Frequently asked questions

Got a question? We may already have an answer!

We've collected a number of questions we frequently get about Visar, DeeDee, and our approach here on this page. To make it a little easier to navigate, we've broken it down into a couple of topics that group up related questions under one heading.

Didn't find your answer here? Contact us!

DeeDee's tech

  • How does DeeDee work in a containerized context?
    DeeDee can be used as a container base image for your containerized applications or as a container runtime environment.
  • What software exists in DeeDee?
    DeeDee consists of a curated subset of the software in Debian. Debian is one of the world's largest software repositories, but the packages used in common real-life workloads represent a fraction of the entire archive.

    In order to handle this, DeeDee brings the commonly used packages under its support umbrella and leaves the rest as unsupported but still available to the end user.
  • How does DeeDee section its software?
    In contrast to Debian, which sections its software based on license, DeeDee sections it based on use case. We have three primary sections in DeeDee - "core", "service", and "tool".

    "core" consists of the packages absolutely required to bring a DeeDee system to an interactive shell.

    "service" consists of commonly used packages that make a computer do useful things, such as a web server, an SQL database, or a message broker.

    "tool" consists of commonly used packages that lets an operator do useful things, such as a desktop environment, a terminal emulator, or system administration utilities.

    All other software is placed in the "extra" component - still available, still installable, still usable, but not considered part of DeeDee and its support umbrella.
  • Which CPU families does DeeDee support?
    We support all CPU families that Debian supports, which is practically all commonly used architectures in modern computers.
  • How small can you make DeeDee?
    Pretty small. A fresh, non-embedded installation of DeeDee is less than 300 packages, 10 systemd services, and uses about 500MB of disk space and 256MB of RAM.

    This can be reduced further for resource-constrained environments.
  • Can DeeDee be used for embedded systems?
    Yes! DeeDee has a very small footprint in its minimal state and can be reduced even further for embedded environments. DeeDee also supports common embedded CPU architectures like ARM and RISC-V.
  • Does DeeDee have a realtime kernel?
    Yes! Debian provides an alternative kernel package with realtime features enabled which is also available in DeeDee.

    We add our own security hardening configuration on top of the realtime kernel, same as with the normal kernel.
  • Is DeeDee reproducible?
    Almost. All packages included in DeeDee must either be reproducible or have a valid reproducibility exception in Debian.

    Our own packages and build artifacts have a hard  requirement on reproducibility, ensuring that you can always check our work.
  • Are you using SELinux or AppArmor?
    At the moment, neither. We reach a comparable level of security by utilizing systemd's sandboxing and hardening features, which use the same mechanisms for mandatory access control under the hood.

    This way, we avoid many of the pitfalls with SELinux for end users while at the same time having tailored, service-specific hardening in place to protect against zero-days and general misbehaviour from a system service.
  • Will you add SELinux or AppArmor support?
    Yes, we plan on having one of these available and configured by default. You can always install and apply your own policies, regardless of what we do.

DeeDee's design

  • Where in the tech stack does DeeDee belong?
    DeeDee sits between your hardware (virtualized or real) and your applications, supplying basic services that enable real workloads to run.
  • How does DeeDee handle vulnerability management?
    DeeDee uses SBOMs of its repositories and packages together with open vulnerability data sources to identify, classify, and handle vulnerabilities as they are discovered.

    For our commercial customers, we take on the responsibility of reporting any such vulnerabilities to ENISA and CERT-SE alongside providing mitigation actions and security patches. 

    For vulnerability management of production environments, we offer DeeDee Inspect as an Integrated component to generate, enrich, and manage OBOMs within your own environment.
  • What is DeeDee Approved?
    DeeDee Approved is our term for software that has been selected, curated, configured, and validated for use with DeeDee.

    Approved software can come from the Debian repositories or from external sources, and is the first level of specific work we add to a piece of software in DeeDee. We do not integrate Approved software with other software other than what is required for it to function in its minimal state and to comply with applicable cybersecurity standards.
  • What is DeeDee Integrated?
    DeeDee Integrated is a system-level building block that you can use to rapidly construct an application platform for your actual workload.

    Integrated components are typically based on an open-source base software with added security hardening, compliance documentation, and full functional integration with other Integrated components available in DeeDee. These components are also covered by commercial support from Visar.

    The open-source base software is almost always available as a DeeDee Approved component to all users of DeeDee.

DeeDee's governance

  • Is DeeDee based on Debian Stable or Testing?
    DeeDee is based on Debian Stable.
  • What does the release cycle for DeeDee look like?
    DeeDee tracks the release cycle of Debian Stable.
  • What does the support period for DeeDee look like?
    DeeDee follows the LTS support period for Debian with longer support periods available for enterprise customers.
  • Is DeeDee a hard fork from Debian?
    No. DeeDee's closest analogy in the Debian ecosystem is a Debian Blend, where a downstream distribution still uses Debian's packages, follows Debian's governance, and actively participates in Debian's development.

    We do all three in addition to adding our own packages to the Debian base and offering commercial support.
  • Why did you choose Debian as your base?
    Debian is one of the world's most battle-tested, stable, and boring choices for a Linux deployment. Our users want no surprises, minimal changes, and maximum compatibility.

    Stable doesn't just mean feature stability - important as that is - but also runtime stability. Debian has proven itself in environments from the deepest mines to the international space station and is the natural choice if you want a system that plans for decades of use.
  • Isn't Debian slow to update its software?
    Kinda. Debian freezes feature updates during its release cycle, but that doesn't mean bug fixes and security patches stop.

    Debian's release cadence for non-feature changes is counted in hours, not years, and is deployed to end users rapidly and effectively without causing operational changes to production systems.

Visar's governance

  • Is Visar a private company?
    Yes. Visar is incorporated as a limited liability company in Sweden, which is part of the European Union.
  • Who owns Visar?
    Visar is owned by private individuals with a long history in defense, the public sector, and the open-source community.
  • Why isn't Visar a non-profit organization?
    We believe a for-profit organization offers us more flexibility in our choices and methodology to bring better security to more people faster.

    That said, Visar prioritizes reinvestment of its earnings into its products and the open-source ecosystem.
  • What's Visar's stance on AI?
    Visar takes a strong stance on AI usage and does not permit the use of unethically sourced, trained, or developed AI models in its products.

    AI as a technology can be used to greatly accelerate many workloads. However, we believe that speed should not outweigh responsibility, ethics, and accountability.

    Additionally, we do not train models on or use user data in inference unless explicit consent has been given by the data owner. 

    If you would like to read more about this, please refer to our full AI usage policy which goes into full detail on our position.

Open source

  • Is Visar an open-source company?
    Yes! Open-source lives at the heart of our products, our culture, and our philosophy.
  • Does Visar contribute to open-source projects?
    Yes! We actively participate in the development and maintenance of several open-source projects, and strive to upstream any relevant code that we produce.
  • What does Visar contribute upstream?
    We primarily contribute security-related changes, bug fixes, and Debian packaging material.

    In general, if we develop an improvement to existing software that is generally applicable to users outside of DeeDee, we will make every effort to send that patch upstream.
  • What does Visar release as open-source?
    Beyond patches to existing software, Visar releases any software it develops that is generally applicable to users outside of DeeDee under an open-source license on our Git server.

    Additionally, all DeeDee-specific security or security-affecting configuration is released to the public.
  • What does Visar not release as open-source?
    Tools, features, or cross-component integrations only applicable to commercial users of DeeDee is typically not released as an open-source project.
  • Do I get access to the source code of commercial components as a customer?
    Yes! As a customer, you get full access to every line of code from us that runs on your systems with all the tools required to build it from source - no exceptions.
  • Which license does Visar release code under?
    Visar releases code under a variety of licenses depending on the type of open-source contribution. If it is a patch to an existing project, we follow any requirements set out by that project and typically contribute the code under the most permissive license alternative already in use by the project.

    For our own code, we favor strong copyleft licenses such as the Affero GNU General Public License (AGPL) for the equal rights it afforts to all users of the software, be they past, present, or future.

Compliance

  • How does DeeDee handle SBOMs?
    Visar continuously generates SBOMs for every package released as part of DeeDee, including all packages in the "extra" section.

    Practically, this means that we offer SBOMs for every package in Debian, DeeDee, and all of our Integrated components with fully enriched metadata regarding licenses, pedigree, and dependencies.

    Additionally, we generate a repository snapshot SBOM every time we update our published packages, so you can see which packages were available and which vulnerabilities were relevant at any point in DeeDee's lifecycle.
  • How does DeeDee handle OBOMs?
    DeeDee offers tools to generate and manage OBOMs of your production environments as part of DeeDee Inspect, our Integrated component for dependency tracking.

    These OBOMs are generated every time a system-level change is applied (such as a configuration change or package update) and can optionally be uploaded to an external SBOM management server.
A stylised drawing of an armadillo's face in light grey on a dark gray background. The face is set to the left, next to the text



© Copyright 2025 Visar Systems AB - All rights reserved