r/sysadmin • u/Halomora • 13d ago
Question Anyone survived a Windows to Linux user workstations migration?
Hey fellow sys admin,
I work at a VFX/animation studio (~400 users).
We're kicking off a project to migrate our artist workstations from Windows 10/11 VDIs to Linux. Flavor is pretty much locked it ll be Rocky Linux 9 with KDE.
I am curious if there's anyone here who's been through a similar workstation migration to linux?
What Linux flavor, did you end up on, and would you pick the same again?
How did you handle what GPOs used to give you?
For the Base OS deployment/imaging, did you use Kickstart + Puppet/Ansible, or something else?
Anything that looked easy on paper and turned into a one big pile of {Jurassic_Park}?
Tools that made your life easier along the way?
I am looking for any war stories, good or bad!
Thank you!
96
u/RevolutionaryElk7446 13d ago
Ansible Tower (or AWX) and Terraform (or opentofu).
I've done this for departments, but they were onboard and testing alongside before deployment to fine tune their client requirements. Also held training and Q/A to address concerns.
What kind of plan is going on here?
38
u/Halomora 13d ago
Pretty much the same plan as you, we are going to have some beta testers, preferably a small batch that represents well all the positions of the company. And we will do some q/a, testing before to deploy to one department, then another, etc..
57
u/RevolutionaryElk7446 13d ago
You're gonna wanna beta test yourself first as well. How experienced is your team in deploying, administering, and supporting linux and users within linux?
Ansible/Terraform answers a lot for automation and deployment but what tools are there to support the IT and I'm guessing you're going to be getting some kind of enterprise support or are ya winging it?
→ More replies (1)8
→ More replies (1)8
u/fennecdore 13d ago
Isn't AWX deprecated now ?
9
u/RevolutionaryElk7446 13d ago
It's definitely shifted since IBM bought out Redhat. Think it's been like 2 years since a 'release' but code is still being committed. It's basically just an upstream of AAP
41
u/Sylogz Sr. Sysadmin 13d ago
We use Kickstart, ansible and puppet. We use 5+ distros and it works great for those that want to use it. We use Windows AD for user/group management with SSSD. Took a while to get it working properly and patchikg with different times depending on importance.
7
u/SorryMaintenance 13d ago
Use whatever disto that is best supported by the software that your users will use.
3
u/Halomora 13d ago
That's how i pictured it, thank you! You leave the choice of OS to your users?
53
u/JerikkaDawn Sysadmin 13d ago
You planning to support Hannah Montana Linux?
→ More replies (1)12
5
u/cryptopotomous 13d ago
Users can't even be trusted discretionary access control on folders and SharePoint. DO NOT let them roll with their own distro. Is the user base already familiar with Linux? If not, have you looked at distro friendly to windows user (zorinOS, Ubuntu, Pop!_OS, Mint, etc)?
Not sure what you guys have for budget but if the plan to go Rocky is set in stone consider checking out CIQ for enterprise support. They do for Rocky Linux what Red Hat does does for rhel...but much lower cost. They also offer Ascender Pro for automation which is built off AWX.
4
u/Frothyleet 12d ago
Best practice is to only provide the linux kernel to all of your users and force them to compile their OS from scratch, which ensures it is tailored exactly to their needs.
→ More replies (1)
37
u/othilious 13d ago
Much smaller scale, but we just completed a migration of about 30 machines that we started around March.
Basic setup was to keep it simple; Framework laptops, all the same config, Ubuntu, stick to web-apps for things we aren't ready to move away from (Office 365, etc). Configure via Ansible and some custom script glue.
We rolled it out in phases; replacing one machine per team, fire-fighting their specific issues and bundling the fixes for those into scripts for Ansible.
Developers was easiest; most were already on Ubuntu to begin with, for them it was just bringing the machines in line with policy regarding security, configuration, etc.
Some bumps in the road we experienced:
- Altium Designer under Linux was a PITA. We had hoped to do this with WINE/Proton which worked but with some glaring rendering issues. GPU pass-through was also hit-and-lots-of-miss. This particular thing is still stuck on a Windows machine.
- There is no good solution for Teams, all of the solutions we've tried have had some nasty downsides. We'll keep using the Teams for Linux project, but for internal communication we're switching to Slack.
- A lot of conference speakers like Jabra have issues with "timing out" due to power saving, causing audio to drop mid-call. Some udev rules fixes that, but its annoying when you have more than one model spread across multiple meeting rooms.
Apart from that, it's been pretty smooth. People like how much "snappier" the machines feel and the adjustment to the different GUI was fine even for the non-technical people. Quite a few comments along the lines of it feeling cleaner, faster and easier. We've actually un-mothballed a few older Laptops that were headed for the recycling because they are much more performant under Ubuntu, whereas they were unusable under Win11 after the upgrade.
Honestly, there's a lot we could've done better or automated, but a significant chunk of it was "good enough" for our company straight out of the box. Hell, even the printers worked without hassle when those same demon machines have been nothing but pain under Windows.
13
u/jhansonxi 13d ago
Altium Designer under Linux was a PITA
PCB designer and former sysadmin here who uses AD daily. Also the slacking maintainer for the Wine AppDB entry for it. It was functional up to v17 but Altium did a rewrite/port to 64-bit for v18. It broke badly and for the first few releases wasn't stable on Windows neither. It's getting better, and I want to spend more time testing it on Wine, but I've been overloaded with work. It's a huge complicated app, arguably larger than Office. Because it's proprietary with limited demo access I'm automatically the gatekeeper of any Wine bug I report including compiling Wine builds with test patches.
5
u/othilious 12d ago
Thanks for all your efforts! It was not a complaint about anyone involved in maintaining the stack needed to make these things work. I've fielded plenty of complaints about AD well before the attempted switch, and we knew it was likely going to be a hurdle going in. It's also entirely possible we did something wrong.
We'll likely come back to it in a few months.
→ More replies (4)6
134
u/MrCatberry 13d ago
Holy Shit...
Are the arists "on board"? Or better: Are they even knowing?
52
u/wrosecrans 13d ago
I used to work in VFX. I'd say the overwhelming majority of VFX artists have used Linux. It's mostly a non-issue. The industry has always had pretty widespread nix usage going back to the late 80's/early 90's when everybody was using Irix on SGI hardware. Most of the major DCC tools used in VFX started life on Irix or Linux, and the Windows port only happened much later as a secondary platform with some quirks.
A typical VFX artist basically spends all day in Nuke, Flame, Maya, or Houdini, and checking GMail in Chrome. That all looks pretty much identical regardless of which OS you are using anyway, save for the decoration on the window borders. You barely touch the OS. At a lot of studios, you barely even need to know where files are stored because a lot of assets are moved through studio specific pipeline tools to publish stuff through some sort of database and accessed at a higher level.
It's a completely different user base from an accounting department that is used to spending all day in something like MS Excel and the user needs to completely change their workflow if they move to a different OS.
20
u/fuhry 13d ago
Very much this - I knew a bunch of people at Blue Sky Studios (they animated Ice Age, Robots, Rio and a bunch of other films) and their whole stack was built on RHEL or one of its rebuilds IIRC. Didn't learn too much about the management layer because all the people I knew were animators and artists not IT. But all of the workstations, at least for those in creative roles, were 100% Linux.
4
u/janky_koala 12d ago
So many guys shooting their mouths off in this post that have zero understanding of the use case. It’s quite clearly a very niche speciality, but we all see the output very regularly
43
u/Halomora 13d ago
They do know it's gonna happen at some point. Do they have the choice? not really, execs are pushing hard on it.
41
32
u/st0ut717 13d ago
Can I ask why you didn’t choose Mac for the desktop for the artist?
39
13d ago edited 9d ago
[deleted]
32
u/HorseShedShingle computer janitor 13d ago
Probably significantly cheaper to license and maintain than whatever VDI hellhole of licensing is going on.
They gotta have a massively beefy cluster to power 400 VFX artists regardless of the OS, and then there is the licensing and management - plus you are still buying those users some sort of laptop/desktop that they console in from.
I cannot imagine an m4 pro Mac Mini, Mac Studio, or MBP would be more expensive then that.
19
u/JustinHoMi 13d ago
Yeah, the Linux solution certainly won’t be free though, as an uninformed exec might think.
17
u/seniorblink 13d ago
But ChatGPT said so
4
u/cryptopotomous 13d ago
Oh God... I love how ChatGPT made the entire C suit senior systems engineers all the sudden.
6
u/stiffgerman JOAT & Train Horn Installer 13d ago
MSPaint doesn't take much CPU...
4
u/WayneH_nz 13d ago
It does with all the AI stuff MS are putting and then disabling, with out removing any of the code, so it can be slipstreamed back in when end users are wanting to have Donald being shafted by Mickey as an option in paintAI.
61
u/chandleya IT Manager 13d ago
If you run an art shop that’s too broke for Mac’s but has 400 artists? Sounds like a dumpster fire
18
→ More replies (5)8
6
u/gribbler 13d ago
Because medium or large animation and VFX doesn't really use Mac on the desktop, not many use Windows unless it's specific for an application
→ More replies (14)2
u/Spider-Thwip 11d ago
Linux is better for VFX, applications run a lot better on Linux than they do on Windows and Mac.
We only kept a mac for the editorial team.
→ More replies (2)→ More replies (2)3
u/xtheory 13d ago
Do the VFX apps they are trained on run on Linux, otherwise you're guys are gonna have a very bad time.
→ More replies (4)18
u/ChristmassMoose 13d ago
They’re on vdi doing serious creative work? it can’t get much worse
9
u/Keleus 13d ago
Just have to do VDI right. I can pull 50fps+ out of our gpu backed vdi setup and many times much higher.
6
u/tigglysticks 13d ago
Yeah performance is there. Just anytime I've priced it out never makes any sense from a cost perspective. Bad enough the price tag on the hardware but then you add VDI licensing... I can't justify it no matter which way I look at it.
8
u/gehzumteufel 13d ago
VFX houses it makes more sense because they gotta control for DLP very strictly. It avoids any data ever being on local machines.
→ More replies (2)2
u/Frothyleet 12d ago
Also, VFX often involves enormous files, which tends to mean you get to choose between two very expensive options:
VDI with very expensive [even before the current times] hardware and preposterous licensing
Client-side work, with very expensive workstations, 10GbE connections at a minimum to your end users, and often supplementing with direct attached storage functioning as local file caching
→ More replies (2)11
→ More replies (1)3
u/Pazuuuzu 13d ago
Does it matter? They have as much choice in it as IT. Somebody signed off on it, so its happening.
→ More replies (2)
60
u/Waste_Development971 13d ago
This sounds interesting, let us know how bad it may go.
→ More replies (1)
12
u/FarToe1 13d ago
Builds: PXE + Kickstart + Ansible / Teraform is the usual way. New machine boots to pxe, which wipes disk and installs OS. Ansible then applies your configs. Or you can do it with usb sticks.
As far as GPO equivalents: Those ansible roles that you applied at build can be re-run daily to ensure consistency, and manage change. Want to add/remove a service account? Change a role and that updates existing and future machines.
You don't need awx/AT but some folk like it. There are alternatives, including writing your own inventory management systems.
Shame you're locked on Rocky. Much as I love it (Been with it since the start and still maintain a couple of hundred Rocky vms), I would not choose it or any other EL for this. The lack of major release upgrade path without reinstalling is a headache. One might say that if you get your deployments right then it's simply a case of forcing that change every five years but with people's workstations they can get a little grumpy about such things like their little desktop personalisations disappearing. That aside, it's good.
Debian, Ubuntu or something else with dist-upgrade would be my route so you stand a chance of not invoking a riot when the OS approaches EOL.
Your users will probably be the biggest issue. IME, only technical users (Dev and IT) like moving to linux. When the others find out they can't run their favourite tool they can get quite excitable. Asking someone who's deeply invested in Excel to give it up is going to cause complaints.
Best advice I can give you is leave a way back so you can reverse course if management get spooked about the complaints and tell you to put people back on windows.
2
10
u/TheProle Endpoint Whisperer 13d ago
Can your helpdesk support them?
2
u/Halomora 13d ago
They will need heavy training, but they are all young so we are hoping they will be able to catch up fairly quickly.
11
10
u/BlueHatBrit 13d ago
Can you afford for them to learn? It's going to cost a bomb in all the time wasted and mistakes made.
2
u/1a2b3c4d_1a2b3c4d 13d ago
I agree. Something seems off about this whole post.
8
u/flummox1234 13d ago
It's VFX artists a lot of that industry is on Linux
5
u/awful_at_internet Helpdesk Manager 13d ago
Sure. That's not gonna stop Tim in Accounting from opening a ticket because he can't find Excel.
Helpdesk is not an optional stakeholder in a project like this.
2
2
u/khobbits Systems Infrastructure Engineer 13d ago
We've never really had any problem with it.
It helps if you automate a lot of the basics.
Like we have a button in slack, to trigger reboots.
It will look up the machines they are assigned, list the machines they can connect/control, and give them the option to reboot.The reboot first tries to send a restart command to the machine, and if that doesn't work, it will trigger a power cycle (usually using either idrac or proxmox, depending on if the machine is physical or vm).
Our helpdesk tend to prefer support via ssh, over other methods.
You can nip in, fix something and nip out, without ever taking control over the desktop session.3
u/Frothyleet 12d ago
but they are all young so we are hoping they will be able to catch up fairly quickly.
Unfortunately this doesn't tend to play out. Older folks are often blamed for being bad about tech literacy, and often are, but it's a bell curve; the young are bad too. There is a small, sub-decade peak of literacy for millenials who grew up during the period where home PCs started springing up, in the '00s, which terminated pretty quickly after smartphones and tablets supplanted personal computing at home.
The youngsters grow up with mobile OS, they don't exposed to real computers until maybe higher ed or the workforce.
17
u/pdp10 Daemons worry when the wizard is near. 13d ago
It's evident from the comments that few posters know that higher-end VFX long ago went from SGI to Linux. Commercial VFX packages on Linux include Autodesk Maya, Foundry Nuke, SideFX Houdini, Adobe Substance Designer, and for open source, Blender.
How did you handle what GPOs
Linux doesn't have a "registry", it uses discrete configuration files. Actually, most of the time the settings are directories where files can be dropped, and the files are concatenated together to form a configuration. This lets software packages and automation, add or remove chunks of configuration without touching anything else. Examples are *.d/ directories like /etc/sysconfig.d/ for kernel config, /etc/pam.d for authentication stack, /etc/init.d/ for many types of init system, /etc/xinetd.d for network-spawned daemons, /etc/modules-load.d/ to specify kernel modules for the initrd, and /etc/profile.d/ for the default user login scripts.
→ More replies (2)
6
u/the_notorious_NRG 13d ago
You will always have windows/ Mac in a studio, I'm part of a team that run rocky 9.5 as our workstation flavour. It means we can standardise across flame/nuke/resolve/Houdini. You will always have edge cases cinema4d, Photoshop and senior artists that can only use a Mac. I've used puppet and salt, both fairly easy to use, probably much easier to make config files with Claude these days. But to kickstart a machine from start to finish in 40mins, is the dream. Pipeline is much easier via Linux, you can't scale as quickly in windows or Mac in my experience.
→ More replies (2)
6
u/jimicus IT Manager 13d ago
I've worked for a couple of companies that made a Linux GUI available to people with varying levels of technical expertise. Generally with great success.
In very general terms, they didn't try to treat it like Windows.
By which I mean they didn't start out with a general purpose operating system that can do more-or-less anything then try and put guardrails in place with GPO.
Instead, they started out with a system that had literally nothing installed and nothing enabled - then they installed and enabled what people needed to do their job.
No more, no less.
It makes for a pretty basic, bare-bones desktop experience - but it also means there aren't a great many avenues open to people to mess up their own computer. And if everyone has clear workflows based around a small, well-defined set of tools, it's not too difficult.
→ More replies (4)2
u/Halomora 13d ago
Nice! Thank you for sharing, that s pretty much the approach i want to follow honestly, try to lock everything possible and incrementaly opens more if there's a clear need. The plan is also to audit our actual GPOs and see which one we need accross OS and which one we can remove too.
3
u/jimicus IT Manager 12d ago
You’re thinking backwards.
Nobody ever started with a full install of KDE with all the bells and whistles. They started with the base DE package and nothing else. No Kde-extras-games.rpm, no Kde-control-panel.rpm, no Kde-backgrounds.rpm no Kde-extra-icons.rpm.
Contrast with Windows which just includes everything and you can’t easily remove it; you have to accept GPOs that block instead.
Didn’t matter if it was Gnome or KDE; the end user wasn’t seeing the control panel anyway.
68
u/hops_on_hops 13d ago
Developers, sure. But why on earth would you do this?
I give it a month before your staff go rouge and buy a bunch of macbook.
72
u/breizhsoldier 13d ago
Why go rouge when they could go jaune or bleu?
→ More replies (1)13
u/dparks71 13d ago
Hey sister, go sister, soul sister, flow sister, gitchie gitche ya ya obviously.
→ More replies (1)9
u/breizhsoldier 13d ago
in strong french accent Oh so he meant the users goes to moulin rouge to have an apple?
4
33
u/Halomora 13d ago
u/janky_koala summarized it well, the bigger studios have already made the move there (like netflix), most of our clients as well. And also we have a team of developper that provides baked in apps for our artists and render servers. And since renders are all linux already then they will only have to support one OS instead of 2. From our execs pov, it s also a good argument to sell the studio to potential clients, kind of like a trend in the industry.
44
u/mknawabi 13d ago
Because Blackmagic and other VFX software companies support Linux as they should.
54
u/janky_koala 13d ago
Most pro studios are on Linux, predominantly Rocky. Often it’s running on workstation clusters in the MER and the users have a lower spec terminal to connect to from.
7
31
u/DDOSBreakfast 13d ago
There is a fairly large push outside of the US to start moving away from US software.
→ More replies (3)4
u/Lemmealonepl0x 13d ago
Besides France switching, what other companies or countries are you aware of that are switching to Linux?
20
u/throwaway117- Jr. Sysadmin 13d ago
China is moving all domestic businesses off windows. That's a BFD
→ More replies (3)15
12
→ More replies (3)13
u/thunderbird32 IT Minion 13d ago
VFX was all done on UNIX in the bad old days, and Linux is more user friendly. They'll be fine.
6
u/flecom Computer Custodial Services 13d ago
IRIX was pretty great, still has a place in my heart, after all "IT'S A UNIX SYSTEM!" lol
→ More replies (1)9
u/ThatDistantStar 13d ago
SGI workstations were purpose build for graphics design. Rocky is just plan ole general purpose Red Hat.
9
u/pdp10 Daemons worry when the wizard is near. 13d ago
SGI workstations were purpose build for graphics design.
Originally they were an M68k on a SUN PM1 motherboard and a custom 3D accelerated framebuffer running commodity Unix. Then they adopted RISC processors, buying out MIPS.
In other words, SGIs were commodity machines with custom graphics hardware from the start. The most relevant difference with today's Linux workstations is that graphics hardware is so specialized that only third-party vendors like Nvidia and AMD have kept making it.
The commercial VFX software vendors originally chose to support Red Hat Linux, not Debian/Ubuntu.
13
10
u/thischildslife Sr. Linux/UNIX Infrastructure engineer 13d ago
We have about 500 Linux CAD workstations for engineers.
I build a kickstart/PXE deployment infrastructure & make custom kickstart.cfg's for each department.
Configure a fresh box to boot PXE, boot it up, select the profile from my grub.cfg menu, give the system a name & walk away. 45 minutes or so later it's done.
→ More replies (2)2
u/Competitive_Knee9890 13d ago
Just out of curiosity, which CAD software do your engineers use on Linux?
I’ve been a long time Linux user and I work as a software engineer, but I graduated in aerospace engineering, they made us use Solidworks at uni, so I was simply running a QEMU/KVM windows vm for that and other annoying exams.
Obviously I parted ways with that industry, but I’m into 3D printing and I still have a decent grasp of CAD concepts.
My obvious choice as a solo hobbyist is FreeCAD, but I was wondering these days if there’s any commercial CAD that supports Linux at scale.lol just saw the post you linked, I work at Red Hat
7
→ More replies (4)3
u/thischildslife Sr. Linux/UNIX Infrastructure engineer 13d ago
They use a LOT of different commercial packages. For CAD is PTC/Creo. Some of the electronics packages are Xilinx Questasim, Vitis, Vivado. Using Parasoft test automation, gitlab-ee/gitlab-runner.
11
u/xfactores 13d ago
I've been managing a fully Linux on Rocky/Alma 9 studio for 3 years now. Started with salt and basic kickstart and moved to Foreman and Ansible. Foreman is good since you can manage updates and lock package versions, it's also much easier than having to maintain a manual kickstart, just click a button, reboot the machine in PXE and half an hour later you have a fresh OS install.
The studio I work at had done the migration from Windows to CentOS 7 before my time so I inherited that, it was a mess of very basic LDAP, misconfigured NFS shares and inexistent security. We moved to FreeIPA from bare LDAP but I wouldn't recommend it, it's a finicky piece of software and since you already have an AD, just go with that. Be careful though, storage sharing is the most tricky part if you want to keep some Windows for those apps that don't work on Linux (Adobe...), misconfigured samba clients can break permissions and you will have users complaining that they can't access that one PSD wrote by the Windows guy.
Another pain point is NVidia drivers, get the .run installer from their sites, don't use the prepackaged drivers you can find in alternatives repos like ELRepo or the cuda repo, idk if you use Houdini and Maya but they have some weird bugs with the prepackaged drivers. And don't use KDE, use Gnome. KDE doesn't ship natively with RHEL9, it's an EPEL addon and isn't well maintained. You can customize Gnome with config files to be more like Windows or macOS, check the addons.
Last I can say is good luck and prepare your help desk team for a mountain of tickets :)
5
u/carlwgeorge 13d ago
KDE doesn't ship natively with RHEL9, it's an EPEL addon and isn't well maintained.
The Fedora KDE SIG puts significant effort into those packages. If you have specific problems, I'm sure they'd like to hear about them.
https://fedoraproject.org/wiki/SIGs/KDE
If the problem is just "it's too old", then there's nothing they can do about it because of the older libraries in RHEL 9. Switching to RHEL 10, with a newer KDE stack in EPEL 10, is the recommended solution.
3
u/pdp10 Daemons worry when the wizard is near. 13d ago
misconfigured NFS shares
storage sharing is the most tricky part if you want to keep some Windows for those apps that don't work on Linux (Adobe...)
Adobe is native on Mac, and Mac natively supports NFS (and Windows supports NFSv3 less natively). However, I'm pretty sure that Adobe still doesn't technically support remote storage, so even if NFS is simple, that doesn't guarantee that it solves your problem.
→ More replies (1)2
u/Halomora 13d ago
That s a great feedback thank you very much! I will have a look into GNOME, choice wasnt mine but by former colleagues and i think they went with KDE because of the esthetic, it looked more like a windows interface.
3
u/segagamer IT Manager 12d ago
Don't go with GNOME - it has very limited usability and accessibility options, including being unable to (easily) set text scaling to anything between 100% and 200%. A joke of a desktop environment.
Stick with KDE.
2
u/Horvaticus Staff SRE 12d ago
I've got some counter advice, you can federate FreeIPA with your AD domain, and carve out a specific domain just for Linux so you don't have a co-mingled environment system wise. AD users will be able to auth into FreeIPA realm joined machines too.
14
u/Dramatika 13d ago
Does the design software your team uses actually support Linux? If you’re counting on compatibility layers or the users learning a new software I’d imagine you’re in for a bad time
21
u/bv728 Jack of All Trades 13d ago
I'd guess they're using Blackmagic Fusion - Blackmagic is recommending studios migrate to Rocky Linux and offers full support on the distro for most of their products. That's literally the only reason I see anyone use Rocky deliberately, but Blackmagic claim they have multiple VFX houses on it now.
5
u/Halomora 13d ago
compatibility layers we are almost there, but users learning AND the desktop team learning as well is going to be a steep curve :/
3
u/Inquisitive_idiot Jr. Sysadmin 13d ago
Yikes.
It’s one thing to migrate when supported software is there.
It’s a 💩 show when you have a migration to duct-taped compatibility solutions.
That’s an easy way to lose your talent*
*bu maybe not in this economy 🤔
→ More replies (2)2
u/khobbits Systems Infrastructure Engineer 13d ago
A lot of the Autodesk software runs perfectly fine on Linux.
The VFX Reference Platform encourages Linux.→ More replies (2)
4
u/GrandpaJoe7 13d ago edited 13d ago
My predecessor started with foreman and puppet and CentOS7 to manage all hardware and VM deployments back in 2015ish (before my time here). We PXE boot for the initial deployment using foreman and then puppet takes over from there and applies configs based on the host group assigned to the endpoint.
We have since migrated to RHEL 9 and Satellite. We also moved from VMWare to OpenShift. Thought about Ansible, but we have so many custom puppet modules, lift and shifting all of that seems like more work than it’s worth right now. The whole puppet/openvox thing may force our hand though.
We aren’t VFX, but we do a lot of image processing in GIS related space and run our own HPC. Before being acquired by a megacorp, all desktop workstations were Linux. Now we have to use Megacorp SOE Windows laptops but end users will RDP into their RHEL Linux workstations or a shared interactive server running Gnome (XRDP works pretty well) to do those workflows. Our network is entirely internal behind the megacorp’s zscaler network so is only accessible from inside.
→ More replies (1)2
u/davy_crockett_slayer 13d ago
Do you guys run iPXE? I've been looking into DeployR.
2
u/GrandpaJoe7 13d ago
Just a simple Kickstart PXElinux BIOS for older machines and UEFI for newer machines. Satellite runs a little tftp server and matches the MAC to the initial boot loader configs for you.
Used to be the same process with VMs on VMWare but for OpenShift Virtualization, we now provision the vm in OpenShift directly with a yaml and the register it back to Satellite to get the host group info and puppet agent for post build configurations.
2
3
u/pacmanlives Alcoholism as a Service 13d ago
I know someone that worked to IBM a while back and they switched all their tech workers(privileged users) over to Linux in like 2014. They had their own spin of RHEL6 this was before IBM bought RedHat. There was some pain at that point with gnome and KDE really not being where they are at these days.
With how much more usable Linux has gotten the past few years. The switch will not be to bad so long as you have good management tools for that single pane of glass. I feel like KDE has been light years a head of Windows for almost a decade
4
u/Relevant_Candidate_4 13d ago
I have to know, what tools are you using that works well in Linux for these VFX artists and animators? They tend to have their favorite workflows in tools that most often are windows or tacos native, usually not cross platformnor linux native, but there are some of course.
→ More replies (14)8
u/janky_koala 13d ago
https://vfxplatform.com specifies agreed industry standards that the big apps contribute too as well. These are THE big players - the likes of Pixar, Framestore, Dreamworks, MPC, etc
The idea is if all the hitters are in agreement, all the vendors will be too. It makes it much easier to build custom pipelines and plugins knowing exactly which packages the main apps utilize now and will use in a few years.
→ More replies (2)3
3
u/Nonaveragemonkey 13d ago
User groups, automation like puppet and sudoers files will give you like 95% of gpo control with half the pains.
4
4
u/jdiscount 13d ago edited 13d ago
I worked at a VFX studio 10+ years ago and we were 90% Linux from the start, just a few windows machines for artists who needed apps like Adobe.
I'm actually pretty shocked to hear of a VFX studio that uses Windows as everyone I knew who worked in other studios was also primarily Linux.
We used CentOS and salt to manage everything so thats irrelevant in 2026.
Personally I'd spend time making terraform and ansible playbooks to codify all aspects of your configuration.
I.e. an ansible playbook for a CG artist, another for a Houdini, another for a Nuke artist etc.
Edit: one thing I remembered was the file share permissions with mixed use SMB/NFS and Linux/Windows/Mac all accessing was a constant fight.
I haven't been in an IT role for a long time and I'd like to think this has improved drastically, but at the same time I feel like the world has moved away from onprem storage so it may not have had much effort in improvement. We moved to a Qumulo storage cluster, and that was somewhat better than Isilon, but still had issues.
→ More replies (1)
4
u/spikyness27 13d ago
Everything is a button, as long as the user can find the button to the application they will be fine.
3
u/billyalt 13d ago
In my experience so long as the software they use is basically the same (I'm assuming your org uses DaVinci Resolve) its really not that hard to get people acclimated.
7
13d ago
[deleted]
15
7
u/Halomora 13d ago
That's the distro we use for our renders and also our regular servers and we deploy them via Puppet/Foreman so the classes we already wrote can be re-used against the future workstations. Also, the remote desktop tool we use for users influenced that choice.
3
u/unquietwiki Jack of All Trades 13d ago
Let's see.... I migrated 2/3rds of a rental car company to Ubuntu years ago. Had to do that without the benefit of fast Internet, so would prepare USB drives with sideloaded updates & visit the sites to image systems one at a time. Not sure if you can build up a decent preinstall with Rocky: that'll save you a bunch of bandwidth and time if you can otherwise. User management... may want to look into doing something with SAMBA/AD: tooling/support for that is better than it was.
3
u/Barrerayy Director of IT 13d ago
Also vfx/animation studio, we did it also. We use Rocky on our workstations and also on all our infra vms. Our thin clients are mac minis.
Pxe booting + kickstart + ansible (also tried salt) has been fairly easy.
pretty standard in vfx tbh
2
u/SilkBC_12345 13d ago
I tried setting up Foreman and kickstart and image via PXEboot a couple months ago to test some things but couldn't never get the imaging to work with UEFI BIOS enabled.
3
u/purestvfx 10d ago edited 10d ago
I work in vfx. Linux is much more suitable for this kind of work than windows, and most artists know this. Also all the bigger vfx companies used Linux. Artist Software is normally managed with a tool called "Rez" which if deployed correctly can significantly reduce the workload on the it department (and is normally managed by a pipeline person)
→ More replies (1)
4
u/doglar_666 13d ago
You might want to look into something like FleetDM for Linux estate management. AD GPO integration via sssd is limited and Intune integration is still quite immature, though I believe Ubuntu is quite well supported.
I would be using Terraform+cloud-init for deployment, then Ansible for configuration management. If bare-metal, definitely a Kickstart file.
2
2
u/Beginning_Lifeguard7 13d ago
Oh this is going to go well, let me get some popcorn. The bosses can push all they want but IT is going to get beat like a rental car. Do you have a training budget for 400 people? Is the IT staff up to speed? Do you have a support team that can handle endless calls because the icon moved or god forbid changed color?
The flavor of Linux is irrelevant. I did a cost study to move my organization to Linux and the math did not math. The lost employee productivity made it obvious to the bosses just how bad that idea was. Oh and moving to Linux is a gift that keeps on giving. You’re going to have to train every new hire. I LOVE Linux, in the data center. On end users desks in a business environment, oh hell no.
→ More replies (1)
2
u/Taboc741 13d ago
I am super interested in what you are using for your VDI stack. I'd love to move some folks to Linux virtual desktops, but I have been unable to get remote screen access to work well in my home lab. I see y'all picked Rocky Linux. Which hypervisor you using? If anyone has a working alternative to AVD on Linux I'm game to hear what tech stack makes this work.
2
u/Halomora 13d ago
look into amazon DCV :)
2
u/Taboc741 13d ago
We can't host anything on Amazon. It's either on-prem (we have proper data centers) or Azure.
I guess technically we could do Oracle or IBM cloud, but fortunately we don't hate ourselves. Dealing with Walmart is funny. Become a big enough supplier and they demand you don't use AWS.
→ More replies (1)
2
u/stobbsm 13d ago
I build images with packer using ansible to get a golden image. If they are on VDI, I’m assuming they already have network home directories, and that’s an easy enough mount to configure.
What’s the backend ID situation? I’m guessing AD, which means your users can join easily enough, just make sure your have AD configured properly for Unix UIDs and GIDs.
You also NEED to test this migration with a test user first to make it pass a technical feasibility pilot, and then get an actual artist who will be using it migrated once you have the technical issues worked out. This is your first UAT.
Iterate, and if you think it’s going to take 2 weeks, double it. Anything more than that, add an extra week. You will likely need it, as it’s not a matter of IF something breaks, but WHEN.
TLDR; have a solid plan, test it without an artist first, then test it with one artist, and keep soliciting feedback to understand the shortcomings.
2
u/Toto_nemisis 13d ago
I dont want to IMAGINE the questions you are going to get... all thw dumb questions!
Where is my one drive, where is "my documents", why is my computer deive now labeled Fedora and not the Cdrive. Why doesnt my Adobe work?!
At 50 people, sure. But 400.... I wpuld need an army of people to support it lol
2
u/nomaddave 13d ago
A lot of Ansible Tower work back in the day. It's probably not changed too much. But it is not easy - that's the wrong question to ask, IMO. It's just worth all the work for what you have on the other side.
I wouldn't try to find a way to 1:1 convert policies, though. It's not going to work well. Rather, treat it like a greenfield project as long as everyone has access/software they need. Chances are in most enterprises there's a ton of cruft that should just be discarded and it's not generally work sorting through, IMO.
2
u/HappierShibe Database Admin 13d ago
I've been involved in two windows to linux rollouts, one stuck the other rolled back to windows after three months. As long as management understands that the money they save on licensing and support packages they are going to spend on training and in house support, then linux can work as long as the userbase has the technical knowhow, computer literacy, and a willingness to learn new systems; AND it can be a net positive for the organization. If the users aren't supported with extensive training, or management thinks it's a free ride- be ready to rollback next quarter.
What Linux flavor, did you end up on, and would you pick the same again?
The successful one we went with RHEL for workstations, and I think it's probably the best choice for a large organization. The support we got from Redhat was top notch, and we absolutely needed it.
How did you handle what GPOs used to give you?
We preconfigured an image, and mapped a home directory at the user level. Everyone got a clean machine from the base image with their home directory mapped in on boot, and everyones system got booted at 4:00AM; no exceptions. There are almost certainly better ways to do this, but it was simple to setup and met our needs.
For the Base OS deployment/imaging, did you use Kickstart + Puppet/Ansible, or something else?
We used a RHEL solution, I do not remember what it's called, they probably have something newer now.
Anything that looked easy on paper and turned into a one big pile of {Jurassic_Park}?
By and large everything worked pretty well at a technical level, we had application specific struggles, but they were all addressable.
The big surprise for me was how utterly impossible it was for some users to learn a new operating system no matter how much training you gave them. Working in IT we largely work with a cohort that is open to new ideas and new ways of doing things, not everyone in IT is possesed of a great intellect, but even the densest of hardware maintenance techs in the dankest and most poorly run datacenters have some capacity for learning new technologies or adapting to different ways of doing things- if you don't you won't be in this field for more than 18 months before you start to fail at your job.
This is not true of other areas of specialization, in many careers you can cruise along for 40 or 60 years, and never have to learn a truly new way of thinking or operating. These users will be your greatest challenge in migrating a typical organization to linux.
2
u/bloodguard 13d ago
Almost all the applications our non-developer users need for their work are used via a browser (email, calendar, docs, accounting, project management etc.). So far we're not forcing them off of windows but we're slowly introducing it to willing victims users. I definitely think that Windows 11 is the last version we're going to license from Microsoft.
Deployment, updates and maintenance is via ansible. All desktops (windows and linux) are managed through a cluster of Samba AD servers. Still managed via Windows RSAT. If anyone can recommend a decent open source web based replacement for RSAT I'm all ears.
2
u/khobbits Systems Infrastructure Engineer 13d ago
I'm currently building out a fairly new studio.
The company is mostly Ex Mill/MPC/Technicolor staff, so they know how it works, we just need to build something that can be 100% consistent.
It's my second time building the automation from scratch, so it's mostly mundane at this point, it's just building all the building blocks again, to handle different edge cases.
Things are going reasonably well, there has been a lot of "We used to do X, can we do that here as well?", which is mostly positive, as we pretty much can.
We're going down the same route:
Deploying Rocky 9
Foreman for PXEBoot + Puppet Management
Ansible for things we do 'once', or one per machine, like configuring hypervisors.
The only thing I wished I'd done in advance, was re-read the TPN, before building some stuff, as I've had to move some things again, after building workflows.
I've found things like Claude can help diagnose issues in deployment far quicker than I can.
For example giving it an export of SELinux Permissive SOAK, and having it build the rules for me.
Basically anything where it consume/search lots of content and draw data out of them.
I recently gave it access to scrape Prometheus, and told it that a "workstation was running slow", and it came back in a couple minutes saying that there was a flapping uplink in a bond that was causing issues, exactly at the same time as the initial user login PCOIP session started.
2
u/Halomora 13d ago
thank you for sharing, that's sounds very similar :) what do you guys use for remote access for users ?
2
u/khobbits Systems Infrastructure Engineer 13d ago
We're using PCoIP/HP Anywhere.
It's EOL, but we have enough licenses for the time being.Don't have an answer on the next step.
→ More replies (1)
2
2
u/MainRoutine2068 13d ago
We did an exploration before, but given the vast amount of different use case, application compatibility, and edge cases. We end up moving to Mac instead
2
u/P00351 13d ago
The French gendarmerie did a migration of several thousands of machines 20 years ago. See for example https://interoperable-europe.ec.europa.eu/sites/default/files/document/2012-02/IDABC.OSOR.casestudy.Gendarmerie.10.pdf
2
u/trippedonatater 13d ago
Read through your virtualization providers docs. They should have recommendations on some of these things.
I have deployed Linux VDIs before. I did Packer + Ansible for building base Linux images. NFS for persistent home directories. Then deployed and managed deployments with Terraform (this one, especially, can vary based on platform, though).
If you are keeping AD and Windows server infrastructure, there's some GPOs around access control and login that could be picked up by sssd.
That said I would not for the most part try to copy what you were doing with each GPO one by one and translate that to Linux. I would look at what, generally, you were trying to do with GPOs (system hardening, admin rights, etc.) and then research the proper way to do each of those things in a Linux/Unix environment. Linux permissions tend to be implemented pretty differently than Windows ones.
As step 1, maybe make sure you have really great and regular backups on both the old and new systems.
3
2
u/dgibbons0 13d ago
Two decades ago, it was centos and cfengine for management. Probably not that useful these days...
2
u/AtTheRogersCup2022 12d ago
Reference the vfx platform and have your pipeline and software team lead the testing of all DCCs before you land on a distribution.
Rocky is a safe bet, some places prefer Alma but you will likely land on RHEL.
2
u/virtualbitz2048 Principal Arsehole 12d ago
You're doing VFX in VDI?? I had a customer that I could never make happy. It came down to H264 and bitrate limitations, along with a lot of CPU driven workflows that were too expensive. Do tell, who's hosting this, how much does it cost, what platform are you using
→ More replies (3)
2
u/NEWREGARD 12d ago
I just pray for your own sanity, you’re not also on the helpdesk for that first few months of transition.
4
u/speedstic Sr. Googler 13d ago
I once asked users to try LibreOffice.
We don't talk about that anymore...
7
3
u/Waste_Development971 13d ago
dude
When im broke and refuse to use adobe, I tried using for a pdf
jesus christ.
Everytime I see people go "its so good" im baffled
2
u/speedstic Sr. Googler 13d ago
I use gimp and inkscape for any kind of image editing. If you can get through the quirks of gimp it's the same as PS more or less and inkscape is super easy to use.
Photopea.com is also good and free for a web based image editor and was made by one guy which baffles my mind.
5
3
u/FourtyMichaelMichael 13d ago
gimp and inkscape
Easily the two most off putting UI/UX applications in existance.
Just know that YOU are not a normal user, and your brain does not work like theirs, that was probably obvious, but know that yours isn't "better".
Agree with other guy, Krita is the shit.
→ More replies (1)
6
u/Accomplished_Disk475 13d ago
I have a hard time imagining end users on Linux distros. Mine can't figure out Windows which they've grown up on.
23
u/techw1z 13d ago
the less people know about windows the easier it is to switch them to linux
all they need to do is click desktop icons anyway. (assuming you can find the same software for linux, otherwise it's really more about adapting to a new software with different UI, just like they would have to if you switch to a different software on windows)
10
u/thunderbird32 IT Minion 13d ago
Their industry used to be all (or at least largely) UNIX. VFX was once the land of Silicon Graphics. People now aren't any less tech savvy, and Linux is probably more user friendly than IRIX was. They'll figure it out.
4
u/jfoust2 13d ago
Well, actually... Back in the day if you could afford an SGI workstation and the software your artist was using, then you could certainly afford a little PC off to the side if they needed to check email.
5
u/WantDebianThanks 13d ago
With how much of people's jobs are done on web pages these days, I best deb in accounting wouldn't even notice
2
u/ansibleloop 13d ago
KDE uses the same interface style as windows for the most part
Even the key bindings work the same
2
u/Pazuuuzu 13d ago
To be fair at times even I have to stop and wonder where MS put things again... It's like a never ending Easter egg hunt...
→ More replies (1)→ More replies (1)2
u/JimFknLahey 13d ago
only thing i can think of on that front is wine/proton has come a long, long, long, long way recently.
2
u/Bladelink 13d ago
Honestly I think the strides that Valve has made with Proton have been a huge deal. Sort of like when people didn't want to cut cable because of sports, people couldn't switch off windows because of gaming. But that hurdle has now been more or less removed.
2
u/mangonacre Jack of All Trades 12d ago
As well as desktop experience. I have a Framework running Ubuntu, and the "Framework" key (where the Windows key is otherwise) operates exactly like Windows at least in the few I've used. Alt-tab works the same, and others. I still struggle with the Macbook I've had for years, but this one is very intuitive for me.
8
u/armaghetto 13d ago
https://giphy.com/gifs/s239QJIh56sRW
clicked into this post just to make sure I read it correctly
→ More replies (7)14
u/Halomora 13d ago
the bigger studios have already made the move there (like netflix), most of our clients as well. And also we have a team of developper that provides baked in apps for our artists and render servers. And since renders are all linux already then they will only have to support one OS instead of 2. From our execs pov, it s also a good argument to sell the studio to potential clients, kind of like a trend in the industry.
3
u/m0os3e 13d ago
How much testing have been done with applications compatibility for Roxky Linux,l?
I love Linux but not sure I would recommend an artist studio to migrate to it.
For end point management I would use ansible and build playbooks.
5
u/Halomora 13d ago
The team responsible for developping apps for our artists are most of them technical artists so they do all the testing, which helped tremendously to pick the linux flavor and also let my team focus on the infrastructure part.
→ More replies (7)
2
u/TechnicaVivunt Intune Shenaniganator 13d ago
FleetDM and best of luck?
2
u/Halomora 13d ago
That looks like a nice tool, did you use it yourself already ?
→ More replies (1)
2
u/Skyhound555 Sr. Sysadmin 13d ago
This is becoming more and more common because no one can afford the proprietary stuff anymore. My entire organization is trying to swap to anything-linux to get rid of the costs.
I may get downvoted for this, but effective AI prompting will help a ton.
The problem is it is so new that there is very little experience in this. A lot of theory and it should work. However, there isn't much out there readily available. There is no Microsoft Learn for Linux.
Learn Linux fundamentals and use those to blaze your own trail. You can leverage AI to support you as well.
1
u/frzen 13d ago
What remote access application are you using?
will your EDR have any tools to enforce configs / compliance or is that something you're looking to just set, or set and monitor, or set and monitor and remediate?
It's a different use case to you but I've been playing with NixOS and doing health checks remotely by having a central server deploying with --target-host so your desired state is basically constantly being monitored / pushed
has a billion edge cases for how users can break it but for me it's more about configuration drift etc and obviously it wouldn't work if you've settled on rocky but I wouldn't shrug at using nix itself for some part of this
→ More replies (1)
1
u/Mr_Squinty 13d ago
I did this at school in the early 2000s, it went really badly. We used the LTSP red hat distribution iirc
→ More replies (2)
1
1
u/Lost_Term_8080 13d ago
Trying to figure out what the business requirement or analysis was for this.
1
u/Into_the_groove 13d ago
is there an GPU or no GPU?
Gnome 3 and KDE really require a GPU to function well. Mate you can do pure CPU, with no GPU.
We have over 30k linux citrix vdi. we use mostly alma 8, but have used rocky 8/9 for other builds for engineering.
→ More replies (1)
1
u/missed_sla 13d ago
I can only imagine testing this with my users, who need step by step instructions with screenshots and arrows and a paragraph next to each one, explaining what each one is. The people who call the start menu "the four squares button". The people who use caps lock to type every upper case letter. The ones who can't figure out how to make a call on an iphone.
Yeah, no. I hate Windows, but I wouldn't survive that transition.
1
1
u/crankysysadmin sysadmin herder 13d ago
Are you doing VDI, but with linux, or dumping VDI and running linux on workstations? Does this mean a big hardware swap out then?
→ More replies (3)
314
u/bakonpie 13d ago
I'd like to know what your prototype and pilot deployment looked like