Feature sets

This page answers "what does this base give me" at a glance: pick a base distribution and read across. Every column links to the page with the details. For image naming and how the tested matrix is built, see the Image support matrix.

The rows are the bases Kairos builds and tests in CI on master, plus openSUSE Leap 15.5 and 15.6, which CI no longer builds. Kubernetes (k3s and k0s, through provider-kairos) does not depend on the base, see Choosing a Kubernetes distribution.

Release status

CIS L1 hardening and SELinux are on kairos master and ship with the next kairos release after v4.3.0. Images built with v4.3.0 have neither.

By base distribution

Base	Trusted Boot (UKI)	SELinux	CIS L1	FIPS	System extensions
Hadron	✅	❌	✅	✅	✅
Ubuntu 20.04	🧪	❌	✅	⚠️1	❌
Ubuntu 22.04	🧪	❌	✅	⚠️1	❌
Ubuntu 24.04	✅	❌	✅	⚠️1	✅
Ubuntu 25.10	✅	❌	✅	⚠️1	✅
Ubuntu 26.04	✅	❌	✅	⚠️1	✅
Debian 12	🧪	❌	✅	🧪	❌
Debian 13	🧪	❌	✅	🧪	✅
Fedora 41	✅	✅	✅	✅	✅
Fedora 42, 43	🧪	✅	✅	🧪	✅
Rocky, AlmaLinux, Oracle Linux, CentOS Stream 9	🧪	✅	✅	🧪	❌
Rocky, AlmaLinux, Oracle Linux, CentOS Stream 10	🧪	✅	✅	🧪	✅
openSUSE Leap 16.0	🧪	✅	✅	🧪	✅
openSUSE Leap 15.5, 15.62	🧪	🧪	⚠️3	🧪	❌
Alpine 3.21, 3.23	❌	❌	✅	🧪	❌

Boards

All boards are arm64 only. Each column links to the board's install page.

Base	Raspberry Pi 3	Raspberry Pi 4	Jetson AGX Orin	Jetson Orin NX	Jetson AGX Thor	DGX Spark
Hadron	✅	✅	❌	❌	✅	❌
Ubuntu 20.04	✅	✅	❌	❌	❌	❌
Ubuntu 22.04	✅	✅	✅	✅	❌	❌
Ubuntu 24.04	🧪	🧪	❌	❌	✅	✅
openSUSE Leap 15.6, Tumbleweed	✅	✅	❌	❌	❌	❌
Alpine 3.19	✅	✅	❌	❌	❌	❌

Key

• ✅ Yes: supported and built or tested in CI, or documented on the linked page.
• ❌ No: not supported, or not documented for that base.
• ⚠️ With conditions: works, with the condition in the footnote.
• 🧪 Not tested: supported by kairos-init, but CI does not build or test that combination.

Footnotes

1. FIPS on Ubuntu needs an Ubuntu Pro subscription and extra packages, so kairos-init --fips refuses Ubuntu. Build it from the Ubuntu FIPS example for 20.04, 22.04 or 24.04 instead. There is no example for 25.10 or 26.04 yet. ↩ ↩² ↩³ ↩⁴ ↩⁵

2. Leap 15.5 and 15.6 are end of life upstream (December 2024 and April 2026), so CI only builds Leap 16.0. kairos-init still detects and builds them. Their systemd (249 and 254) is too old for system extensions. ↩

3. On Leap 15.5 and 15.6, pam-config does not know the pwquality module, so the CIS password quality rule is skipped and pam_cracklib stays in place. ↩