Why choose OpenBSD?
OpenBSD places emphasis on code correctness and security. Choose it when the workload and your operational experience align with its supported software and administration practices.
Keep the system supported
Stay within the supported release window, apply available security fixes and test upgrades. A minimal installation still needs a firewall policy, access controls and reliable backups.
A good workload fit
Gateways, small network services, security research labs and carefully scoped internet-facing applications are common reasons to evaluate it. Confirm required drivers and application support first.
Secure the first login
Verify the SSH host key through a trusted channel where available. Add your own public key, use a unique administrative account and limit inbound ports to the services you actually run. Keep a tested path back in before changing firewall or authentication settings.
A focused base or a focused network service
Specialist setups can include a supported OpenBSD base, httpd with certificate automation or a relayd proxy setup. They have different responsibilities: serving content, renewing certificates and forwarding traffic all need an operator and a test plan.
Keep the release window visible
OpenBSD release support changes over time. Verify the current supported version and errata at deployment. Review the actual configuration rather than assuming a security-focused operating system makes an exposed application safe automatically.
Extended image variants
These specialist variants differ from the six Linux choices in the configurator. Confirm the requested image is available, uses a supported release and has compatible drivers and a documented update path.
- OpenBSD base release
- OpenBSD prior-release migration target
- OpenBSD + httpd / acme-client
- OpenBSD + relayd
Update older runbooks before deployment
OpenBSD 7.6 and 7.5 labels can appear in older instructions. Verify support and use a maintained release for a new installation. An httpd or relayd image concept should be rebuilt and tested against the actual supported release rather than preserving an obsolete version because a tutorial used it.