Linux desktops and ChromeOS Flex for old PCs

Forty PCs on the second floor stop getting Windows updates, and the budget pays for twelve new ones. The other twenty-eight have three futures, and the published minimums decide which: ChromeOS FlexChromeOS Flex: Google's version of ChromeOS that installs over Windows, macOS or Linux on Intel and AMD PCs, turning a model Google has tested into a centrally managed device for the Chrome browser and web apps. turns a listed model into a managed browser machine on 4 GB of memory, Ubuntu Desktop runs a full desktop where there are 6 GB of memory and 25 GB of disk, and the rest are replaced. One machine out of the twenty-eight runs a Windows-only application, and no new operating system changes that.

This lesson gives you the rule that sorts them, a program that applies it to ten PCs, an Ubuntu install that leaves Secure BootSecure Boot: A UEFI firmware feature that refuses to start firmware drivers, boot loaders or operating systems that are not signed with keys the firmware trusts. Windows 11 needs Secure Boot capable firmware, in a VM too. More in “Build a practice lab with virtual machines” switched on, a live USBlive USB: A USB stick that boots a whole operating system without installing it, so a technician can test a PC's hardware or copy files out of a machine whose own system will not start. rescue that respects encryption, and the five places on a GNOMEGNOME: The desktop Ubuntu Desktop ships with: the Activities overview that finds anything by name, the dock, and one Settings application whose panels hold Wi-Fi, displays, printers, users and accessibility. desktop a user’s questions will send you.

An ageing PC has three futures, and the user’s work picks one

Start with the user, not the hardware. The PC on the second floor that runs a browser, a web mail client and a spreadsheet in the browser all day is a different problem from the one that runs a drawing package installed on its own disk, and different again from the one with a single accounting application that exists only for Windows.

Three futures, each in a sentence. ChromeOS Flex replaces the old system with a managed ChromeOS device that runs web apps and the Chrome browser, which Google supports on the models it has tested. Ubuntu Desktop replaces it with a full Linux desktop that installs its own applications and gets five years of security and maintenance updates on a long-term support release. Replacement buys a supported machine, which is the only future that keeps a Windows-only application running.

Those three answers come from four questions, and the table below asks them. Answer it for one real machine on your own desk: what the user does all day, whether the exact model is on Google’s models list with support years left, and whether the PC has Ubuntu’s 6 GB of memory and 25 GB of disk.

The table rules options out rather than ranking them, because that is how the decision actually works: one Windows-only application removes both Linux-shaped futures at once, whatever the hardware can do. Keep the answers beside the asset tag in the ticket, so the next technician reads a decision instead of an opinion.

Sorting the floor this way also spends the budget where it is needed. The twelve new machines go to the users the rule sends to replacement, starting with the one that needs the Windows-only application, and every PC that becomes a ChromeOS Flex or Ubuntu machine releases a new one for somebody who had no other option. The order of the work follows from the same table: the machines with data to move first, the shared and spare PCs last.

ChromeOS Flex is a managed browser machine while its model is listed

ChromeOS Flex installs over Windows, macOS or Linux and gives the PC the ChromeOS experience: the Chrome browser, web apps, central management and automatic encryption of user data. Google’s own description of its reach is broad — “ChromeOS Flex works on most Windows, Mac, and Linux devices manufactured over the last 10 or more years” — but the support promise is narrow, and that gap is where help desks get hurt.

The published minimums are short. An Intel or AMD x86-64 machine, 4 GB of memory, 16 GB of internal storage, the ability to boot from USB and full administrator access to the firmware. Intel and AMD processors and graphics from 2012 or earlier, and Nvidia graphics from 2014 or earlier, are not recommended or supported, and there is no support for ARM machines at all. The installer itself needs a USB drive of 16 GB or more, written either with the Chromebook Recovery Utility or from the downloaded image.

Then comes the part that decides the ticket: the models list. Google certifies individual models, and its documentation is explicit that a device has that status only when its exact model name and number appear on that list. Each row carries a status and the year the certification runs out:

The last two rows are the ones to argue from. Google’s page on certification says that when a model passes its date it leaves the list, stops being eligible for support, stops being tested and may develop faults without warning. The list itself adds that support runs to the end of the year shown. So a model whose listing stops at the year your hardware plan runs to has nothing left to give, which is exactly why the rule in this lesson asks for two years.

Flex is also narrower than a desktop operating system in what it runs: no Windows virtual machines, a local Linux environment that depends on the model, and a list of hardware Google does not test, including CD and DVD drives, fingerprint readers, stylus input and Thunderbolt features. Two further points belong in the ticket. Firmware updates stay the organisation’s job, because a Flex device does not update its own firmware; and Google recommends switching Secure Boot on for Flex devices, because Microsoft accepted its boot loader for that use.

Ubuntu installs with Secure Boot left switched on

The second future is a full Linux desktop. Ubuntu’s download page offers Ubuntu 26.04.1 LTS, where LTS means long-term supportLong-term support: a release a vendor maintains for years rather than months. An Ubuntu LTS release carries five years of security and maintenance updates., with five years of security and maintenance updates. Its published requirements are a 2 GHz dual-core processor, 6 GB of memory, 25 GB of disk and a USB port or DVD drive for the installer — higher than Flex’s minimums, which is why some machines that pass one test fail the other. The desktop it installs is GNOME 50, and the file system it puts on the disk by default is ext4ext4: The file system Ubuntu puts on a disk by default. It keeps a journal of pending changes that the kernel replays when the file system is mounted dirty, which is why a rescue mounts it with the ro and noload options..

The install itself is ten minutes of waiting and five decisions. Step through them, and watch where Secure Boot comes up — or rather, where it does not:

Two steps in that walk-through are worth saying twice. The first is Try Ubuntu: the installer offers a preview that runs the whole desktop from the stick and writes nothing to the disk, so the Wi-Fi, the sound, the trackpad and the display can all be tested before a single byte of the user’s data is at risk. Canonical’s tutorial notes that this preview uses open-source drivers only, so a graphics card that needs a proprietary driver may look worse in the preview than it will after the install.

The second is the third-party software box. Ticking it installs device support and media formats, and Canonical’s driver documentation explains why that is safe with Secure Boot on: the ubuntu-drivers tool and the Additional Drivers application install the pre-built, signed drivers by default, and those are the ones that work with Secure Boot. Drivers fetched from elsewhere are what breaks it.

One case does stop the install, and it is an encryption case. Where Ubuntu is to sit beside an existing Windows system, the installer has to read that disk’s layout, and Canonical’s reference page explains that a BitLocker volume appears as random data without the correct key, so it cannot be mapped. That is a conversation with the machine’s owner about turning BitLocker off first, or about erasing the disk on purpose, never a guess.

A live USB rescues files, and stops at encryption

The same stick that installs Ubuntu is the most useful rescue tool on the desk. A PC whose own system will not start can still boot the live session, see its disks and hand over the user’s documents — on a machine the desk owns and has been asked to recover. Two commands carry the work, and one decision stops it.

lsblk -f is the first command because it answers the question that matters before any mounting: which device is which. Its manual page lists what --fs prints — the name, file-system type, version, label, identifier, free space and use, and where each is mounted — so one screen tells you which partition is Windows (ntfs) and which is Ubuntu (ext4), which disk is encrypted, and which device is the spare drive or the stick you booted from.

The second command is the mount, and it is read-only for a reason: a disk that is about to be sent for recovery must not be written to by the rescue itself. Plain -o ro is not quite enough on a Linux file system. The mount manual warns that “ext3 and ext4 will replay the journal if the filesystem is dirty”, which is a write to a disk you promised not to touch, and suggests ro,noload to prevent it.

Then the stop. If lsblk -f reports crypto_LUKS, or the Windows volume is protected by BitLocker, the data is unreadable without its key, and that is the design working as intended. Canonical’s own page says the contents look like random noise without the correct key. The ticket moves to the person or the organisation that holds the recovery key, through their own process; the owner is told what is happening.

Where the copy does run, two details save the second visit. Format the spare drive so that the user’s next machine can read it, which usually means exFAT rather than ext4, and copy the home folder first, since that is where the documents, the desktop and the mail store live. Then compare the file count and the total size on both sides, unmount the disk and only then let anyone wipe or re-image the machine.

Here is the whole rescue, recorded in a Linux lab: Ubuntu 26.04 LTS with a PC’s two disks and a spare USB drive attached as disk images, named loop0 to loop2 where a PC shows sda or nvme0n1, in a root shell (a live session types sudo in front of these commands). The lab has no udev, which keeps each disk’s details on a running system, so its lsblk reads the disks itself (--properties-by blkid) and leaves the version column empty.

"""The rescue of a PC that will not boot, in the lesson's Linux lab (linux_lab.py: an Ubuntu 26.04 LTS root shell,
as in a live session's terminal after `sudo -i`). lab_disks.sh lays out the PC's disks and the spare USB drive as
loop devices: /dev/loop0 the system disk (Windows and Ubuntu), /dev/loop1 a second disk encrypted with LUKS (the lab
kept no key), /dev/loop2 the spare drive. Two commands are meant to fail: the mount of the encrypted disk, and a copy
with cp -a onto the exFAT drive.
"""
from linux_lab import run

run("""
bash lab_disks.sh pc
lsblk -f --properties-by blkid /dev/loop0 /dev/loop1 /dev/loop2
mkdir /mnt/ubuntu /mnt/windows /mnt/data /mnt/spare
mount -o ro,noload /dev/loop0p4 /mnt/ubuntu
mount -o ro /dev/loop0p3 /mnt/windows
mount -o ro /dev/loop1p1 /mnt/data
mount /dev/loop2 /mnt/spare
mount | grep ' /mnt/'
cp -a /mnt/ubuntu/home/asha/Desktop /mnt/spare/
rm -r /mnt/spare/Desktop
mkdir /mnt/spare/ubuntu /mnt/spare/windows
cp -r --preserve=timestamps /mnt/ubuntu/home/asha /mnt/spare/ubuntu/
cp -r --preserve=timestamps /mnt/windows/Users/Asha /mnt/spare/windows/
find /mnt/ubuntu/home/asha /mnt/windows/Users/Asha -type f | wc -l
find /mnt/spare -type f | wc -l
find /mnt/ubuntu/home/asha /mnt/windows/Users/Asha -type f -print0 | du -cb --files0-from=- | tail -n 1
find /mnt/spare -type f -print0 | du -cb --files0-from=- | tail -n 1
umount /mnt/ubuntu /mnt/windows /mnt/spare
""", failures=2)

$ bash lab_disks.sh pc
lab: /dev/loop0 is the PC's system disk (EFI, Microsoft reserved, Windows, Ubuntu)
lab: /dev/loop1 is the PC's second disk (encrypted; the lab kept no key)
lab: /dev/loop2 is the spare USB drive
$ lsblk -f --properties-by blkid /dev/loop0 /dev/loop1 /dev/loop2
NAME      FSTYPE      FSVER LABEL   UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
loop0
├─loop0p1 vfat                      9C1E-5A7B
├─loop0p2
├─loop0p3 ntfs              Windows 3F2A6B1C0D9E8F70
└─loop0p4 ext4              ubuntu  6f1d2e3c-4b5a-4968-8778-695a4b3c2d1e
loop1
└─loop1p1 crypto_LUKS               2b8f0c1e-7d3a-4e59-9a61-3c4d5e6f7a8b
loop2     exfat             SPARE   5A3E-1C07
$ mkdir /mnt/ubuntu /mnt/windows /mnt/data /mnt/spare
$ mount -o ro,noload /dev/loop0p4 /mnt/ubuntu
$ mount -o ro /dev/loop0p3 /mnt/windows
$ mount -o ro /dev/loop1p1 /mnt/data
mount: /mnt/data: unknown filesystem type 'crypto_LUKS'.
       dmesg(1) may have more information after failed mount system call.
[exit status 32]
$ mount /dev/loop2 /mnt/spare
$ mount | grep ' /mnt/'
/dev/loop0p4 on /mnt/ubuntu type ext4 (ro,relatime,norecovery)
/dev/loop0p3 on /mnt/windows type fuseblk (ro,relatime,user_id=0,group_id=0,allow_other,blksize=4096)
/dev/loop2 on /mnt/spare type fuseblk (rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096)
$ cp -a /mnt/ubuntu/home/asha/Desktop /mnt/spare/
cp: failed to preserve ownership for '/mnt/spare/Desktop/todo.txt': Operation not permitted
cp: failed to preserve ownership for '/mnt/spare/Desktop': Operation not permitted
[exit status 1]
$ rm -r /mnt/spare/Desktop
$ mkdir /mnt/spare/ubuntu /mnt/spare/windows
$ cp -r --preserve=timestamps /mnt/ubuntu/home/asha /mnt/spare/ubuntu/
$ cp -r --preserve=timestamps /mnt/windows/Users/Asha /mnt/spare/windows/
$ find /mnt/ubuntu/home/asha /mnt/windows/Users/Asha -type f | wc -l
14
$ find /mnt/spare -type f | wc -l
14
$ find /mnt/ubuntu/home/asha /mnt/windows/Users/Asha -type f -print0 | du -cb --files0-from=- | tail -n 1
4036818	total
$ find /mnt/spare -type f -print0 | du -cb --files0-from=- | tail -n 1
4036818	total
$ umount /mnt/ubuntu /mnt/windows /mnt/spare

lsblk names every partition before anything is touched: EFI (vfat), the Microsoft reserved one with no file system, Windows (ntfs), Ubuntu (ext4), a second disk whose only partition is crypto_LUKS, and the spare drive (exfat). Ubuntu mounts with ro,noload, which the list of mounts shows as norecovery; the lab runs NTFS and exFAT through FUSE programs, shown as fuseblk; and the encrypted partition does not mount at all. cp -a fails on the spare drive because exFAT stores no owners, so the copy uses cp -r --preserve=timestamps, which keeps the dates, and the last commands check it: 14 files and 4,036,818 bytes on each side.

A second recording shows what noload prevents, on two copies of an Ubuntu partition as a power cut during a save leaves it: one is mounted with plain -o ro, the other with -o ro,noload, and each is then compared with a third, untouched copy.

"""Why a read-only mount is not enough on a dirty ext4 file system, in the lesson's Linux lab (linux_lab.py; the
disks from lab_disks.sh power-cut): /dev/loop0 and /dev/loop1 are two identical copies of an Ubuntu partition as a
power cut during a save leaves it, with its journal still open, and /disks/power-cut.orig is a third copy that nothing
mounts. The first copy is mounted with -o ro, the second with -o ro,noload; dmesg shows the kernel's lines about the
two mounts, and cmp then says whether a mount wrote to its copy.
"""
from linux_lab import run

run("""
bash lab_disks.sh power-cut
dumpe2fs -h /dev/loop0 2>/dev/null | grep -o needs_recovery
mkdir /mnt/a /mnt/b
mount -o ro /dev/loop0 /mnt/a
mount -o ro,noload /dev/loop1 /mnt/b
dmesg -t | grep -E 'EXT4-fs \\(loop[01]\\)' | tail -n 7
ls /mnt/a/home/asha/Documents
ls /mnt/b/home/asha/Documents
umount /mnt/a /mnt/b
cmp -s /disks/power-cut-a.img /disks/power-cut.orig && echo "copy a: unchanged" || echo "copy a: changed"
cmp -s /disks/power-cut-b.img /disks/power-cut.orig && echo "copy b: unchanged" || echo "copy b: changed"
""")

$ bash lab_disks.sh power-cut
lab: /dev/loop0 and /dev/loop1 are two copies of the Ubuntu partition, taken during the power cut
$ dumpe2fs -h /dev/loop0 2>/dev/null | grep -o needs_recovery
needs_recovery
$ mkdir /mnt/a /mnt/b
$ mount -o ro /dev/loop0 /mnt/a
$ mount -o ro,noload /dev/loop1 /mnt/b
$ dmesg -t | grep -E 'EXT4-fs \(loop[01]\)' | tail -n 7
EXT4-fs (loop0): INFO: recovery required on readonly filesystem
EXT4-fs (loop0): write access will be enabled during recovery
EXT4-fs (loop0): orphan cleanup on readonly fs
EXT4-fs (loop0): recovery complete
EXT4-fs (loop0): mounted filesystem 6f1d2e3c-4b5a-4968-8778-695a4b3c2d1e ro with ordered data mode. Quota mode: none.
EXT4-fs (loop1): orphan cleanup on readonly fs
EXT4-fs (loop1): mounted filesystem 6f1d2e3c-4b5a-4968-8778-695a4b3c2d1e ro without journal. Quota mode: none.
$ ls /mnt/a/home/asha/Documents
budget-final.ods
budget.ods
letter.odt
minutes.txt
report.odt
$ ls /mnt/b/home/asha/Documents
budget-final.ods
budget.ods
letter.odt
minutes.txt
report.odt
$ umount /mnt/a /mnt/b
$ cmp -s /disks/power-cut-a.img /disks/power-cut.orig && echo "copy a: unchanged" || echo "copy a: changed"
copy a: changed
$ cmp -s /disks/power-cut-b.img /disks/power-cut.orig && echo "copy b: unchanged" || echo "copy b: changed"
copy b: unchanged

On the plain read-only mount the kernel reports recovery on a read-only file system and “write access will be enabled during recovery”, and cmp shows that copy changed; the noload mount ran “without journal” and changed nothing. The orphan cleanup lines are ext4 looking for files deleted while still open, and there were none. The ext4 manual warns that skipping the replay on a file system that was not unmounted cleanly leaves it with inconsistencies, one more reason to check the copy before anything is wiped.

GNOME: where the settings a user will ask for live

A user whose PC changed system asks six questions in the first week, and five of them are answered in Settings. The GNOME desktop puts a single Settings application behind the Activities overview: press the Super key, type the first few letters of what you want, and open the panel. The table maps the questions to the places:

Printing is the one worth rehearsing, because it is the most common call. GNOME’s documentation says a USB printer is often recognised when it is plugged in, while a printer on the network is not set up by itself and is added from the Printers panel: allow the change with your password, press Add Printer, choose the printer the panel found, or type its network address when the panel does not discover it. The printing module of this track goes into queues, drivers and the faults; here it is enough to know the panel.

Software comes from two places, and both are worth showing the user once. App Center, the application in the dock, installs applications in the two formats Ubuntu carries, snaps and Debian packages, and asks for the password before it does. The terminal’s apt does the same job for anyone who prefers typing, and the updates module of this track covers keeping both current.

The habit to teach on the first day is the Activities overview itself. One key opens it, a few letters find any application or settings panel by name, and the user stops hunting through menus that look nothing like the ones they had. Give them three names to remember on a card beside the PC: Settings for the machine, App Center for software, Files for their documents. Most of the calls in week two are already answered by those three.

Ten PCs, one rule, written down

A decision made twice the same way is a rule; a decision made from memory is a mood. This program writes the rule down. It holds the two vendors’ published minimums in one snapshot, records each PC’s row of Google’s list, and prints a recommendation with the code of the rule that decided it, for ten machines off an inventory sheet:

"""Ten ageing office PCs against the published minimums of ChromeOS Flex and Ubuntu Desktop.

SNAPSHOT holds the two vendors' own minimums, written down once so that a decision can be
repeated and argued with: Google's "Prepare for installation" page for ChromeOS Flex (x86-64,
4 GB of memory, 16 GB of internal storage, no processor from 2012 or earlier) together with its
certified models list and the "About ChromeOS Flex certified models" page (a model is supported
only while its certification lasts), and Canonical's "Download Ubuntu Desktop" page for Ubuntu
26.04 LTS (a 2 GHz dual-core processor, 6 GB of memory, 25 GB of disk).

PLAN_YEAR is the year the hardware plan runs to, so "two years of certification left" is a
number and not a feeling. The desk records each PC's row of the certified list in FLEET: the
status it read and the year the certification runs out.
"""

SNAPSHOT = {
    "flex": {
        "arch": "x86-64",
        "ram_gb": 4,
        "disk_gb": 16,
        "oldest_cpu_year": 2013,
        "listed": ("certified", "minor-issues"),
        "years_left": 2,
    },
    "ubuntu": {"ram_gb": 6, "disk_gb": 25, "cpu_ghz": 2.0, "cores": 2},
}
PLAN_YEAR = 2027

# One row per PC on the desk's inventory sheet. work is what the user does all day:
# "web" (browser and web apps), "desktop-apps" (software installed on the machine) or
# "windows-app" (one application that runs on Windows only).
FLEET = [
    {"tag": "HD-11", "arch": "x86-64", "cpu_year": 2016, "cpu_ghz": 2.3, "cores": 2,
     "ram_gb": 4, "disk_gb": 128, "flex": "certified", "flex_until": 2030, "work": "web"},
    {"tag": "HD-12", "arch": "x86-64", "cpu_year": 2015, "cpu_ghz": 2.4, "cores": 2,
     "ram_gb": 4, "disk_gb": 500, "flex": "minor-issues", "flex_until": 2029, "work": "web"},
    {"tag": "HD-13", "arch": "x86-64", "cpu_year": 2017, "cpu_ghz": 2.5, "cores": 4,
     "ram_gb": 8, "disk_gb": 256, "flex": "certified", "flex_until": 2030, "work": "desktop-apps"},
    {"tag": "HD-14", "arch": "x86-64", "cpu_year": 2014, "cpu_ghz": 2.0, "cores": 2,
     "ram_gb": 8, "disk_gb": 500, "flex": "decertified", "flex_until": 2026, "work": "web"},
    {"tag": "HD-15", "arch": "x86-64", "cpu_year": 2013, "cpu_ghz": 1.6, "cores": 2,
     "ram_gb": 2, "disk_gb": 32, "flex": "not-listed", "flex_until": None, "work": "web"},
    {"tag": "HD-16", "arch": "arm64", "cpu_year": 2021, "cpu_ghz": 2.4, "cores": 8,
     "ram_gb": 8, "disk_gb": 256, "flex": "not-listed", "flex_until": None, "work": "web"},
    {"tag": "HD-17", "arch": "x86-64", "cpu_year": 2011, "cpu_ghz": 2.8, "cores": 4,
     "ram_gb": 8, "disk_gb": 500, "flex": "not-listed", "flex_until": None, "work": "web"},
    {"tag": "HD-18", "arch": "x86-64", "cpu_year": 2018, "cpu_ghz": 3.0, "cores": 4,
     "ram_gb": 8, "disk_gb": 256, "flex": "certified", "flex_until": 2031, "work": "windows-app"},
    {"tag": "HD-19", "arch": "x86-64", "cpu_year": 2016, "cpu_ghz": 2.1, "cores": 2,
     "ram_gb": 8, "disk_gb": 20, "flex": "certified", "flex_until": 2027, "work": "web"},
    {"tag": "HD-20", "arch": "x86-64", "cpu_year": 2015, "cpu_ghz": 1.8, "cores": 2,
     "ram_gb": 8, "disk_gb": 120, "flex": "not-listed", "flex_until": None, "work": "desktop-apps"},
]


def flex_blocker(pc):
    """The first published rule that keeps ChromeOS Flex off this PC, or None when it fits."""
    flex = SNAPSHOT["flex"]
    if pc["work"] == "desktop-apps":
        return "needs-desktop-apps"
    if pc["arch"] != flex["arch"]:
        return "arch-not-x86"
    if pc["cpu_year"] < flex["oldest_cpu_year"]:
        return "cpu-before-2013"
    if pc["flex"] == "decertified":
        return "flex-support-ends"
    if pc["flex"] not in flex["listed"]:
        return "flex-not-listed"
    if pc["flex_until"] - PLAN_YEAR < flex["years_left"]:
        return "flex-support-ends"
    if pc["ram_gb"] < flex["ram_gb"]:
        return "flex-ram-short"
    if pc["disk_gb"] < flex["disk_gb"]:
        return "flex-storage-short"
    return None


def ubuntu_blocker(pc):
    """The first Ubuntu Desktop requirement this PC misses, or None when it meets them all."""
    ubuntu = SNAPSHOT["ubuntu"]
    if pc["ram_gb"] < ubuntu["ram_gb"]:
        return "ram-below-6gb"
    if pc["disk_gb"] < ubuntu["disk_gb"]:
        return "disk-below-25gb"
    if pc["cpu_ghz"] < ubuntu["cpu_ghz"] or pc["cores"] < ubuntu["cores"]:
        return "cpu-below-2ghz"
    return None


def recommend(pc):
    """Return (recommendation, reason code) for one PC: the rule that decided, not an opinion."""
    if pc["work"] == "windows-app":
        return "replace", "windows-app-needed"
    blocker = flex_blocker(pc)
    if blocker is None:
        return "chromeos-flex", "flex-listed"
    missing = ubuntu_blocker(pc)
    if missing is None:
        return "ubuntu", blocker
    return "replace", missing


def certification(pc):
    """The PC's row of the certified models list, as the desk recorded it."""
    if pc["flex_until"] is None:
        return pc["flex"]
    return f"{pc['flex']} to {pc['flex_until']}"


def main():
    flex, ubuntu = SNAPSHOT["flex"], SNAPSHOT["ubuntu"]
    print("The snapshot both decisions are made against")
    print(f"  ChromeOS Flex : {flex['arch']}, {flex['ram_gb']} GB memory, {flex['disk_gb']} GB storage,")
    print(f"                  no processor before {flex['oldest_cpu_year']}, a listed model with")
    print(f"                  {flex['years_left']} or more years of certification left")
    print(f"  Ubuntu Desktop: {ubuntu['cpu_ghz']} GHz x {ubuntu['cores']} cores, "
          f"{ubuntu['ram_gb']} GB memory, {ubuntu['disk_gb']} GB disk")
    print(f"  Hardware plan runs to {PLAN_YEAR}")
    print()
    head = f"{'PC':6}{'arch':8}{'cpu':13}{'RAM':6}{'disk':7}{'certified list':22}{'recommendation':16}reason"
    print(head)
    print("-" * len(head))
    counts = {}
    for pc in FLEET:
        choice, reason = recommend(pc)
        counts[choice] = counts.get(choice, 0) + 1
        cpu = f"{pc['cpu_year']} {pc['cpu_ghz']} GHz"
        print(f"{pc['tag']:6}{pc['arch']:8}{cpu:13}{str(pc['ram_gb']) + ' GB':6}"
              f"{str(pc['disk_gb']) + ' GB':7}{certification(pc):22}{choice:16}{reason}")
    print()
    for choice in ("chromeos-flex", "ubuntu", "replace"):
        tags = [pc["tag"] for pc in FLEET if recommend(pc)[0] == choice]
        print(f"{choice:14}{counts.get(choice, 0):2}  {', '.join(tags)}")
    print()
    print("Every PC the rule sends to replacement, and the requirement it misses:")
    for pc in FLEET:
        choice, reason = recommend(pc)
        if choice == "replace":
            print(f"  {pc['tag']}: {reason}")


main()

The snapshot both decisions are made against
  ChromeOS Flex : x86-64, 4 GB memory, 16 GB storage,
                  no processor before 2013, a listed model with
                  2 or more years of certification left
  Ubuntu Desktop: 2.0 GHz x 2 cores, 6 GB memory, 25 GB disk
  Hardware plan runs to 2027

PC    arch    cpu          RAM   disk   certified list        recommendation  reason
------------------------------------------------------------------------------------
HD-11 x86-64  2016 2.3 GHz 4 GB  128 GB certified to 2030     chromeos-flex   flex-listed
HD-12 x86-64  2015 2.4 GHz 4 GB  500 GB minor-issues to 2029  chromeos-flex   flex-listed
HD-13 x86-64  2017 2.5 GHz 8 GB  256 GB certified to 2030     ubuntu          needs-desktop-apps
HD-14 x86-64  2014 2.0 GHz 8 GB  500 GB decertified to 2026   ubuntu          flex-support-ends
HD-15 x86-64  2013 1.6 GHz 2 GB  32 GB  not-listed            replace         ram-below-6gb
HD-16 arm64   2021 2.4 GHz 8 GB  256 GB not-listed            ubuntu          arch-not-x86
HD-17 x86-64  2011 2.8 GHz 8 GB  500 GB not-listed            ubuntu          cpu-before-2013
HD-18 x86-64  2018 3.0 GHz 8 GB  256 GB certified to 2031     replace         windows-app-needed
HD-19 x86-64  2016 2.1 GHz 8 GB  20 GB  certified to 2027     replace         disk-below-25gb
HD-20 x86-64  2015 1.8 GHz 8 GB  120 GB not-listed            replace         cpu-below-2ghz

chromeos-flex  2  HD-11, HD-12
ubuntu         4  HD-13, HD-14, HD-16, HD-17
replace        4  HD-15, HD-18, HD-19, HD-20

Every PC the rule sends to replacement, and the requirement it misses:
  HD-15: ram-below-6gb
  HD-18: windows-app-needed
  HD-19: disk-below-25gb
  HD-20: cpu-below-2ghz

Two of the ten are ChromeOS Flex, four are Ubuntu and four are replaced, and the interesting answers are the ones that look wrong at first glance. HD-13 is a listed model with 8 GB of memory, yet it goes to Ubuntu: its user needs applications installed on the machine, which is the one thing Flex does not do. HD-17 is the oldest PC in the list and still goes to Ubuntu, because Ubuntu publishes no cut-off year while Flex does not support processors from before 2013.

HD-19 is the case to remember. Its listing is current, it has 8 GB of memory, and the rule still sends it to replacement: its certification runs out in the planning year itself, so Flex is out, and its 20 GB disk is under Ubuntu’s 25 GB, so Ubuntu is out too. Press Edit, give it a 240 GB disk, and run the program again — the same PC becomes an Ubuntu machine, and the reason code changes to flex-support-ends, which is what the ticket should have said all along.

Practise: the rule for your own fleet

Build the decision yourself. The exercise gives you the two vendors’ minimums and the fields a desk records for each PC; you write recommend(pc) so that it returns the recommendation and the code of the rule that decided, in the order the published rules fall. Then check the whole lesson with the questions.

FLEX = {
    "arch": "x86-64",
    "ram_gb": 4,
    "disk_gb": 16,
    "oldest_cpu_year": 2013,
    "listed": ("certified", "minor-issues"),
    "years_left": 2,
}
UBUNTU = {"ram_gb": 6, "disk_gb": 25, "cpu_ghz": 2.0, "cores": 2}
PLAN_YEAR = 2027


def recommend(pc):
    """Return (recommendation, reason) for one PC: "chromeos-flex", "ubuntu" or "replace"."""
    return "replace", "windows-app-needed"

from recommend import recommend


def pc(**changes):
    """A listed PC that ChromeOS Flex fits, with the fields of one test changed."""
    base = {
        "arch": "x86-64",
        "cpu_year": 2016,
        "cpu_ghz": 2.3,
        "cores": 2,
        "ram_gb": 8,
        "disk_gb": 128,
        "flex": "certified",
        "flex_until": 2030,
        "work": "web",
    }
    base.update(changes)
    return base


def test_listed_model_gets_flex():
    """recommends ChromeOS Flex for a listed model that meets its minimums"""
    assert recommend(pc()) == ("chromeos-flex", "flex-listed")
    assert recommend(pc(flex="minor-issues")) == ("chromeos-flex", "flex-listed")


def test_flex_minimums_at_the_boundary():
    """accepts exactly 4 GB of memory, exactly 16 GB of storage and a processor from 2013"""
    assert recommend(pc(ram_gb=4, disk_gb=16)) == ("chromeos-flex", "flex-listed")
    assert recommend(pc(cpu_year=2013)) == ("chromeos-flex", "flex-listed")
    assert recommend(pc(flex_until=2029)) == ("chromeos-flex", "flex-listed")
    assert recommend(pc(disk_gb=20)) == ("chromeos-flex", "flex-listed")


def test_windows_only_application():
    """sends a PC whose user needs a Windows-only application to replacement"""
    assert recommend(pc(work="windows-app")) == ("replace", "windows-app-needed")
    assert recommend(pc(work="windows-app", ram_gb=32)) == ("replace", "windows-app-needed")


def test_flex_ruled_out_but_ubuntu_fits():
    """names the Flex rule that failed when it recommends Ubuntu"""
    assert recommend(pc(work="desktop-apps")) == ("ubuntu", "needs-desktop-apps")
    assert recommend(pc(arch="arm64")) == ("ubuntu", "arch-not-x86")
    assert recommend(pc(cpu_year=2012)) == ("ubuntu", "cpu-before-2013")
    assert recommend(pc(flex="not-listed")) == ("ubuntu", "flex-not-listed")
    assert recommend(pc(flex="major-issues")) == ("ubuntu", "flex-not-listed")


def test_certification_running_out():
    """treats a decertified model, and one with under 2 years left, as support ending"""
    assert recommend(pc(flex="decertified", flex_until=2026)) == ("ubuntu", "flex-support-ends")
    assert recommend(pc(flex_until=2028)) == ("ubuntu", "flex-support-ends")
    assert recommend(pc(flex_until=2027)) == ("ubuntu", "flex-support-ends")


def test_machines_below_both_sets_of_minimums():
    """reports the Ubuntu requirement a small machine misses"""
    assert recommend(pc(ram_gb=2, disk_gb=32)) == ("replace", "ram-below-6gb")
    assert recommend(pc(ram_gb=4, disk_gb=14)) == ("replace", "ram-below-6gb")
    assert recommend(pc(ram_gb=6, disk_gb=12)) == ("replace", "disk-below-25gb")


def test_ubuntu_minimums_at_the_boundary():
    """accepts exactly 6 GB of memory, 25 GB of disk and 2 GHz on two cores"""
    fits = pc(flex="not-listed", ram_gb=6, disk_gb=25, cpu_ghz=2.0, cores=2)
    assert recommend(fits) == ("ubuntu", "flex-not-listed")
    assert recommend(pc(flex="not-listed", ram_gb=5)) == ("replace", "ram-below-6gb")
    assert recommend(pc(flex="not-listed", disk_gb=24)) == ("replace", "disk-below-25gb")
    assert recommend(pc(flex="not-listed", cpu_ghz=1.9)) == ("replace", "cpu-below-2ghz")
    assert recommend(pc(flex="not-listed", cores=1)) == ("replace", "cpu-below-2ghz")


def test_the_order_of_the_rules():
    """reports the first rule that failed, not the last"""
    assert recommend(pc(work="desktop-apps", arch="arm64")) == ("ubuntu", "needs-desktop-apps")
    assert recommend(pc(arch="arm64", cpu_year=2010)) == ("ubuntu", "arch-not-x86")
    assert recommend(pc(flex="decertified", flex_until=2026, ram_gb=2)) == ("replace", "ram-below-6gb")
    assert recommend(pc(work="windows-app", arch="arm64", ram_gb=2)) == ("replace", "windows-app-needed")

Interview questions

Warm-up (fresher): does an Ubuntu install need Secure Boot switched off?

No. Ubuntu Desktop installs and runs with Secure Boot on, because its boot loader is signed with a key the firmware trusts, and the drivers Canonical’s own tools install by default are the pre-built, signed ones that work with the setting on. Switching it off is a change to the machine’s firmware that removes a protection against unsigned boot code, and it tends to stay off for the rest of the PC’s life. The time the question really comes up is when someone installs a graphics driver built outside Ubuntu’s own packages, which can leave the system unable to boot with the setting on — and the fix is to use the signed driver, not to weaken the firmware.

Warm-up (fresher to 2-5 years): a PC is on Google’s models list, so can you deploy ChromeOS Flex on it?

Only after reading the whole row. The list gives each model a status and the year its certification ends, and both matter. A row marked “major issues expected” means boot problems are known; a decertified row, or one whose year is nearly here, means Google stops testing that model and will not support it, so every fault afterwards lands on your desk. Check also that the row is for the exact model name and number, because Google’s documentation warns that variants of a model may behave differently, and that the machine clears the minimums of 4 GB of memory and 16 GB of storage on an x86-64 processor newer than 2012.

Two harder questions follow: one about twenty-eight PCs and a deadline, one about a laptop that will not boot. Choose a plan for the pile of PCs and for the dead laptop before reading on, then see where the model answers begin:

Key takeaways

• An ageing PC has three futures, and the user’s work picks one: ChromeOS Flex for browser work on a listed model, Ubuntu Desktop for a full desktop on 6 GB of memory and 25 GB of disk, and replacement when a Windows-only application has to keep running.
• ChromeOS Flex needs an x86-64 machine with 4 GB of memory and 16 GB of storage, no processor older than 2013, and a row on Google’s models list whose certification year has not arrived.
• Ubuntu Desktop installs with Secure Boot left switched on, because its boot loader and the drivers its own tools offer are signed; an install beside BitLocker-protected Windows stops until the owner deals with the encryption.
• A live USB session reads the disks with lsblk -f and copies data out through a read-only mount, where ro,noload keeps even ext4’s journal replay off a disk you promised not to write to.
• An encrypted volume is where a rescue stops: the recovery key comes from the owner or the organisation through their own process, and the ticket records that the volume stayed locked.