It’s funny this community is more strict on the definitions about (Open)SUSE than security and the nature of immutable distributions.
Yes, you can install firewalld on an immutable OS. But the point of such a system is to not touch the base system, unless absolutely necessary. It’s frowned upon to do so. And if you have to tell users both to respect the immutable nature of the OS and not to forget to install a firewall after first booting, then sorry, you lost my interest. I know, I’m not important. But I’m quite sure more people will scratch their heads over this one.
I’m really worried about the amount of people here that think a firewall is not needed and so much trust is put in people configuring their containers right. Defense in depth, once again. Look it up. Surely you also have a firewall running for this Discourse forum, right? I also run a Disourse forum. VPS and local firewall enabled, because double firewalls are part of defense in depth as well. Because firewalls can have bugs too. And on the local firewall I also have IDS/IPS in conjunction with firewalld. Because that’s what admins do to protect their data.
Anyway 