Personally, I use Rocky Linux on my servers. It’s stable, and has plenty of support since it’s RHEL-based. It’s supported until 2030 or so, and it doesn’t have any of the cloud-init or netplan stuff that Ubuntu Server has.

It’s also pretty simple to set up docker/podman containers, although you need the EPEL for podman-compose and for a lot of other packages, but once you get your setup the way you like it, it just keeps running and running.

If you are already familiar with one package manager, pick a distro that also uses that package manager.

When deciding on the release track, the harder it is to recover the system, the more stable the track should be. Stable does not imply secure.

As you move up through virtualization layers, the less stable the track needs to be, allowing access to more recent features.

Steer clear of distros that pride themselves on using musl. It's historically slow and incomplete. Don't buy into the marketing.

Think about IaC. Remote management is a lot more comfortable if you can consider your server ephemeral. You'll appreciate the work on the day you need to upgrade to a new major release of the distro.

Debian but mostly Ubuntu LTS with the free Ubuntu Pro that gives 10-year support. If I get hit by a bus, chances are the self-hosted systems I've setup would continue to work for years till my family can get someone to support or migrate the data. 😅

@communism
I use alpine, but void is a good option too, for me the host should be minimal and lightweight. At the end I have all on containers

Ubuntu server, though I am thinking of using arch even though it is a rolling distro. It doesn't really matter. As long as docker is supported, I am fine using any.

Devuan. If you need stable, and you like runit, thats the easiest option.

Debian isn't unsecure because security updates for packages are still received.

I use arch on my servers. It is the distro I am most used too, because I use it also as my daily driver.

Used to be CentOS until the stream debacle. Now Debian.

Been running Ubuntu LTS releases on all my server VMs for 8 years and haven't had a single problem. Absolutely solid as a rock. Fantastic support, loads of guides to do anything. Plus you can get 10years of support as a home user with a free Ubuntu Pro subscription.

I always use Rocky Linux or Alma Linux, since I have extensive experience with enterprise Linux and RPM packages. I have Fedora on my main desktop computer. Both Rocky Linux and Alma Linux are rock-solid and are ideal for any kind of workload.

Also, Debian is a good choice if you know how to manage DEB packages and you feel comfortable with APT.

Fedora is a good choice if you want fresh packages and are willing to upgrade your server every 6 months (following the Fedora release cycle).

Rocky Linux and Alma Linux follow a similar slow release cycle of RHEL, wherein you can install your server and not have to worry for years (as long as the packages are updated with dnf update) Debian is also a slow release distribution, which makes it good for servers.

Arch. With testing repos. And somehow, it also just works.

Mint on the Desktop, FreeBSD on the server. Amazingly stable.

Red Hat, because it's free for developers and used by a lot of enterprises.

I won't say which one, but I'll give you a hint as to why:

rpm -Vp https://...

It's what got me off Slackware, and it's true today. If the distro can't support that kind of check, it's dead to me.

Rocky and now moving too OpenSuse leap micro to move into immutable OS deployments.

Its all RKE2 (a k8s distro) on top anyways, so its very minor mods underneath, and base updates so I really want to maximize reproducibility and minim8ze attack surface.

openSUSE Leap - YaST is the greatest thing since sliced bread, and works great on command line over SSH. Yes, sometimes installing some software is difficult, but generally most stuff you would want is there and a lot of stuff runs on Docker anyway now. Very stable too, have had nearly zero issues.

I guess you could use something like those new immutable distros to move away from state and related vulnerabilities. TBH there are plenty of hardening guides for Debian.

Or you could use any hardened version of Fedora which gets security fixes quicker, and then harden it some more yourself. The good part about Debian is that you are free to use SysVInit, I do not know if you could do that on Fedora. I do not think Systemd is a massive risk (if they have reached Systemd you have many other, bigger problems to think of).

I think I should study some more about Fedora. I run k3s on top and will go through their CISA hardening guide at some point to round things out.