver modules. The public cert ships inside the image, so to boot with Secure Boot enabled you just enroll that key once as a Machine Owner Key (MOK).

The steps are the same whether you installed from a Monolith ISO or rebased onto a Monolith image (the ISO itself is Secure-Boot-agnostic — it just installs the signed image). After install, run:

ujust enroll-monolith-secure-boot-key

Reboot, and the blue MokManager screen appears: choose Enroll MOK → Continue, then enter the password monolith. That's it; Secure Boot works from then on.

If you don't use Secure Boot (it's disabled in your firmware), there's nothing to do. The enrollment password is not a secret — it's only typed once at the MokManager screen to confirm a human at the console is approving the key.

Verification

These images are signed with Sigstore's cosign. You can verify the signature by downloading the cosign.pub file from this repo and running the following command (substituting your edition):

cosign verify --key cosign.pub forge.waywardinn.com/monolith-os/<edition>