Yocto
When Linux is to be an integral part of a product, we want to know exactly what is running on the device. With Yocto we can build a Linux system specifically for the product's hardware and function. That gives control over the software, reproducible production and a solid foundation for secure maintenance throughout the product's lifetime.
Yocto
A Linux system built for the product
The Yocto Project is not a Linux distribution like Ubuntu or Debian. It is a build system and a framework for building your own Linux distribution for a specific product.
Only what is needed
A Linux image made for the product
Reproducible production
Version-controlled production images
Several hardware versions
BSPs and variants in the same build system
Security over time
Secure boot, signed updates and CVE tracking
A Linux image made for the product
That is exactly why Yocto is interesting to us at Move.
Instead of installing a general-purpose Linux distribution and then removing or disabling the things the product does not need, we can define precisely what should be part of the system.
Kernel, drivers, libraries, services, applications and configuration become part of a controlled build recipe.
The result is a Linux image made for the product.
We decide 100% of what runs
In an embedded product there is rarely any benefit in installing software that is never used.
With Yocto we can choose exactly the components and services that should be included. If the product does not need Bluetooth, a web server, a graphical desktop or particular system services, they do not have to exist in the image.
That gives a smaller and more manageable system.
We also have control over the version numbers of the software packages used. That makes it easier to understand exactly what software is in a particular product and a particular release.
Yocto works with a layer-based build system in which, for example, the hardware/BSP, product configuration, middleware and Move's own application can be kept separate. That makes it possible to reuse parts of the platform while managing product-specific differences.
A big advantage in production
When a product is to be manufactured in hundreds or thousands of units, reproducibility matters.
The production department should not have to install Linux by hand and then work through a long list of configuration changes. The intended system should be generated as a finished, version-controlled production image.
With Yocto the build configuration can be stored alongside the product's other source code and documentation. If, for example, we manufacture hardware revision 2.1 with software release 3.4, it can be defined precisely which Linux image belongs to that combination.
That is also valuable many years later.
If a product has to be manufactured again or needs a security update, we must be able to understand how the original software was built. Yocto has a strong focus on reproducible builds, where the same defined input should give the same binary output. That makes changes and subsequent validation far more controllable.
Several hardware versions can be handled in a controlled way
Products change over their lifetime.
A compute module may be replaced, a new hardware revision may get a different Ethernet controller, or the product may exist in several variants.
With Yocto we can maintain different BSPs and product configurations within the same overall software project.
That makes it possible to produce the correct image for each hardware version without a series of manually adapted Linux installations in circulation.
Together with a device management system, we can also keep track of which hardware and software is on the products already installed at customers' sites.
A smaller system means a smaller attack surface
Yocto is also interesting from a cybersecurity point of view.
A basic security strategy is to install only what the product actually needs. If a service or software package is not on the system, a vulnerability in it cannot be exploited either.
That does not mean a Yocto system is automatically secure. But it lets us build security into the operating system from the start.
For example, we can work with:
- only the necessary services and network ports
- a read-only root filesystem, where relevant
- user and permission management
- secure boot, if the hardware supports it
- signed software and firmware updates
- individual credentials and certificates
- security hardening of the kernel and software
- logging and monitoring
- control over installed software packages and versions
The Yocto Project itself recommends, among other things, removing unnecessary software and debugging functionality from production images, shutting down services that are not used and using hardware-based secure boot where the platform supports it.
Keeping on top of vulnerabilities over the product's lifetime
Security does not stop once the product has been manufactured.
New vulnerabilities are continually found in the Linux kernel, libraries and open-source components. The manufacturer therefore needs to know which components and versions are in the various software releases.
Yocto has tools and workflows for working with known CVEs and security updates. That makes it possible to assess whether a published vulnerability actually affects the products installed in the market.
This fits well with modern requirements for vulnerability management and, for example, the EU's Cyber Resilience Act, under which connected products increasingly have to be kept secure through their support period.
Yocto gives control throughout the product's lifecycle
For us, Yocto is particularly interesting when Linux is not just a computer standing next to the product, but part of the product itself.
Here the operating system has to be treated in the same way as electronics, mechanics and embedded software: it has to be version-controlled, tested, documented, released to production and maintainable for many years to come.
At Move we can work with the whole chain, from choosing the compute module and BSP to the Yocto image, embedded applications, secure boot, production, remote updates and device management.
The result is a Linux platform where we have control over both what is installed on the production line today and what will need to be maintained at the customer's site in the future.
Frequently asked questions
What is Yocto?
The Yocto Project is an open-source framework for building tailor-made Linux systems for embedded and IoT products. It is not a ready-made Linux distribution.
Why use Yocto instead of Ubuntu or Debian?
If the device is a product, Yocto gives far greater control over exactly which components, versions and services are in the system. A general-purpose distribution can be a better choice in other situations, so the choice depends on the needs of the product.
What is the advantage of Yocto in production?
We can build and version-control a defined production image. That makes installation reproducible and reduces the need to configure each manufactured unit by hand.
Can Yocto handle several hardware versions?
Yes. Different BSPs and configurations can be used for different hardware platforms and product variants within the same overall build system.
Is Yocto more secure?
Yocto gives good opportunities to build a minimal, hardened system, but security still depends on the specific implementation. An important advantage is that unnecessary packages, services and functions can be left out entirely.
Can you do remote updates on a Yocto system?
Yes. Yocto can be part of an architecture with OTA updates, signed images, rollback and device management. The specific update mechanism is chosen based on the product's security and operational requirements.
Can you keep track of known security vulnerabilities?
Yes. Yocto supports workflows for CVE tracking and makes it possible to keep track of the components and software versions that go into a particular image.
Shall we turn your idea into reality?
Technical development takes more than good ideas — it takes the right skills. We have gathered hardware, software and engineering expertise under one roof, so you get from prototype to production quickly and safely.
Reach out to us →