u/sudonem

I need to build out a small number of based Linux based workstations.

The users will not have elevated sudoer permissions (and certainly not direct permissions to manage dnf/apt package installations) but I still need a way to enable them to install/uninstall system packages from a pre-approved list (similar to how MS Intune’s Company Portal works for windows or the jamf self service app for macOS) without having to create support request tickets.

The only options I’ve seen that come close are full MDM platforms (which is probably what we need eventually but would be super overkill for the moment given the small number of users and unlikely to get approval)

I did look at customizing the Gnome Software app to only look at custom repos. but that’s a non-starter. BaseOS and AppStream have to stay enabled for system updates - and Gnome Software always looks at the enabled dnf/apt repos - so I couldn’t hide those and prevent the user from installing packages from those repos this way.

So before I just go build something custom (as I suspect I will need to) I am hoping to hear recommendations for existing tools that I may not have found while searching.

Its not critical that it be FOSS, but I’ll have an easier time getting buy in if it’s narrowly scoped to this specific use case - and not a ton of other features we don’t want or need.

Thanks in advance!

**edit:** Just to clarify - I don’t need advice on how to build something custom here. I have that covered.

Specifically I am just looking for recs on tooling for this use case that might already exist so I’m not needlessly reinventing the wheel.

I find myself in the odd position of joining a team of platform engineers that… aren’t engineering a platform.

The organization is absolutely large enough to justify it, and they are struggling to scale without just adding headcount because (from what I can see) the bulk of the effort is just building disparate glueware rather than a focused effort to standardize… anything.

The current environment components (and a strong desire to self host as much as possible) has me looking at Backatage as a solution I might pitch. I’m very aware that it’s a non-trivial amount of work to stand up and maintain beyond day 1. That got me digging deeper and I came across OpenChoreo

So my actual question is just… is anyone actually using this in production?

Has anyone “migrated” from base Backstage to installing OpenChoreo? How has it gone? pros / cons?