Algiz Linux is a High-Performance, Security-Focused Meta-Distribution of Artix Linux
- Arch Package Dictionary
- Archivist Tools
- Audio Frequency Tools
- Data Recovery Tools
- Document Tools
- Fix Arch Linux
- Media Tools
- A comprehensive manual.
- MAC address randomization via Macchanger.
- Low latency PipeWire audio processing.
- ALHP, Chaotic AUR and Flatpak repositories.
- Steam Proton GE prefix.
- ZFS compatiblity (for server preset only).
- Booster (mkinitcpio replacement).
- Battery life optimizations for laptops via TLP.
- System Tuner (laptop performance manager).
- Mimalloc (high-performance memory allocator).
- Tmpfs Overlay speeds up temporary directories and reduces disk I/O.
- Real-time audio processing.
- A Lynis system hardening rating of 80 on desktop and 78 for laptop.
This project is a combination of significant upgrades and micro-optimizations. I've implemented most of the known & esoteric Linux performance tweaks along with some original implementations. The philosophy behind this "meta-distribution" is to utilize current hardware features and resources generously (when needed) while increasing system hardness greatly beyond the default.
The configuration files sysctl.conf, limits.conf and grub are pre-configured for specific workloads. Depending on the variant chosen there's specific changes tailored for each. These presets are AMD/Intel, NVIDIA, Laptop, Performance, Server and AI. They can be chosen in the installer and by running the optional command post-installation.
Originally I was inspired by Luke Smith's LARBS which is why Algiz's installer is script-based rather than an ISO. This project is packaged similarly to an ISO due to the configurations and content being stored inside various archives. If you want to see what changes I've made you can view them here.
Algiz Linux implements comprehensive kernel hardening which increases security and performance. The system prevents privilege escalation attacks through restricted ptrace access and disabled unprivileged BPF operations, while eliminating core dump generation to prevent information leakage. Kernel debugging is restricted through pointer exposure protection and disabled SysRq functionality, with kexec disabled to prevent unauthorized kernel replacement. ASLR is enabled for memory protection against exploitation. NUMA balancing is disabled to eliminate automatic memory migration overhead.
RAM usage has the highest priority over swapping, keeping active data in memory reduces wear on the drive and increases system responsiveness. Swapping is still possible but only used when RAM is nearly filled. The VM subsystem is configured to reduce unnecessary memory compaction overhead while maintaining balanced VFS cache pressure for responsive file operations. HugePages are dynamically allocated on demand, providing up to 3968 large pages to reduce overhead and fragmentation for large memory workloads.
Zram Integration: The system configures a zram-based swap device /dev/zram0 to provide fast, compressed virtual memory. Zram allocation is dynamically set to 25% of total RAM. The device is initialized with mkswap and immediately activated with swapon. Compression is set to lz4, prioritizing high performance over maximum compression.
Tmpfs Overlay: Temporary directories are mounted as tmpfs with the following size limits:
/tmp– 5 GB/var/tmp– 1 GB/var/cache– 2 GB/home/$USER/.cache– 2 GB
Bind-mounted Directories: Essential directories are bind-mounted and remain on local storage:
/var/cache/pacman/home/$USER/.cache/paru/home/$USER/.cache/nvidia/home/$USER/.cache/mesa_shader_cache/home/$USER/.cache/mesa_shader_cache_db
Specified directories can be added in /bin/tmpfs-overlay
Garbage Collection:
-
Periodic cleanup: Removes files older than 10 minutes.
-
Safe removal: Ensures files in use are never deleted.
Network performance leverages BBR congestion control and cake queue management to improve performance and reduce latency. The TCP stack uses expanded buffer sizes and enables fast connection establishment. IPv6 is limited through restrictive ICMP and routing settings. NetworkManager is set to use dhclient for DHCP with hostname handling disabled along with DNS encryption via Mullvad.
Disk and SSD performance is tuned through scheduler and queue optimizations. SSDs use the mq-deadline scheduler for low-latency I/O, while HDDs use bfq for better fairness under mixed workloads. NVMe drives bypass the scheduler entirely (none) for maximum throughput. Read-ahead is increased to 4096 KB for improved sequential performance, while I/O queue depth is raised to 128 for SATA and 512 for NVMe, enabling higher parallelism. I/O request merging is enabled to combine adjacent requests for efficiency.
F2FS: Root and home partitions formatted with F2FS are optimized with background garbage collection enabled and tuned idle detection intervals to maintain flash-based storage performance consistency. To preserve SSD longevity and prevent write performance degradation, the system runs TRIM operations once every 7 days, reclaiming unused blocks. These processes ensure efficient resource use across F2FS filesystems.
CPU architecture is automatically detected on installation to ensure optimal package installation. The system integrates some of ALHP's repositories which provide architecture-specific builds optimized for modern processor capabilities while keeping Artix's core system packages.
-
AMD/Intel - Configured for high performance and security.
-
NVIDIA - Tweaked for maximum visual fidelity, high performance and security.
-
Laptop - Balanced between power saving, performance and security, at 85% battery + AC connection performance is increased and reduced at 10%.
-
Performance - Maximum performance configuration with no security mitigations, CPU scheduling and expanded memory limits.
-
Server - The system expands TCP/UDP buffer sizes up to 16MB for high-performance connections. TCP stack handling is tuned for scalability with up to 2 million
TIME_WAITsockets, window scaling and reuse enabled for faster turnaround. Security and stability are reinforced with SYN cookies, strict reverse path filtering, martian packet logging, disabled source routing and ICMP redirects. IPv4/IPv6 are both hardened with rate limiting for ICMP and disabled router advertisements. These settings balance low latency with resilience against network abuse patterns. -
AI - Specialized for AI workloads with larger HugePages allocation and no security mitigations.
