Things to Do After Installing Linux Mint 22.3

A fresh Linux Mint install works the moment you log in, but the things you’ll want on day one are mostly switched off. Timeshift has no schedule, the firewall is inactive, the multimedia codecs aren’t installed and Wine isn’t there at all. These are the things to do after installing Linux Mint, in the order that keeps you out of trouble, because one of them can fill your disk if you do it at the wrong moment.

Original content from computingforgeeks.com - post 178165

You’ll take a Timeshift snapshot, run the first round of updates, check the Driver Manager, add codecs, turn on ufw, use Flathub and install Wine, with every step closing on what you should see. Each section stands alone, so skip what you don’t need. I went through every step on a fresh Linux Mint 22.3 Cinnamon install in a VM in October 2026, and they still hold, including the one that ran a 40 GB disk out of space.

Check What the Fresh Install Leaves Off

Before changing anything, it helps to know what Mint already did for you, because about half of a typical post-install list is already done. The Welcome screen opens on first login, and its First Steps page is Mint’s own checklist: Desktop Colors, System Snapshots, Driver Manager, Multimedia Codecs, Update Manager, System Settings, Software Manager and Firewall. If you close it, search the menu for Welcome Screen to bring it back.

What the list doesn’t tell you is the state of each item. On the test install, before any of the steps below, this is what the system looked like:

Item	State on a fresh install	What to do
Timeshift	Installed, no snapshot, every schedule off	Take one snapshot, then set a schedule
Updates	544 packages waiting in apt	Install them in two passes
Firewall (ufw)	Installed, service enabled, rules inactive	Enable it
Multimedia codecs	mint-meta-codecs not installed	Install it
Flatpak	Flathub remote already added (system)	Nothing, just use it
Snap	Blocked by /etc/apt/preferences.d/nosnap.pref	Leave it unless you need a Snap
32-bit packages	i386 architecture already enabled	Nothing, Wine can use it
Wine	Not installed	Install wine-installer
Swap and TRIM	3.8 GB swap file, fstrim.timer enabled	Nothing

So you don’t need to add Flathub, enable 32-bit support or set up swap, which older Mint guides still tell you to do. The real work is in the first four rows. If you haven’t installed Mint yet, the step-by-step Mint install guide covers the installer itself, including the codecs checkbox that saves you one step here.

Take a Timeshift Snapshot Before Anything Else

Your first snapshot should capture the clean system, before 500 packages change underneath it. If an update or a driver breaks the desktop later, that snapshot is the state you’ll want to roll back to. You can do this from Menu > Administration > Timeshift, where the first-run wizard asks you to pick RSYNC and a disk, or straight from the terminal:

sudo timeshift --create --comments "fresh install" --tags O

On first run Timeshift picks RSYNC and the root partition on its own, then copies the whole system. I’ve left out the rsync percentage counter, which redraws itself a few hundred times, and a harmless status: No such file or directory line from Timeshift’s temporary script. The rest is what it printed:

First run mode (config file not found)
Selected default snapshot type: RSYNC
Mounted '/dev/sda3' at '/run/timeshift/3685/backup'
Selected default snapshot device: /dev/sda3
------------------------------------------------------------------------------
Estimating system size...
Creating new snapshot...(RSYNC)
Saving to device: /dev/sda3, mounted at path: /run/timeshift/3685/backup
Syncing files with rsync...
Created control file: /run/timeshift/3685/backup/timeshift/snapshots/2026-10-26_23-41-49/info.json
RSYNC Snapshot saved successfully (169s)
Tagged snapshot '2026-10-26_23-41-49': ondemand

It took 169 seconds and 7.3 GB. Now look at the device line: the snapshot sits on /dev/sda3, the same partition as the system it protects. That covers a bad update, but not a dead drive, so if your machine has a second disk, point Timeshift at it in the GUI under Settings > Location. Your home folder is excluded by default (the config lists /home/lorna/**), which is what you want, since Timeshift is not a backup tool for documents.

Now add a schedule, because one manual snapshot goes stale within a week. The Welcome screen recommends at least two daily and two boot snapshots. In the GUI that’s the Schedule tab. From a terminal, you can flip the same four values in the config file that the first snapshot just created:

sudo sed -i -e 's/"schedule_daily" : "false"/"schedule_daily" : "true"/' -e 's/"schedule_boot" : "false"/"schedule_boot" : "true"/' -e 's/"count_daily" : "5"/"count_daily" : "2"/' -e 's/"count_boot" : "5"/"count_boot" : "2"/' /etc/timeshift/timeshift.json

Timeshift won’t act on the edit until it reads the file again. A check does that, and it also writes the cron jobs:

sudo timeshift --check

You should see it reuse the snapshot you just took as the first daily one instead of copying the system again, then add two cron tasks:

Last daily snapshot not found
Tagged snapshot '2026-10-26_23-41-49': daily
------------------------------------------------------------------------------
Added cron task: /etc/cron.d/timeshift-hourly
Added cron task: /etc/cron.d/timeshift-boot

The boot job in /etc/cron.d/timeshift-boot is @reboot root sleep 10m && timeshift --create --scripted --tags B. Remember that 10-minute delay, because it’s the reason the disk section further down exists. On a disk of 64 GB or less, leave the schedule_boot expression out of that sed command for now. The first snapshot after the updates will be large whatever triggers it, so on a small disk you want to be at the keyboard with free space checked when it runs, not have it fire on its own ten minutes after a reboot.

Install the Linux Mint Updates in Two Passes

The Update Manager (the shield icon in the panel) won’t show you everything on the first run, and that confuses a lot of people. Refresh the package lists first, then ask the Update Manager’s own command-line tool what it plans to install. On the test install apt reported 544 upgradable packages, but the tool listed exactly one:

sudo apt update
sudo mintupdate-cli list

Mint’s own upgrade tooling owns that single entry, and the Update Manager held everything else back until it was installed. Not even the security fixes showed up yet.

package         mint-upgrade-info                             1.3.0

Install it, which took under 8 seconds, then list again. In the GUI this is the same as clicking Install Updates once and watching the list refill. Before you install the full list in the next step, run through this check:

• You’ve taken the Timeshift snapshot from the previous section.
• You’re on mains power if this is a laptop, since the run takes a while.
• You’ve got at least 15 GB free on the root partition (df -h /), because the updates, their download cache and the next snapshot all land there, and closer to 25 GB if you’ll add Flatpaks and Wine afterwards.
• You know whether you rely on VirtualBox or an NVIDIA card on the 470 driver.

With that done, install the update tool and count what’s left. The first command takes seconds, and the second groups the new list by type.

sudo mintupdate-cli upgrade -y
sudo mintupdate-cli list | awk '{print $1}' | sort | uniq -c

Mint counts source packages here rather than binary ones, which is why it’s 209 and not 544. Most of them are security fixes:

      4 kernel
     69 package
    136 security

The kernel entries are worth a look before you click through them, because one of them moves you to a newer hardware enablement kernel series:

kernel          firmware-sof                                  2023.12.1-1ubuntu1.11
kernel          linux-6.8.0-147.147                           6.8.0-147.147
kernel          linux-7.0.0-38.38~24.04.4                     7.0.0-38.38~24.04.4
kernel          linux-base                                    4.5ubuntu9+24.04.2

Mint 22.3 ships the HWE kernel 6.14, and this round pulls the 7.0 HWE series in its place. That’s fine on most hardware, but the Linux Mint 22.3 release notes say the HWE kernel has issues with VirtualBox and that the old NVIDIA 470 driver doesn’t support newer kernels. You’re already on an HWE kernel at install time, so skipping the 7.0 lines alone won’t help you there. The notes recommend installing Linux Mint 22.1, which ships the 6.8 LTS kernel, and upgrading to 22.3 without switching to HWE. On a machine that’s already installed, you can try the 6.8 series from the Update Manager under View, Linux Kernels instead, and the kernel guide for Mint covers switching series. If that’s you, do this update pass in the GUI so you can untick the kernel lines. Everyone else can install the lot:

sudo mintupdate-cli upgrade -y

Give it time. The full run took 820 seconds on a 4-core VM with a fast connection, and SSH refused connections for a short while in the middle, as openssh-server was upgraded and restarted. When it finishes, clear the download cache with sudo apt clean, which gives the root partition back the space the downloaded packages took, then reboot and confirm the new kernel is the one running:

uname -r

My test VM came back on the 7.0 HWE kernel, and the boot took under 10 seconds.

7.0.0-38-generic

If uname -r still shows the old kernel, you haven’t rebooted yet, or GRUB picked the older entry. The old kernel stays installed either way, so you can boot it from the GRUB menu under Advanced options if the new one gives you trouble.

Keep Timeshift From Filling the Disk

This is the step nobody puts in a post-install list, and it’s the one that bit me. I hadn’t checked free space, and ten minutes after the reboot above the boot snapshot cron job fired about 30 seconds into the Wine install, so the two ran side by side. By then I’d also added the codecs and Flatseal from the sections below, so the new snapshot had to store every file the 544 updates had changed, plus those codecs and 3.6 GB of Flatpak runtimes, which Timeshift doesn’t exclude by default (it does skip the apt download cache). The snapshot’s 11 GB and Wine’s 1.8 GB together took the root partition from 13 GB free to zero in about four minutes. Cinnamon threw a warning while gnome-screenshot failed with No space left on device:

Timeshift does not guard against this. Its log for that snapshot shows Free space: 13.0 GB and has_space() - 0 required (0 B), because once a snapshot exists it only checks for 1 GB of free space, not for the size of the snapshot it’s about to take. Nothing was corrupted, and sudo dpkg --audit came back clean. You should not count on that luck, though, because a full root partition can break logins and leave package installs half-finished. To get the space back, clear the apt cache first, then delete the extra snapshot by name:

sudo apt clean
sudo timeshift --delete --snapshot "2026-10-27_00-17-28"

The apt cache alone gave back 2 GB, and the snapshot another 11 GB, leaving the disk at 68% used. Use sudo timeshift --list to find your own snapshot names. To keep this from happening on your machine:

• You’ve got at least 15 GB free on the snapshot disk before the first big round of updates, or about 25 GB if you’ll also add Flatpaks and Wine.
• You’ve pointed Timeshift at a second drive if your system disk is 64 GB or smaller.
• You’ve run sudo apt clean after the first update pass, since apt-get and the Update Manager keep every downloaded package in /var/cache/apt on the same partition.
• You’ve planned for the first snapshot after a big update round to be large, whether the daily or the boot schedule takes it.
• You’ve checked sudo timeshift --list a day later and deleted any snapshot you don’t need.

On a 250 GB or larger drive you can mostly ignore this, because the same 11 GB snapshot is a few percent of the disk. The trouble is specific to small SSDs, older laptops and VMs, which happen to be where people try Mint first.

Check the Driver Manager

Open Menu > Administration > Driver Manager and let it scan. Most hardware works with the drivers already in the kernel, so on a lot of machines, including the test VM, you’ll see a green check and nothing else:

If the window does list something, that’s a driver Mint can’t ship enabled by default, and you’ll usually want it. In practice that means NVIDIA graphics cards, where the proprietary driver is what games and CUDA need, and some Broadcom Wi-Fi chips, which Mint’s driver tooling looks for by their PCI vendor ID. The terminal version of the same check is ubuntu-drivers devices, which printed nothing at all on the VM because the QXL graphics and virtio network card need no extra driver.

Pick the driver marked “recommended”, click Apply Changes and reboot when it asks. If you’re installing the 7.0 kernel from the updates section, finish that update and reboot first, so the NVIDIA module gets built against the kernel you’ll actually run.

Install the Multimedia Codecs

Unless you ticked the codecs box in the installer, Mint can’t play H.264 video, MP3s in some apps, or DVDs yet. One metapackage fixes all of it. You can click Launch next to Multimedia Codecs in the Welcome screen, or install it yourself:

sudo apt-get install -y mint-meta-codecs

It pulled in 57 packages in 68 seconds, and it also swaps one library for its fuller build, so don’t worry when you see a removal in the summary:

The following packages will be REMOVED:
  libavcodec60
...
0 upgraded, 57 newly installed, 1 to remove and 0 not upgraded.
After this operation, 72.0 MB of additional disk space will be used.

libavcodec60 is replaced by libavcodec-extra60, the same FFmpeg library built with extra codecs. To confirm GStreamer can now decode H.264:

gst-inspect-1.0 avdec_h264 | head -5

A working install shows the libav decoder at primary rank. If the command says No such element or plugin, the install did not finish:

Factory Details:
  Rank                     primary (256)
  Long-name                libav H.264 / AVC / MPEG-4 AVC / MPEG-4 part 10 decoder
  Klass                    Codec/Decoder/Video
  Description              libav h264 decoder

That’s all most people need from this step. If Mint runs on real hardware with a working GPU, skip the next subsection, which only applies to virtual machines.

Running Mint in a VM: remove gstreamer1.0-vaapi the safe way

The codecs pull in gstreamer1.0-vaapi, and Mint’s release notes say that playing video with it in a VM without 3D acceleration crashes Xorg and logs you out. The fix they give is apt remove gstreamer1.0-vaapi, but there’s a catch they don’t mention: mint-meta-codecs depends on it, so the metapackage goes too.

sudo apt-get remove -y gstreamer1.0-vaapi

Both packages leave together in the summary, and the second one is the trap.

The following packages will be REMOVED:
  gstreamer1.0-vaapi mint-meta-codecs
0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.

With the metapackage gone, the codecs it brought in are orphans. A simulated sudo apt-get autoremove -s on the test VM listed five of them for removal, including libavcodec-extra, so the next autoremove would quietly undo part of your codec install. Marking the main packages as manually installed stops that:

sudo apt-mark manual cabextract gstreamer1.0-libav gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly libavcodec-extra libdvdcss2 libdvdnav4 unshield

Run the autoremove simulation again afterwards, and it should list nothing. You can skip this whole subsection on real hardware with a working GPU, since VA-API there gives you hardware video decoding and lower CPU use.

Turn On the Firewall

Mint ships ufw and its GUI, gufw, with the service enabled but the rules switched off, so nothing is filtering incoming traffic yet. Check it yourself:

sudo ufw status

On a new install you’ll get one line, which means no rules are being applied at all:

Status: inactive

A stock desktop install doesn’t run an SSH server, so most of you can enable the firewall straight away. The test VM did have openssh-server on it, and if yours does too, allow SSH first or you’ll cut off your own remote session. Run it from a local terminal if you can, because over SSH ufw stops to ask Command may disrupt existing ssh connections. Proceed with operation (y|n)?:

sudo ufw allow ssh
sudo ufw enable

The enable command should answer Firewall is active and enabled on system startup. The defaults come from /etc/default/ufw, which already drops incoming and allows outgoing traffic, as the verbose status confirms:

sudo ufw status verbose

Look for deny (incoming) on the Default line. If it says allow, check that file before you go any further.

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)

Anything you share later needs its own rule, and it’s tidier to limit it to your home network than to open it to everyone. For Samba, adjust the subnet to match your router’s (often 192.168.1.0/24):

sudo ufw allow from 10.0.1.0/24 to any port 445 proto tcp comment "Samba from LAN"

Search the menu for Firewall Configuration and you’ll see the same rules in gufw, which is the easier place to add and remove them later:

Before you call the firewall done, run through this quick check:

• You see Status: active in sudo ufw status after a reboot.
• You’ve allowed SSH before enabling ufw, if you log in remotely.
• You’ve added a LAN-only rule for each service you share, such as Samba on 445/tcp.

If you plan to share folders with Windows machines, the Samba sharing guide for Mint picks up right where that rule leaves off. For remote logins, set up SSH keys on Mint before you open port 22 at all.

Get Apps From Flathub Instead of Snap

Flathub is already set up as a system-wide remote, and the Software Manager shows Flatpak apps next to the regular packages, so you don’t have to add anything:

flatpak remotes

You’ll see one remote, installed system-wide. Every user on the machine shares the apps from it.

flathub	system

A good first Flatpak is Flatseal, which lets you see and change what each Flatpak app is allowed to touch. The release notes point you to it for fixing mouse pointer themes in Flatpak apps, too. From the desktop, flatpak install flathub com.github.tchx84.Flatseal asks for your password in a pop-up. Over SSH there’s no pop-up to answer, so use sudo:

sudo flatpak install -y --noninteractive flathub com.github.tchx84.Flatseal

It took 93 seconds, because the 1.4 MB app brought its runtimes with it. List everything that landed:

flatpak list --columns=application,size

Almost all of it is the GNOME runtime and two GL extensions. Flatseal itself is the smallest line.

com.github.tchx84.Flatseal	1.4 MB
org.freedesktop.Platform.GL.default	462.3 MB
org.freedesktop.Platform.GL.default	462.3 MB
org.freedesktop.Platform.codecs-extra	43.4 MB
org.gnome.Platform	1.1 GB
org.gtk.Gtk3theme.Mint-Y-Aqua	423.9 kB

/var/lib/flatpak grew from 6.9 MB to 3.6 GB for one small app. The next GNOME app you install reuses that runtime, so the cost is mostly up front, but on a small disk it’s a good reason to prefer the regular Mint package when the Software Manager offers both. Updates for Flatpaks show up in the Update Manager next to your regular packages, so you don’t need a separate routine for them.

Error: “Flatpak system operation Deploy not allowed for user”

You’ll hit this when you run flatpak install over SSH without sudo. The download finishes, then every runtime fails with Failed to install org.gnome.Platform: Flatpak system operation Deploy not allowed for user, because polkit has no desktop session to ask for your password. Rerun the same command with sudo, or run it from a terminal inside your desktop session, where the password prompt can appear. Adding --user won’t help on its own, because Mint sets up Flathub only as a system remote.

Why Snap doesn’t install on Mint

Mint blocks snapd on purpose with an apt pin, so an apt install snapd fails until you remove the pin:

cat /etc/apt/preferences.d/nosnap.pref

Its comments explain the decision and link to Mint’s own page on it.

# To prevent repository packages from triggering the installation of Snap,
# this file forbids snapd from being installed by APT.
# For more information: https://linuxmint-user-guide.readthedocs.io/en/latest/snap.html

Package: snapd
Pin: release a=*
Pin-Priority: -10

You do not need Snap for anything on this list. If one app you rely on only ships as a Snap, the Snap on Linux Mint guide shows how to lift the pin cleanly.

Install Wine From the Mint Repositories

For running the odd Windows program, Mint’s release notes recommend wine-installer over the bare wine package. It adds wine-desktop-files, which the notes say adds menu entries upstream Wine lacks, such as regedit and your C:\ drive. You also don’t need to enable 32-bit packages first, because Mint already has the i386 architecture turned on:

dpkg --print-foreign-architectures

If it prints i386, go ahead and install:

sudo apt-get install -y wine-installer

Wine is the largest thing on this list, so check your free space first. The install took 4 minutes 48 seconds and needed 1.8 GB:

0 upgraded, 260 newly installed, 0 to remove and 0 not upgraded.
After this operation, 1,847 MB of additional disk space will be used.

Check which build you got. The version decides which Windows programs will run, so look at it before you blame a program.

wine --version

Mint inherits this Ubuntu build from its base. Note the major version, because it matters further down.

wine-9.0 (Ubuntu 9.0~repack-4build3)

Open Configure Wine from the menu (or run winecfg) once, so Wine builds its ~/.wine prefix. The terminal fills with err:ole lines on that first start, and you can ignore them. When the window opens, the About tab shows the version you’re running:

The repository build is solid for older Windows utilities, but it’s well behind WineHQ, whose stable branch has moved on to 11.x. If a newer program or game won’t start, remove wine-installer and follow the WineHQ install guide for Linux Mint, which adds the official repository from the WineHQ Debian and Ubuntu instructions and installs winehq-stable. Do not mix the two, since both provide /usr/bin/wine, and apt will fight you over which one owns it.

Once all of this is done, a quick look from the terminal shows each piece in place: the clean snapshot, the active firewall with its LAN rule, the Flatpak and the Wine build.

The whole list took a little over half an hour on the test VM, and most of that was the update run. From here, the Docker setup for Mint and the Chrome install are the two next steps people ask about most.

Common Questions After a Fresh Mint Install

These come up again and again once the setup above is finished, so here are short answers to the three most common ones.

Is Linux Mint better than Ubuntu for a desktop?

For most people coming from Windows, yes, because Mint gives you a traditional desktop, no Snap, and tools like the Update Manager and Driver Manager that explain what they’re doing. Both use the same Ubuntu packages underneath, which is why the updates above are the same ones apt sees, only counted by source package instead of binary package. The Linux Mint vs Ubuntu comparison goes through the differences side by side.

When does Linux Mint 23 come out?

It will not, because Mint is changing its numbering. The September 2026 Mint monthly news says the next release is Linux Mint 27 “Adrien”, based on Ubuntu 26.04 and scheduled for Christmas 2026, with yearly releases and no point releases after that. There is no rush to move, since Linux Mint 22.3 is supported until April 2029.

Do I need to reinstall to undo a bad update?

No, that’s what the first snapshot is for. Open Timeshift, select the snapshot you took before the update and click Restore, and Timeshift restarts the computer when the restore finishes. If only a new kernel is the problem, picking the older one under Advanced options in the GRUB menu is quicker still. Your home folder was excluded from the snapshot, so a restore leaves your documents as they are.