Things to Do After Installing openSUSE Leap 16

You’ve just finished the openSUSE Leap 16 install and you’re looking at a clean GNOME desktop. Before it becomes your daily driver, a handful of things to do after installing openSUSE Leap turn the stock system into one that plays your media, rolls back a bad update in one reboot, and gives you the admin tools that replace YaST. None of it’s hard, and most of it happens in one terminal session.

Original content from computingforgeeks.com - post 168845

Leap 16.1 is out with the same GNOME 48 desktop and 6.12 kernel as 16.0, so the routine barely changed, but the Packman line and the NVIDIA repository alias both needed fixing. I went through every step again on a fresh openSUSE Leap 16.1 GNOME install in November 2026, and with those two fixes they still hold.

Start from the welcome screen

The steps run in the order you’d do them on a fresh machine: updates first, then media and apps, then the safety net and the admin pieces. By the end you’ll have this checklist done:

• You have every update applied and the non-OSS repository turned on.
• You have Packman codecs, and the repository survives the next minor upgrade without edits.
• You can install apps from Flathub and the openSUSE repositories.
• You know Snapper is protecting you, and only the ports you need are open.
• You can manage the machine from Cockpit in a browser or from Myrlyn on the desktop.

The first thing you see after logging in is the GNOME Tour, which now introduces openSUSE Leap 16.1 itself. Click through it or close it. Nothing below depends on it.

Once the tour is out of the way, open a terminal from the app grid and start with updates.

Update your system first

Always start here. The install media is a snapshot in time, so there are already patches waiting by the time you log in. Refresh the repositories and apply every available update:

sudo zypper refresh
sudo zypper update

On Leap you use zypper update (or zypper patch) for day-to-day updates within a release. Save zypper dup for moving between Leap versions, not for routine patching. If a kernel update lands, reboot before you move on, because the codec and driver steps below expect the running kernel to match the installed one.

Set your hostname and time

Two small things that are easy to forget. The installer leaves the machine with a generic name (the shell prompt shows localhost), so give it a real name now (the prompts and Cockpit screens below show it) and confirm time sync is on:

sudo hostnamectl set-hostname leap-desktop
timedatectl

You want to see your own time zone and two yes answers:

               Local time: Tue 2026-11-03 19:55:43 EAT
           Universal time: Tue 2026-11-03 16:55:43 UTC
                 RTC time: Tue 2026-11-03 16:55:43
                Time zone: Africa/Nairobi (EAT, +0300)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

Both were already on after the install, so on most machines this step is just a quick check that the clock and the name are what you expect.

Turn on the non-OSS repository

Leap ships the non-OSS repository defined but disabled. It holds freely redistributable but non-open packages a lot of people want, such as certain firmware and browser bits. Enable it and refresh:

sudo zypper modifyrepo --enable openSUSE:repo-non-oss
sudo zypper refresh

That’s the part that trips people up later when a package “isn’t found”: it was sitting in non-OSS the whole time. While you’re looking at the repository list, you’ll also notice repo-openh264 is already enabled on a fresh 16.1 install. It carries Cisco’s OpenH264 build, so basic H.264 playback works before you add anything else.

Add the Packman repository and install codecs

OpenH264 covers one codec. Full FFmpeg, AAC through fdk-aac and the patent-encumbered bits of Mesa’s video acceleration still come from the community Packman repository. Add it with $releasever in the URL instead of a hard-coded version number:

sudo zypper addrepo -cfp 90 'https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Leap_$releasever/' packman
sudo zypper refresh

The single quotes matter. Without them your shell expands $releasever to an empty string and zypper adds a broken URL. With them, zypper stores the variable as written and fills in your release each time it reads the repository. The first refresh shows the PackMan Project signing key with its fingerprint, F887 5B88 0D51 8B6B 8C53 0D13 45A1 D067 1ABD 1AFB, and asks whether to reject it, trust it temporarily or trust it always. Type a to trust it always if the fingerprint matches.

Confirm the URL resolved to your release with sudo zypper lr -u -P. Packman sits at priority 90, ahead of the stock repositories at 99, and its URI ends in openSUSE_Leap_16.1 while the file on disk still says $releasever:

That split is why this form is worth the quotes: when you upgrade to the next minor release, the same repository points at the matching Packman tree on its own. Now switch your installed multimedia packages over to the Packman builds. The vendor change is expected here, so accept it:

sudo zypper dist-upgrade --from packman --allow-downgrade --allow-vendor-change

On a stock GNOME install zypper wants to switch 27 packages from SUSE to Packman. Expect these groups in the list:

• You’ll see the FFmpeg libraries (libavcodec61, libavformat61 and friends).
• You will see the Mesa stack, including Mesa-libva for hardware video decoding.
• You’ll see libfdk-aac2 and the libheif plugins for HEIC photos.
• You will see one downgrade, libquicktime0, which is normal and why --allow-downgrade is there.

Afterwards rpm -q --qf '%{VENDOR}\n' libavcodec61 prints http://packman.links2linux.de, which is the quick way to check the switch took. VLC, the GNOME video player and Firefox now play the formats that were silent before. The openSUSE Leap codecs guide goes further into the individual codec packages and playback tests.

Already added Packman with openSUSE_Leap_16.0 in the URL?

If you set this machine up on 16.0 with the old hard-coded line and then upgraded, your Packman repository still points at the 16.0 tree, and you’ll keep getting 16.0 builds next to a 16.1 system. zypper can’t edit a repository’s URL in place, so remove it and add it back with the variable:

sudo zypper removerepo packman
sudo zypper addrepo -cfp 90 'https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Leap_$releasever/' packman
sudo zypper refresh packman

Then run the dist-upgrade --from packman command above again so the installed codec packages move to the 16.1 builds. You don’t lose anything by removing the repository first. Installed packages stay where they are until that dist-upgrade replaces them.

Set up Flatpak and Flathub

Flatpak is already installed on a GNOME Leap 16.1 system, but no remote is configured, so flatpak remotes prints nothing. The Flathub remote is what gives you the large catalog of desktop apps. Add it:

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

Run flatpak remotes again and you should see flathub listed as a system remote. Log out and back in once so GNOME Software picks it up, then you can install and manage Flatpak apps from the store or the command line. It’s the easy way to get apps that aren’t packaged in the openSUSE repositories. If you’re weighing it against other formats, the Snap vs Flatpak vs AppImage comparison breaks down when each one makes sense.

Install your everyday applications

With Packman and Flathub in place, pull in the basics. From the repositories:

sudo zypper install vlc fastfetch htop git

VLC comes from the main OSS repository and links against the Packman FFmpeg you just installed, so it plays everything without extra plugins. Swap in whatever fits your own workflow. The point is that codecs are sorted first, so media apps work the first time you open them. Run fastfetch afterwards if you’d like a one-screen summary of the release, kernel and desktop you’re on.

Confirm your Snapper safety net

This is the openSUSE feature that saves you. On the default Btrfs root, Snapper takes a snapshot before and after every change you make with zypper, so a broken update is one reboot away from being undone. Confirm it’s active:

sudo snapper list

You’ll see the first root filesystem snapshot, then a pre and post pair for every zypper run that installed, updated or removed packages. Repository changes such as addrepo don’t create one. I took this listing later in the guide, so it shows five pairs from the zypper runs up to then, and at this point you’ll likely have fewer:

The Used Space column tells you how much disk each snapshot actually pins, which is the number to watch if your root partition is small. If an update ever breaks the system, reboot, and in the GRUB menu pick Start bootloader from a read-only snapshot to boot a working state. Once it’s up and works, run sudo snapper rollback and reboot to make that state the default, otherwise the next normal boot goes back to the broken one. You don’t have to set anything up, because the default install already runs it. Three details help when the day comes:

• You get a pre and post snapshot for package changes, because snapper-zypp-plugin hooks into libzypp, but not for files you edit by hand.
• You can compare a pair with sudo snapper status 2..3, which lists every file that package operation touched.
• You don’t have to prune old snapshots, because the number cleanup policy keeps between 2 and 10 of them.

The companion guide on automatic rollback with Snapper covers managing snapshots day to day.

Open only the ports you need

firewalld runs by default on Leap 16.1, and on my test install the public zone already allowed SSH and Cockpit. If this is a desktop you may want SSH closed. If it’s a server, open just the services you actually run. The commands to add a service and check the result look like this:

sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

On a stock install the first command answers Warning: ALREADY_ENABLED: ssh, which is fine. The zone listing confirms what’s open, and getenforce confirms SELinux is the security module doing the enforcing:

To close SSH on a desktop, swap --add-service for --remove-service in the first command and reload. Do that from the machine’s own keyboard, never over an SSH session, because the reload cuts you off. Add a service per app you expose (http, https, and so on) rather than opening the firewall wide. SELinux is the default security module on Leap 16.1, so between the two you start with sane defaults. The firewalld guide for Leap covers zones and rich rules when you need more.

Install Cockpit for web-based administration

Cockpit is the browser-based admin console openSUSE leans on now that YaST is retired. It gives you a graphical view of services, storage, logs, networking and updates without leaving the browser. Install and enable it:

sudo zypper install cockpit
sudo systemctl enable --now cockpit.socket
sudo firewall-cmd --add-service=cockpit --permanent
sudo firewall-cmd --reload

The firewall lines are only there for machines where the Cockpit service was removed from the zone. On a stock 16.1 install they report it as already enabled. Open https://localhost:9090 (or the machine’s IP from another computer) and accept the self-signed certificate warning on the first visit. The login page shows your release name at the top:

1. 1User name
2. 2Password
3. 3Log in

Sign in with your normal account:

1. Type your login name in the User name field.
2. Enter the same password you use on the desktop in the Password field.
3. Click Log in.

You land on the Overview page with health, usage and system information for the machine. A yellow banner says the web console is running in limited access mode, and if you see that, it’s normal: Cockpit starts every session without root rights.

Click Turn on administrative access and type your password again when you want to change services, storage or updates. Your user can do that because the installer puts the first account in the wheel group, and Leap 16.1 asks for that user’s own password rather than root’s.

Meet Myrlyn, the new package manager

Leap 16 retired the YaST software module and replaced it with Myrlyn, a graphical package manager built on the same libzypp backend zypper uses. If you liked clicking through packages in YaST, this is what you’ll use now. Install it:

sudo zypper install myrlyn

The app grid now has two launchers, and the part that trips people up is picking the wrong one. Myrlyn (read-only) runs as your normal user: you can browse and search, but the Accept button stays greyed out. The plain Myrlyn entry runs myrlyn-sudo, asks for your password and can install and remove packages. Either way you get the familiar Search, Patches, Updates, Repositories and Patterns tabs. Here is the read-only launcher, with Accept greyed out at the bottom right:

The version on 16.1 is Myrlyn 1.0.0. Its Repositories tab is a handy place to double-check that Packman and non-OSS are both enabled without going back to the terminal.

Add GNOME Tweaks and extensions

GNOME stays at version 48 on this release (48.8 at launch) with bug-fix updates, so everything here works the same as on 16.0. The stock desktop is deliberately minimal. GNOME Tweaks unlocks fonts, window-button layout and startup options, and the Extensions app that ships with the desktop lets you switch on features like a dock or system tray:

sudo zypper install gnome-tweaks

Open Tweaks to set your fonts and titlebar buttons. The GNOME browser connector already ships with the desktop, so head to extensions.gnome.org in Firefox and toggle extensions on directly, or pull curated ones from the repository such as gnome-shell-extension-user-theme. That’s where a fresh GNOME starts feeling like yours. If you picked KDE Plasma in the installer instead, skip this section; the repository, codec, Snapper, firewall and Cockpit steps apply unchanged, though the test run here was GNOME only.

Install the NVIDIA driver if you have an NVIDIA GPU

If your machine has an NVIDIA card, the proprietary driver gives you proper acceleration. openSUSE ships a repository definition for it as a package, so you don’t have to add URLs by hand:

sudo zypper install openSUSE-repos-Leap-NVIDIA
sudo zypper refresh
sudo zypper install-new-recommends --repo NVIDIA:repo-non-free

The package adds an NVIDIA service, and the repository it creates is called NVIDIA:repo-non-free, pointing at download.nvidia.com/opensuse/leap/16.1. Use that full alias in the last command. On 16.1 the short name repo-non-free fails with “Repository ‘repo-non-free’ not found by its alias, number, or URI”. You can confirm the alias with zypper lr | grep -i nvidia. The last command pulls the driver that matches your card. On a machine without NVIDIA hardware it simply prints “Nothing to do.”

My test machine was a VM with no NVIDIA card, so I could only confirm the repository and the command, not the driver itself. On a Secure Boot system, if the driver install asks you to enroll a signing key, follow the blue MOK enrollment screen on the next reboot. If you’re on Intel or AMD graphics, skip this entirely, since those drivers are already in the kernel.

Keep the setup working on the next Leap release

With updates applied, codecs in place, your safety net confirmed, and Cockpit and Myrlyn ready, Leap 16.1 is set up the way it should have shipped for your machine. Because the Packman line now uses $releasever, the only third-party repository on this list follows you to the next minor release without edits. If you’re coming from an older release, the upgrade from Leap 15 guide walks through moving an existing system across. If you’d rather have a read-only root that updates atomically, the Leap Immutable Mode install is the other path 16.1 offers, picked in the same Agama installer. The Leap 16.1 release announcement lists everything else that moved in this release.