---
title: "Why a general-purpose distribution is the wrong base for AI"
url: "https://kyberlinux.com/blog/why-a-general-purpose-distro-is-the-wrong-base"
description: "A distribution built to run everything is a poor foundation for a machine that runs one thing. The cost is not disk space — it is patching, auditing and blast radius."
---

# Why a general-purpose distribution is the wrong base for AI

September 1, 2026·3 min read·Kyber Linux

A general-purpose distribution is a remarkable piece of engineering: it will run a laptop, a web server, a build farm and a router, and it will do all of that with packages maintained by people who care. It is also the wrong foundation for a box whose entire job is to run one inference workload — and the cost of using it anyway is not disk space, which nobody cares about, but patching, auditing and blast radius, which everybody eventually does.

## What you actually inherit

Install a standard server image on a device that does inference and count what you got.

A package manager and its dependency graph. A display or printing stack, often present because something else pulls it in. Two or three scripting language runtimes. Init scripts for services that will never start. A mail transfer agent, sometimes. Utilities for filesystems the device does not have.

None of that is wrong of the distribution — it is doing its job. It is simply not your job.

## The three costs

**Patching.** Every component is a subscription to somebody else’s security advisories. A vulnerability in a library you do not use still generates a ticket, a change window and a regression risk, because proving you do not use it costs more than updating it.

**Auditing.** Someone eventually asks what runs on the device. With a general base the honest answer is a package list of over a thousand entries and a shrug. With a minimal one the honest answer is a short list you can walk through in a meeting.

**Blast radius.** The interesting property is not whether a component has a vulnerability but what an attacker reaches from it. On a general system, a foothold lands next to interpreters, package tooling and a writable filesystem. On a minimal read-only one, it lands next to almost nothing.

## Subtraction is harder than it looks

The obvious response is to strip a general distribution down, and everybody tries this first. It works, once. The problem is that it does not stay stripped.

An update pulls in a recommended dependency. A new team member installs a debugging tool that stays. A driver requires a library that requires three more. Six months later the image is back to being general-purpose, and the hardening someone did in week two has quietly eroded.

Assembling upward from a declared minimal base inverts that. The image is a definition rather than a starting point that has been edited, so the only way to add something is to say so in a file that gets reviewed.

## Where general-purpose is still right

Worth being honest, because this is not an argument against distributions.

If the machine’s job is undefined, a general base is correct — that is exactly what it is for. Development machines, shared servers, anything a human logs into and works on. Flexibility has real value when you do not know what tomorrow needs.

The case for minimal is narrower: the workload is known, the hardware is constrained, the machine has no keyboard, and nobody is going to log in to fix it. Which happens to describe every device the Kyber family runs on — a deck in a pocket, a controller on a robot, a small server on a shelf.

## The property that matters most

If you take one thing: **what is not in the image cannot be exploited, cannot break and does not need patching.**

That sentence is the whole argument for minimalism, and it holds regardless of how good the distribution you started from is. Subtraction is the only security technique with no runtime cost and no clever failure mode — which makes it a strange thing for our industry to spend so little time on.

-   minimal images
-   attack surface
-   distributions
-   edge

## Keep reading

-   [Immutable, verified, boring](https://kyberlinux.com/blog/immutable-verified-boring)
-   [The power budget is the design constraint](https://kyberlinux.com/blog/the-power-budget-is-the-design-constraint)