Everything paradox 0.3 does, what you type to make it do it, and an honest list of what it can't do yet.
This is an archived handbook. It documents paradox 0.3, which is no longer the current version, and it will not be edited again — so that anyone still running 0.3 has documentation matching the software in front of them.
paradox is a Linux distribution built with the Linux From Scratch method — every package compiled from upstream source rather than pulled from another distribution's archive. There is no Debian, no Arch and no Red Hat underneath it.
You need:
paradox is built to run on old hardware and new. The base is compiled so that performance-critical libraries detect the processor at runtime and take the fast path where the hardware allows and a safe one where it doesn't — so a decade-old Celeron and a current Ryzen both run the same image without one of them crashing. new in 0.3
There is still no ISO. No installer image has been built for any release so far, and every paradox machine in existence was made by cloning an existing disk. ISO tooling is the next major piece of work — the kernel now carries the squashfs, overlayfs and loop support a live image needs new in 0.3, so the groundwork is in place, but the image itself does not exist yet.
For scale, when images do appear: the base system is roughly 3.6 GB installed, and the networking firmware adds about another 677 MB. A compressed server image should land somewhere around 1.4–1.7 GB.
If you already have a paradox machine in front of you, carry on to the next section.
paradox boots UEFI through GRUB. There is no initramfs — the kernel finds the root
filesystem by PARTUUID on its command line, which is why the cmdline reads
root=PARTUUID=… rather than the more usual filesystem UUID.
The boot menu is now an editable file at /boot/grub/grub.cfg rather than
being baked into the EFI binary. new in 0.3 The EFI stub is a small redirector that points
at it, which means changing a boot entry no longer means rebuilding the bootloader.
The kernel is 6.18.10-pdx, built for paradox with the networking,
firewall and filesystem support the system relies on. new in 0.3
Boot is quiet by design (quiet loglevel=3). You will see very little
before the login prompt, which is intentional rather than a sign something stalled.
paradox linux (aurora)
Kernel 6.18.10-pdx on an x86_64 (tty1)
paradox login: pdxadmin
Password:
reality is optional
aurora · 0.3
pdxadmin@paradox:~$
Log in as pdxadmin. The mirror banner prints and you land at a shell.
The system identifies itself in /etc/os-release, which reads
VERSION="0.3 (aurora)" — the reliable place to check which release a machine
is running.
Every colour in paradox is deliberate. The rule the theme follows: the colours that tell you who you are stay separate from the colours that tell you what a file is, so nothing is ambiguous at a glance. The hostname is blue rather than cyan specifically so it is never mistaken for a directory.
Root and a normal user differ in exactly one way — the username colour. Yellow means you are root and should be paying attention.
pdxadmin@paradox:~$ whoami pdxadmin root@paradox:~# whoami root
ls is aliased to always use colour. The palette is the "aurora spectrum":
root@paradox:~# ls script.sh test_folder test.txt backup.tar.xz wallpaper.png
The MOTD is the wordmark, a divider, and the wordmark reflected and dimmed beneath it — which way is up. The banner is bright cyan and its reflection a dimmer cyan, reality is optional sits below in yellow, and the release line reads aurora in magenta beside the version in white.
Search matches highlight in magenta. nano is themed to match — cyan title bar with white text, cyan line numbers, bright cyan shortcut keys — and comes configured with line numbers, syntax highlighting, soft wrap, auto-indent, and 4-space tabs that insert spaces.
The Linux text console can only display 16 colours. The prompt and banner are written in 16-colour codes so they are exact, but the file listing palette uses 256-colour codes and will look approximate on the console. Over SSH or in a graphical terminal you see the real thing.
The default account is pdxadmin, uid 1000, password paradox.
It belongs to the wheel group, which is what grants sudo.
Change that password before the machine is on a network you don't control. It is published in this handbook, which means it is not a secret.
pdxadmin@paradox:~$ passwd Changing password for pdxadmin. Current password: New password:
Administrative commands go through sudo, which asks for your password
every time. The paradox- tools are run as your normal user — they ask for
your password themselves at the point they need it, rather than requiring you to
remember to prefix them.
Wi-Fi works. new in 0.3 This is the headline of 0.3 and the thing that changes what paradox can be installed on — a laptop with no ethernet port is no longer a dead end.
Two commands cover almost everything. Both are run as your normal user, both figure out the hardware themselves, and both ask for your password only when they are about to change something.
Run it with no arguments and it scans, lists what it found, and connects to whichever
you pick. A network marked psk asks for its passphrase — typed blind, nothing
echoes back. Networks marked open connect straight away.
Once you have joined a network it is saved, so it reconnects on its own after a reboot and will not ask again.
pdxadmin@paradox:~$ paradox-wifi ↻ paradox-wifi scanning the airwaves on wlan0… 1 aurora-5G psk ●●●● (connected) 2 aurora psk ●●●● 3 nebula-guest psk ●●● 4 quasar_lab open ●●● 5 pulsar-2G psk ●● 6 corona_house psk ●● pick a network [1-6] (q to quit): 3 ↻ paradox-wifi connecting to nebula-guest… Passphrase for nebula-guest: (hidden) ✓ connected to nebula-guest radio wlan0 state connected network nebula-guest ip 192.168.10.36/24
The other things it does:
paradox-wifi status — radio, state, network and addressparadox-wifi --disconnect — drop the current connection but keep the network saved, so it reconnects next bootparadox-wifi --forget-networks — erase every saved network, so the machine stops connecting on its ownUnderneath it is iwd, which runs its own DHCP client — there is no
separate DHCP daemon to configure or fight with.
Wired ethernet uses DHCP out of the box and needs no attention. When you want a fixed
address — which on a machine running SSH you usually do — paradox-wired
walks through it and writes the systemd-networkd configuration for you.
pdxadmin@paradox:~$ paradox-wired 1 enp2s0 down 2 enp3s0 up 192.168.10.107/24 pick a nic [1-2] (q to quit): 1 ✎ paradox-wired static ip on enp2s0 ip address : 192.168.10.10 subnet (24 or mask) : 24 gateway (blank=none): 192.168.10.254 dns, comma-separated: 1.1.1.1,8.8.8.8 will write /etc/systemd/network/00-paradox-enp2s0.network: [Match] Name=enp2s0 [Network] Address=192.168.10.10/24 Gateway=192.168.10.254 DNS=1.1.1.1 DNS=8.8.8.8 … if enp2s0 is the link you're on, this can drop the session — reconnect on the new address. apply this? [y/N] y [paradox] password for pdxadmin: ✓ applied static 192.168.10.10/24 on enp2s0
paradox-wired status — list the wired interfaces and their addressesparadox-wired --dhcp — hand a port back to automatic addressingRead the warning it prints before answering yes. If you are connected over the port you are reconfiguring, applying the change drops your session and you reconnect on the new address — worth thinking about before doing this remotely over the only link you have.
The base ships firmware for the common Wi-Fi families — Intel, Atheros, Realtek, Broadcom, MediaTek and Marvell — along with wired NIC blobs, Bluetooth, Intel graphics and the wireless regulatory database, so most machines get online without hunting for anything. It is about 677 MB, and it is the reason a from-scratch distribution can be plug-and-play at all.
Everything else upstream ships — AMD and Nvidia graphics, server SmartNICs, audio and
SoC firmware — is available as linux-firmware-extra in the repository rather
than sitting unused in every install.
paradox now comes up firewalled on every boot. new in 0.3 The policy is default-drop on input: unless a rule allows it, incoming traffic is discarded.
What is allowed:
Outbound traffic is unrestricted, and forwarding is off.
pdxadmin@paradox:~$ systemctl status nftables Loaded: loaded (nftables.service; enabled) Active: active (exited) pdxadmin@paradox:~$ sudo nft list ruleset
Default-drop means anything you host yourself is unreachable until you say otherwise. Start a web server, a game server or a database, connect from another machine, and it will simply hang — the service is running fine, the firewall is discarding the packets before they arrive.
Rules live in /etc/nftables.conf. Add a port alongside the existing SSH
line, then reload:
pdxadmin@paradox:~$ sudo nano /etc/nftables.conf tcp dport 22 accept tcp dport 8080 accept # check it parses before loading pdxadmin@paradox:~$ sudo nft -c -f /etc/nftables.conf pdxadmin@paradox:~$ sudo systemctl restart nftables
Check the file with nft -c -f before loading it. A syntax error in a
firewall you are editing over SSH is a bad way to end an evening.
Software is managed with paradox, a wrapper over the pacman package
engine. The verbs are themed; plain synonyms work identically, and any extra arguments
pass straight through.
| command | does | plain form |
|---|---|---|
| paradox glitch <pkg> | install a package | install |
| paradox collapse <pkg> | remove a package and its orphaned dependencies | remove |
| paradox shift | sync the database and upgrade everything | update / upgrade |
| paradox refresh | refresh the package database only | sync |
| paradox seek <term> | search the repository | search |
| paradox info <pkg> | show package details | — |
| paradox list | list installed packages | — |
| paradox help | print the menu | -h / --help |
Packages are served from a self-hosted repository at
repo.paradoxlinux.com, backed by Cloudflare R2. Each arrives as a
.pkg.tar.zst archive with a detached GPG signature, and
SigLevel = Required means an unsigned or badly signed package is refused
rather than installed.
The public key is published at
repo.paradoxlinux.com/paradox-linux.gpg. Verify it against the fingerprint
before trusting it:
0956915D16CAA24FD62E 8750 2D94 217B AAB7 6E21 0956 915D 16CA A24Fparadoxadmin <paradoxlinuxadmin@gmail.com>The private key lives only on the build host and is never shipped in the system.
Eighteen signed packages, up from one in 0.2. Everything is built from source with its own PKGBUILD rather than repackaged from elsewhere.
pdxadmin@paradox:~$ paradox seek tmux paradox/tmux 3.5a-1 pdxadmin@paradox:~$ paradox glitch tmux resolving dependencies... Proceed with installation? [Y/n] ✓ tmux 3.5a-1 installed
Downloads now go through curl rather than pacman's own sandboxed downloader, which was unreliable on some hardware — a change you will not notice except that transfers stop hanging. new in 0.3
"No bloat" is only useful if you know what you actually have. This is the tour.
Everyday tools that used to be missing now build as signed packages and ship in the base:
nano, and only nano. vim is not installed. If you are a vi person that is the first thing you will want to change — and now that the repository has eighteen packages in it, building one is a reasonable request rather than a project.
No desktop, no display server, no audio stack, no printing, and no vim. Bluetooth firmware is present but nothing is configured to use it. Nothing runs that you did not start.
paradox runs systemd, so services and logs behave the way they do on any modern distribution. Only a handful of the enabled units are paradox's own choices rather than systemd defaults.
The rest are systemd's own presets: oomd, pstore, sysext, confext, udev credentials and the journald sockets.
pdxadmin@paradox:~$ systemctl status sshd pdxadmin@paradox:~$ systemctl list-unit-files --state=enabled pdxadmin@paradox:~$ journalctl -b -p err pdxadmin@paradox:~$ journalctl -u iwd -f pdxadmin@paradox:~$ sudo systemctl poweroff
Kept current for every release, because finding this out at eleven at night is worse than reading it now.
Things that have actually caught someone out.
paradox-wired warns you before it applies. On a machine with Wi-Fi as well, the wireless connection stays up as a way back in.--disconnect keeps the network saved on purpose. Use --forget-networks if you want it gone.root=PARTUUID=….rootwait — USB enumeration is slower than the kernel's patience./var/lib/pacman/db.lck; delete it before retrying./etc/ssl goes missing, downloads fail in ways that look like the network is down./usr/bin/paradox — the package manager wrapper/usr/bin/paradox-info — system information/usr/bin/paradox-wifi · /usr/bin/paradox-wired — the network tools new in 0.3/etc/bashrc — the prompt, LS_COLORS, GREP_COLORS and the aliases/etc/motd — the mirror banner/etc/nanorc — the nano theme and behaviour/etc/os-release — version and identity/etc/pacman.conf — repositories and signature policy/etc/nftables.conf — the firewall ruleset new in 0.3/etc/iwd/main.conf — Wi-Fi daemon configuration new in 0.3/var/lib/iwd/ — saved wireless networks new in 0.3/etc/systemd/network/ — wired configuration; paradox-wired writes 00-paradox-<nic>.network here new in 0.3/boot/grub/grub.cfg — the editable boot menu new in 0.3/etc/ssl/certs/ca-certificates.crt — the CA bundle/etc/fstab — root by filesystem UUID with noatime, ESP at /boot/efiGPT with two partitions: a FAT EFI system partition and an ext4 root. The kernel
command line is root=PARTUUID=… rootwait ro quiet loglevel=3.
The release where paradox learned to get online anywhere. A rebuilt kernel brought the networking stack to life, Wi-Fi works end to end, a firewall comes up at every boot, and the base was made portable enough to run on old processors as well as new ones.
6.18.10-pdx, built for the hardware paradox actually runs onparadox-wifi and paradox-wired — in-house network toolslinux-firmware-extraUnchanged from 0.2: the LFS method and toolchain, the partition and UUID layout, the users and groups, the init system and the colour theme apart from the version string.
The release where the package manager became real — a live signed repository, a published key, and the first package installed end-to-end. Read the 0.2 handbook.
The first bootable state — base LFS, the console theme, and a package manager with nowhere to fetch from. Read the 0.1 handbook.
Every version → — each release, its handbook, and whether an image exists