You switched to Fedora six months ago because Windows Update restarted your machine during a presentation, or macOS refused to let you install a driver. You've survived the initial setup. You know sudo and you've run dnf install a few times. Now you're hitting the second wall. You need a proprietary codec for a video, a game won't launch because of a missing library, or SELinux denied access to a folder you just created. The system feels locked down, and the wiki answers assume you know what a "transaction" or a "context" is. This is where the daily driver friction lives. Fedora isn't broken. It's just enforcing rules that Windows and macOS ignore.
What's actually happening
Fedora prioritizes stability, security, and upstream alignment over out-of-the-box convenience for proprietary software. The default installation contains only free and open-source software. This means multimedia codecs, NVIDIA drivers, and some popular apps are not in the base repositories. The package manager, DNF, enforces strict dependency resolution. SELinux enforces mandatory access control, which means file permissions are not the only gatekeeper. The firewall uses zones rather than simple allow/deny lists.
These choices keep the system secure and predictable. They also mean you have to explicitly opt-in to features that other distros include by default. The adjustment is learning where the defaults end and where your configuration begins. Fedora gives you a clean base. You add the complexity you need, and you keep the complexity you don't.
Software installation and package management
Software on Fedora comes from three sources. System packages live in /usr/bin and are managed by DNF. Sandboxed apps live in ~/.local/share/flatpak and are managed by Flatpak. Portable binaries run directly and leave no trace. Use DNF for system tools, libraries, and core applications. Use Flatpak for user-facing apps that need sandboxing or frequent updates. Use AppImage only when a package does not exist elsewhere.
DNF keeps a transaction history. You can undo a bad install. This is a superpower compared to manual installs. If a package breaks your system, you can roll back the transaction without reinstalling.
Here's how to update your system and refresh the metadata to ensure you get the latest package versions.
# Force metadata refresh to avoid stale cache issues, then upgrade all packages
sudo dnf upgrade --refresh
Here's how to install a system package from the official repositories.
# Install VLC from the official Fedora repositories
sudo dnf install vlc
Here's how to add Flathub and install a sandboxed application.
# Add Flathub remote if it does not exist, then install Spotify as a sandboxed application
flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak install flathub com.spotify.Client
Flatpak apps run in a sandbox. They cannot access your home directory by default. This is a feature. If an app needs access, you grant it explicitly. This prevents data leaks and malware persistence. If an app complains about missing files, check the sandbox permissions before blaming the app.
Run dnf upgrade --refresh weekly. Stale metadata causes dependency hell.
Enable RPM Fusion for proprietary software
Fedora does not ship proprietary software. RPM Fusion bridges the gap. It provides NVIDIA drivers, multimedia codecs, and some non-free applications. Enabling RPM Fusion is safe and standard practice for daily drivers. The repositories are community-maintained and align with Fedora releases.
Here's how to install the RPM Fusion release packages for the current Fedora version.
# Install RPM Fusion free and nonfree release packages using the current release number
sudo dnf install \
https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm \
https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
The $(rpm -E %fedora) expansion returns the current release number, ensuring the correct repository file is installed. This command works across releases without manual editing.
Here's how to install the multimedia group to get codecs for video playback and audio encoding.
# Install the multimedia group which includes common codecs and plugins
sudo dnf groupinstall "Multimedia"
Verify the repositories are active.
# List enabled repositories to confirm RPM Fusion appears in the output
dnf repolist
Enable RPM Fusion early. You will need codecs before you realize you need them.
SELinux: mandatory access control
SELinux is not a suggestion. It is a mandatory access control system. Disabling it removes a critical layer of security and breaks assumptions made by many Fedora packages. When an application fails to access a file despite correct POSIX permissions, SELinux is usually the cause. The error appears in the journal with a specific denial message.
You will see errors like this in the journal:
type=AVC msg=audit(1710000000.000:123): avc: denied { read } for pid=4567 comm="firefox" name="index.html" dev="sda1" ino=12345 scontext=system_u:system_r:unconfined_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0
SELinux contexts are labels attached to files and processes. The policy defines which labels can interact. When you move a file, the context might not update. restorecon fixes this. When you compile software, the binary might have the wrong context. restorecon fixes this too.
Here's how to check the SELinux context of a file.
# Display the SELinux context alongside standard permissions
ls -Z /path/to/file
Here's how to restore default SELinux contexts for a directory.
# Recursively restore default contexts based on policy rules
sudo restorecon -Rv /path/to/directory
The restorecon command resets contexts based on policy rules, fixing mislabeled files without changing permissions. It is the standard fix for context drift.
SELinux denials show up in journalctl -t setroubleshoot with a one-line summary. Read those before disabling SELinux. The summary often suggests a fix command.
Read the denial before guessing. journalctl -t setroubleshoot tells you exactly what was blocked and why.
Firewall configuration
Firewalld manages the firewall using zones. A zone defines the trust level of a network interface. The default zone is usually public. Services are allowed per zone. Changes to the permanent configuration do not apply until you reload the runtime configuration.
Here's how to add a service to the permanent configuration.
# Add SSH to the permanent configuration for the default zone
sudo firewall-cmd --permanent --add-service=ssh
Here's how to apply the permanent changes to the running firewall.
# Reload the firewall to merge permanent rules into the runtime configuration
sudo firewall-cmd --reload
The --reload command merges permanent rules into the runtime, ensuring the change takes effect immediately. Without this step, the rule exists on disk but does not protect the system.
Verify the service is active.
# List all services and ports allowed in the default zone
firewall-cmd --list-all
firewall-cmd --reload after every rule change. Otherwise the runtime config and the persistent config diverge.
Reload after every change. A rule that exists in permanent but not runtime is a rule that does nothing.
System updates and major upgrades
Fedora releases a new version every six months. The N-2 release goes end-of-life when N+1 ships. You must upgrade to stay supported. dnf upgrade updates packages within the current release. dnf system-upgrade handles major version transitions. They are different commands with different risks.
The upgrade process downloads everything before rebooting. This allows you to verify the download size and cancel if you run out of space. It also means the reboot is the only risky moment. If the power fails during download, you just try again. If the power fails during reboot, the transaction rolls back.
Here's how to download packages for a major version upgrade.
# Download packages for Fedora 42 and prepare for a reboot to apply the upgrade
sudo dnf system-upgrade download --releasever=42
Here's how to reboot into the upgrade transaction.
# Reboot into the upgrade transaction which applies the new release
sudo dnf system-upgrade reboot
The reboot triggers the transaction that replaces the current system with the downloaded packages. The system will not boot until the transaction completes or rolls back.
Snapshot the system before the upgrade. Future-you will thank you.
Common pitfalls
Editing files in /usr/lib/ is a mistake. Packages overwrite these files on update. Edit /etc/ instead. Configuration files in /etc/ are user-modified. Files in /usr/lib/ ship with the package. The package manager controls /usr/lib/.
Disabling SELinux to fix a permission error hides the real issue and creates a security hole. Fix the context or policy. Use restorecon or check the audit log for the correct label.
Mixing dnf and yum commands can cause confusion. yum is a symlink to dnf but some flags differ. Stick to dnf. The dnf command supports all modern features and transaction history.
Using sudo for everything is unnecessary. Flatpak installs do not require root. User-level tools do not require root. Only system-wide changes need sudo.
Edit /etc/, never /usr/lib/. Package updates overwrite library paths and break your system.
When to use each tool
Use DNF when you need system-wide tools, kernel modules, or libraries that other packages depend on. Use Flatpak when you want sandboxed applications with automatic updates and easy rollback. Use AppImage when a developer provides a portable binary and no package exists. Use RPM Fusion when you need proprietary drivers, codecs, or applications that Fedora cannot ship by default. Stay on the default GNOME desktop if you want the upstream experience with minimal configuration. Switch to a Fedora Spin when you prefer a different desktop environment or window manager.