The European Sovereign Desktop

Linux runs almost everything a company depends on, right up until the moment a person looks at a screen. Every supercomputer, nine in ten cloud servers, most of the machine room. Then a human sits down, and Windows is back.

In Europe the desktop tells the opposite story from the data centre. 62% of desktops run Windows, 15% macOS, and 3% desktop Linux, on mid-2026 StatCounter figures, with a large "unknown" slice that quietly hides some of the Linux. One operating system won every tier of computing except the one tier with a face in front of it.

This piece is about that last tier: why it held out, and why the European sovereignty push, starting with the engineers, is the first force heavy enough to move it.

The cliff

Linux runs the heavy tiers, and every human-facing platform built this century. The desktop is the exception.

That is a cliff, not a slope, and the two human-facing rows sit on opposite sides of it: mobile at 70%, the desktop at 3%. So the story is not that people reject Linux. Everything an engineer touches is already Linux, and so is the phone in everyone's pocket. It is the traditional desktop, specifically, where Windows still holds.

The holdout was never technology

Servers were allowed to be Linux because they are invisible and admin-managed. Nobody in procurement had to retrain for them, and no end user ever saw one. The desktop stayed Windows for a different reason: end-user friction. The familiar office suite, the one line-of-business application, the training cost of change.

Capability was settled years ago. A modern Linux desktop is not the rough thing it was a decade back. What kept it out was never that it could not do the job. It was that changing what sits in front of a human is expensive, and nobody had a reason strong enough to pay.

Mobile already broke the excuse

That mobile row is the tell. Android is a Linux kernel and iOS is a Unix, so the moment people built a brand-new human-facing computing tier from scratch, they built it on the same foundations as the server and never looked back.

The desktop is not the one tier humans refuse to run Linux on. It is the one tier old enough to have locked in before Linux was ready, and it has coasted on that lock-in ever since. That reframes the whole problem: it is not a preference to overcome, it is an incumbency to pry open.

The engineers are already there

The 3% average hides the one group that matters. Among developers, 28% run Ubuntu as their personal machine, and once you add the other distributions and Windows Subsystem for Linux (another 17%), close to half the profession works in a Linux userland every day. The aggregate buries them because they are a small share of all the seats there are.

And they reach that half against the grain. The standard-issue machine is a Windows laptop; the management stack, the security agent, and the identity system are Windows-first; the licence is already bought in a bundle; the exception process taxes anyone who deviates; and WSL is handed over as the pressure valve that keeps them on the managed host. Half the profession runs Linux anyway.

That is not a ceiling, it is a floor held down. The near-half among engineers is a suppressed number, what the estate permits, not what the people would choose. Take the friction away and it rises.

And yet even that suppressed half barely moves the headline number, because in a company of thousands the technical staff are a rounding error in total desktops.

The technical crowd does not move the desktop number. It makes the migration that would move it survivable, by proving the skills and the tooling already exist.

So the engineer segment is not the growth. It is the enabling precondition. It is the evidence a procurement office needs that a Linux fleet can actually be run, before it commits the seats that would show up in the statistics.

Why the server pulls the desktop

Once an estate standardises on Linux infrastructure, four forces pull the desktop after it, roughly in order of strength.

• Skills arbitrage. An admin who runs a Linux fleet all day has no friction on a Linux desktop. As the estate goes Linux, the marginal cost of a Linux workstation for technical staff falls to near zero.
• Toolchain convergence. The desktop has hollowed out to a terminal, a browser, and an editor, and the real work happens inside a container. When the dev environment is Linux regardless of host, the host operating system loses its moat.
• Homogeneity. If the whole estate is Linux, the desktop collapses to one patch pipeline, one config tool, one threat model. Sovereignty and a minimal attack surface turn out to be the same argument wearing two hats.
• Procurement politics. Servers were always allowed to be Linux; the desktop was the holdout on friction. Something has to be heavy enough to override that friction.

Sovereignty is the lever

The European sovereignty push is the first thing heavy enough. It does not argue with the user. It re-files the desktop as the same data-residency and foreign-jurisdiction problem already solved on the server, the one behind telemetry and who owns the infrastructure.

Once the desktop is a jurisdiction question rather than a taste question, it moves to the procurement office, where Linux has always won. Schleswig-Holstein is the working proof: 30,000 administrative workstations moving to open-source office software and Linux, 80% converted by late 2025, 15 million euros a year saved against a one-time cost of 9 million, and payback inside a year.

The lever is already moving at the format layer. Germany's federal digital-stack plan mandates two open document formats, ODF and PDF, and leaves Microsoft's proprietary format off the list entirely, with compliance targeted for 2027. The United Kingdom mandated ODF for government back in 2014, and the Interoperable Europe Act points every EU administration the same way.

Mandate the open format and the office suite stops being a reason to keep the operating system. The biggest thing pinning an ordinary seat to Windows quietly comes unpinned.

And the endpoint is not a peripheral layer in that threat model. It is the most sensitive one: credentials, live sessions, decryption keys, and the human decisions all sit there. A programme that runs on a foreign-controlled endpoint has conceded the layer that matters most. Sequencing the desktop last is fine; exempting it forever is the tell.

Sovereign on a non-sovereign operating system is not sovereign.

The sovereign score

You could reduce all of this to a single number. Score an estate by the share of each tier that is genuinely sovereign, then combine the tiers. Average them naively and Europe looks respectable: the servers and the cloud pull the mean up past halfway.

But an average treats a supercomputer and a laptop as equally exposed, which is nonsense. Weight each tier by where a foreign lever actually hurts, the layer that holds the credentials, the keys, the live sessions, and the human decisions, and the endpoint swallows the weight. The score becomes, more or less, the sovereignty of the desktop.

And the sovereign desktop in Europe stands under three percent, below even the three that runs Linux at all, because sovereign means an EU-controlled operating system on hardware you can attest, not a Linux install on a foreign vendor's laptop.

By its infrastructure, Europe is most of the way sovereign. By the measure that governs the risk, it is barely off zero, because the tier that decides the score is the one still running a foreign OS.

The buy side is already solved

The usual objection is that you cannot buy Linux fleets. You can, today, at scale, with real support contracts. There are three routes.

• Tier-1 OEMs certify Linux workstations with enterprise support and global return logistics, the same procurement machinery as their Windows lines.
• Resellers and managed providers source, image, and provision Linux exactly as they do Windows, which is how a five-hundred-seat order actually gets filled.
• EU sovereign vendors assemble Linux machines inside Europe, and some replace the proprietary firmware with an open implementation, closing a firmware attack surface a sovereign buyer genuinely cares about.

The operating system is sovereign by construction, and more so with a European backer. Because the code is open, no single vendor holds the update keys or a telemetry pipe, so any mainstream Linux is already a step out from under a foreign jurisdiction. A European enterprise distribution adds the commercial layer: a support contract and a security response under EU law.

Hardware assembled in Europe, firmware you can inspect, and an operating system nobody can remotely relicense: the sovereign stack exists at every layer, not only in the marketing.

The revealed preference is louder than any of them. In 2026 the three largest PC makers each became premier funders of the Linux firmware update service. You do not pay to keep the lights on for a market you think is charity.

The bottleneck moved downstream

So procurement is not the constraint. Two things are, and they are the same two that bound the public-sector migrations.

The first is fleet management. There is no turnkey equivalent of the Windows or Apple management stack, the zero-touch enrollment and policy push a generic IT org expects. You assemble it from parts. Buying a Linux fleet is trivial; running one is a platform you build.

The second is the line-of-business long tail: the CAD tool, the ERP fat client, the one workbook finance will not give up. Schleswig-Holstein explicitly carves out the minority of seats where specialised software still needs Windows. That residual is where migrations die.

But that tail is genuinely a tail. Most seats are now a browser and webmail, where the operating system underneath is invisible to the person using it, and the web versions of the office suite and the chat tools have quietly removed much of what once pinned them to Windows. The genuinely locked seats are a minority, not the default.

Buying a Linux fleet is trivial. Running one is a platform you build, and the line-of-business long tail is where migrations actually die.

Which is why you start with the engineers

Both bottlenecks point at the same first move. The seats that already have the fleet-management capability and carry no line-of-business blocker are the technical ones: engineering, infrastructure, and staff whose toolchain is already Linux-native.

So the migration that ships is not "everyone off Windows." It is segmented. The engineers go first, because they are ready and they prove it can be run. The browser-only majority, the knowledge workers whose whole working surface is a browser and webmail, are the volume, and Linux serves them without noticing. Only the genuinely Windows-locked seats stay, and they are a minority.

For this group the two arguments point the same way, which is rare. Sovereignty usually asks a user to trade utility for principle. For the people who run the estate it does the opposite. An operator who lives in a Linux fleet all day, then reaches it from a mandated Windows workstation, pays a parity tax on every task, and that endpoint holds their privileged credentials, the single most sensitive layer in the sovereignty threat model.

A Linux workstation removes the friction and closes that layer at once, so the current policy costs both. The real objection was never Linux anyway. It was an unmanaged endpoint holding privileged access, and a managed, attestable Linux fleet answers that directly.

The honest counter-forces do not sink this, but they shape it. Windows Subsystem for Linux and macOS are real pressure valves: they hand a developer a Linux userland without leaving a managed host, and they may suppress native adoption indefinitely. A sovereign buyer, though, is not solving for developer comfort. A Linux userland inside a foreign-jurisdiction host still runs on the operating system the sovereignty case is trying to leave.

The aggregate needs the majority, not just the engineers. Technical staff alone are a rounding error in total seats, so the European number only moves when the browser-only majority moves with them, which is what a public-sector mandate, or a determined enterprise, sets going. And the scar is real: an earlier German city migrated and rolled most of it back within four years, on training and application compatibility, not on the technology.

The progression, then

It is not a groundswell of users choosing Linux. It is the desktop becoming a procurement decision, governed by the same logic that made the server Linux a decade ago, and taken one segment at a time.

Sovereignty supplies the mandate. The engineers supply the capability, and the first seats. Procurement, the part everyone assumed was the hard bit, turns out to be the easy one.

Sovereignty does not persuade users onto Linux. It turns the desktop into a procurement decision, and hands the engineers the first seats.

The first seat is your own

There is an older idea under all of this: you cannot hand out a freedom you do not hold. An organisation that sells sovereign systems from a foreign-controlled endpoint, or an engineer who builds them on a machine whose keys belong to someone else, is trying to give away what it does not have.

Sovereignty is not a product you ship to a client. It is a state you reach yourself, first, at the one seat where your credentials and your decisions live. The engineers already running Linux against the grain have started their own liberation. That is why they can lead the rest: not because they are the most technical, but because they are already free.

And a market, for whoever leads

The same idea has a commercial edge. Europe is mandating sovereignty from the top, and demand for it will outrun the supply of firms that can deliver. The credential that wins that work is not a deck. It is a sovereign estate you already run.

A company that has liberated its own estate, the engineers first and the offices behind them, has proof it can liberate a client's, and it can say what a competitor still on Windows cannot: we run what we sell you. In a sovereignty market, the migration you did for yourself becomes the reference that wins the contract. Self-liberation is not only the precondition to lead. It is the pitch.