I’m not an expert, but OpenBSD may be a wildcard option. I’ll leave considering that to somebody else.

As others have suggested, QubesOS is a good one to have on your list. I’d probably use if it weren’t for its crippling effects on battery life.

Immutable distros are much friendlier to laptops and, as I understand, update in a way not unlike an Android device would. But I insist on some system-level customizations and I haven’t been motivated to learn how such customizations can be made to survive updates and the like.

I’ve also been eyeing NixOS, but with everything up and running on Debian smoothly for a few years, I haven’t found the excuse to switch yet. Along with customizing it to be a comfortable daily driver, I’ve also been trying to see how secure I can make my system as a fun exercise. While it’s not immutable, Debian is a good base considering the team behind it and how much is riding on its security, including internet-facing servers.

What I’ve done to harden Debian, if anyone’s interested:

• Apply Madaidan’s hardening guide judiciously. Roughly 2/3 of the measures made sense for my use case and it’s almost unnoticeable in my daily workflow.
• Have as few closed-source components as possible. In my case, intel-microcode is the only non-free package on my system.
• Install the hardening-runtime package, but remove its included slub_debug=FPZ kernel argument, which in recent kernels forces less secure unhashed pointers.
• XFCE is still not fully ported to Wayland, so I use slock, the X11 screen locker with fewest lines of code.
• Install the ufw firewall and default to deny
• Enable unattended-upgrades
• Everything including the /boot partition is encrypted. I have built coreboot with just the GRUB2 payload, which I configured to immediately bring up the LUKS password prompt. All other options are behind a password.

I also put together and maintain a ~16 GB clean system image of Debian set up exactly to my taste, which I clone to my machines as needed. This probably wouldn’t have been a thing if I knew about NixOS earlier, and it certainly hasn’t helped me switch over either.

Security? Qubes! https://www.qubes-os.org/

gentoo is secure

Honestly id argue Debian stable is the most secure as long as the apps your using are getting security hotfixes backported. Since you get all the security fixes and none of the new features that tend to be where new security holes pop up. Combine that with good opsec in general, and your basically good to go.

One thing tho. Some people use them interchangably but is your focus security or privacy? Security being harder for bad actors to exploit something on your system, and privacy being strict control over your data.

Why not test Secureblue instead of Silverblue?

I like stability and cleanliness. Security by default. Least mental load possible long-term.

Excellent breakdown of your desires! FWIW, I definitely resonate with these as well.

I’m currently testing out NIXos. Next will be VanillaOS, 3rd will be Fedora Silverblue.

One simply can’t ignore the fact that these are so-called atomic distros. Which makes a ton of sense considering what you set out for. FWIW, my personal takes on the individual projects are as follows:

• NixOS is pretty excellent. If the epitome of cleanliness is reached with becoming stateless, then there’s simply no other viable alternative.
• For VanillaOS, I feel it has yet to fully realize its promise. Or, at least, hasn’t fulfilled whatever’s required to break into the (relative) ‘mainstream’ for one reason or another.
• Fedora Silverblue has been my daily-driver in some shape or form over the last three years 😅. As such, I’m clearly biased. However, I’d reckon secureblue, i.e. a derivative that goes all-in on security, is actually more interesting for you.

Anyone have good recommendations? Easy backups, stability, security first posture, least maintenance and memory load. I hate getting scattered in symlinks, scripts, and filesystem placing.

Honestly, with Fedora Atomic and Nixos, you’re already considering the very best at the job. Though, for completeness’ sake, consider looking into openSUSE Aeon as well. While I’d argue the other two are currently more interesting, I wouldn’t want to dismiss it altogether.

Beyond these, we find some other distros that miss something crucial for them to be considered a legit candidate/alternative:

• Guix System can put up a decent fight against NixOS and may even sway you over if you’re into lisp. Unfortunately, though, it has yet to receive what flakes brought to the table for NixOS. Don’t get me wrong; Guix’ implementation of channels is vastly superior over Nix’ and therefore Guix System doesn’t gain as much from its (to be) flake counterpart. However, with flakes, NixOS becomes pretty smooth sailing. Like, you can just trust it to work reliably. With Guix, however, it can get ugly sometimes. Which can even lead the biggest Guix proponents back to NixOS…
• Kicksecure is another hardened-by-default distro worth mentioning. Sadly, unlike secureblue, it does nothing with atomicity.

What are some pros and cons of different distros?

This is too broad of a question 😅. If possible, narrow it down to some face-offs you’re particularly interested in. After which I will try to help out if I can. Btw, I ‘found’ this comment that attempts to assign tiers to distros in terms of how they fare security-wise.

What do you daily drive as a power user?

Without going over what a power user is and/or if I would even qualify as such, I’ve been daily-driving secureblue for over a year now.

Give me your thoughts and recommendations! Thanks.

At this point, I think both NixOS and secureblue pose as the most interesting candidates for ya. The former peaks in cleanliness, while the latter peaks in security.

Fedora’s Anaconda system makes UEFI secure boot easy and ships with SELinux integrated but set to permissive by default. Their built in network filtering tools are pretty easy but I still just use OpenWRT on a separate device. Silverblue was nice for a few years but I switched to Workstation for a machine with Nvidia hw.