(As reader may guess, I'm more familiar & comfortable in the Linux/POSIX world, so please keep that in mind)
I'm in the process of rebuiling n+20 laptops, intended for semi-public use (MakerSpace: think classroom or library), and want to set them up in an immutable/ephemeral manner.
I want them to be 'flushed' periodically, so that they are all similar/standard, and clean for the next persons' use.
Users/guests constantly log into the desktops an/or browsers with their personal gmail/o365 accounts, which has us/my environ represent a privacy & security risk.
The game-plan looks like:
- set up a base-line or reference (W10) desktop with
- stripped-down OS, with updates , patches & system-level tweaks applied
- relevant accounts loaded - logons & browsers logged into relevant web-apps (cookies loaded), etc
- using the likes winget, choco/vagrant/ansible/puppet/chef/whatever/etc to install our standard app set
- setting up local server/'cloud' back-end for docker/VM's/etc to rapidly try out options
- PXE imaging & deployment tool - Foreman, FOG, etc
- Guests/users store configs & personal data on LAN NAS (ala NextCloud)
- image or build periodic reference snapshot of reference-machines (including updates) that get deplyed via PXE
Essentially what I'm after is something akin to Fedora Silverblue, that's an immutable/ephemeral desktop, where nothing "sticks" across reboots & the underlying remains unchanged. Thinkig of it in a similar way Docker images have changes "layered" on top of each other or a ZFS or Git, where changes are taken as incremental snapshots that can be committed or rolled back gracefully.
I/we have not comitted to AD yet - the environment has not been large or complex enough to warrant it yet - but I know the short answer is to use GPO; I plan on burning that bridge eventually.
Is there a way or some other best-practice means for me to achive this goal? How can I build an OS or image that gets nuked - from the ground up - across reboots, to the point where the HDD's are interchangable & no update are ever promped?
