Bor: My Side Project - Wed, Jul 22, 2026

An introduction to Bor — an open-source policy management platform for Linux desktops, why continuous enforcement matters for compliance and security, and where it fits in the EU's move toward Linux in the public sector.

This blog does not get updated very often, and there is a simple reason for that: most of my free time goes into a side project called Bor. After more than a year of evenings and weekends spent on it, it deserves a proper introduction here.

The Bor policy management console

What is Bor

Bor is an open-source policy management platform for Linux desktops. The core idea can be summarized in one sentence: define, distribute, and enforce desktop configuration policies across a fleet of machines — in real time.

Windows administrators have had this for decades in the form of Group Policy. On Linux, the equivalent simply did not exist as a cohesive tool: configuration is scattered across dconf, KConfig, polkit, browser policy files, and package managers, and every organization ends up gluing these together with scripts. Bor turns them into centrally managed, versioned policies:

Why it matters: compliance and security

Managing desktops is ultimately a security exercise, and this is where most of the engineering effort has gone:

These are not checkbox features. Regulations such as NIS2 now apply to a very broad set of organizations in the EU, and they require demonstrable control over endpoint configuration, auditability, and incident visibility. A fleet of Linux desktops managed by ad-hoc shell scripts cannot demonstrate any of that.

The EU moment

The timing for a tool like this is not accidental. The European public sector is in the middle of a genuine shift toward Linux and digital sovereignty. The EU OS initiative — started by Robert Riemann of the European Data Protection Supervisor — proposes a standardized Linux desktop for public administrations. France went further: DINUM announced that government workstations will move away from proprietary operating systems, with every ministry required to present an implementation plan by autumn 2026 — following earlier moves like Schleswig-Holstein’s migration in Germany.

Migrating hundreds of thousands of desktops to Linux is the visible part. The less visible part is the question every IT department asks on day two: how do we manage them? The Windows world answers with Group Policy and Intune; a sovereign Linux desktop needs an equivalent that is self-hosted, open source, and auditable. Bor is licensed under LGPLv3, runs entirely on-premises with no cloud dependency, and integrates with the directory services these organizations already operate (FreeIPA, Samba/AD, LDAP). That is precisely the profile that sovereignty-driven procurement is looking for.

Why not just Ansible?

This is the most frequent question I get, so it earned a slide of its own at TuxCon 2026. Infrastructure-as-code tools — Ansible, Puppet, Salt — are excellent at what they are built for: provisioning. Bor is not trying to replace them; it occupies a different layer: continuous enforcement. The difference matters most exactly in the environments governments and schools operate:

The two categories compose well: use Ansible to install the OS and the Bor agent, then let Bor own the desktop configuration for the rest of the machine’s life.

Where to look next

The project is developed in the open by Vute Tech and contributors:

Issues, pull requests, and feedback are very welcome. And if your organization is looking at the post-Windows era on the desktop — I would genuinely like to hear what policy types you need next.

Comments

Back to Home