Any atomic distro + flatpak packages.

Don’t think in terms of easy to use and unbreakable. You won’t get that because something as simple as losing icons on the desktop is the kinda thing that’ll confuse someone that’s bad with computers. Instead, think in terms of what’s going to be easy for you to fix when you inevitably have to play tech support.

Whichever distro you choose, you could set up SSH access for yourself to do things for them (apart from fixing most networking issues if they can’t connect to the internet ofc).

Debian and install the “unattended-upgrades” package.

You set it up with an email address to complain to when something fucks up and it just works.

You could try Aurora, it’s made by the same people as Bazzite but with a general (or developer) focus instead of a gamer focus, and while it’s not LTS I think it updates less rapidly than Bazzite.

If your user is really tech un-savvy though, I’d just go with ChromeOS Flex. For all their (many) faults Google do at least produce a simple all-in-one experience, and I’d rather my elderly relative use Chrome’s password manager than no password manager at all.

I installed Fedora Silverblue on my parent’s laptop almost a year ago and I haven’t had any complaints or issues.

They’re really not tech literate or heavy users so Silverblue is the perfect fit. I installed and configured Librewolf and Bitwarden for them and everything has been running fine. Everything else is vanilla Silverblue.

They don’t know or don’t care about updating software. But Silverblue does flatpak updates automatically in the background. OS and firmware updates are integrated and handled via the Gnome Software Center, so I’ll click the install button every so often when I visit. No terminal required! There is a password prompt, but at least it’s a GNOME shell password prompt, not a terminal password prompt.

Additionally, I was able to get LUKS encryption working without my parents noticing: https://discussion.fedoraproject.org/t/encryption-advice-for-silverblue/162810/7

It’s not the most secure LUKS implementation, but I’m also not worried about state actors hacking my parent’s laptop. Originally, I skipped the disk encryption entirely because the extra password prompt made it harder to use the computer.

Define what you mean by “locked down”. If you don’t give your user superuser privileges, every distro is locked down because the user can only ever write to their own /home

I’d strongly recommend Mint:

• with Cinnamon DE: very Windows-esque UI
• Ubuntu / Debian-based, i.e. rock-solid, unlikely to break
• 100% automated updates (including automatic removal of old kernels so your /boot won’t get clogged
• Timeshift system snapshots in case something does break. (Note: I’ve only ever used Timeshift to un-fuck systems that I, personally, had fucked with superuser rights and manual meddling.)

elementaryos is great for just this. haven’t used it in a while but i remember it being the most polished user experience on linux.

Take a look at the immutable distros like Fedora Silverblue. It would install updates automatically, and has the ability to always rollback to a working version. I haven’t used it long enough to have version upgrades tested. Perhaps it asks for user input. These upgrades happen twice a year.

If I was doing that these days with my current skills, I’d install some minimal version of Arch Linux and probably would remote into it once in a while to update, or invent some simple script to do the updates unattended. The lesser the packages the easier the whole task.

Also, don’t forget there’s Chrome OS which you can install on a regular PC. (It was called Chrome OS Flex last time I did that for a relative.) It’s the easiest I can remember right now. That’s for situations when all they need is actually just a browser. For those cases Chrome OS shines.

FydeOS might be more in line with what you need. Based on ChromeOS, but without the Google account requirements and spyware. I installed this on my dad’s PC along with setting up DNS-based Ad blocking and it’s been rock solid. If he just needs a browser, that’s basically what it is.

You can check out Bluefin and Aurora, which are Bazzite without the gaming. Pick the former if they’re used to macOS, the latter if Windows.

I personally have installed Mint (Debian edition) with similar needs. Absolutely zero input might be a bit much to ask, since user should be aware of that something is going on before shutting everything down, but when that’s taken care of the unattended upgrades work just fine. Just recently I had to fix a laptop with mint to friend of a friend because upgrade was interrupted. Just running ‘dpkg --configure -a’ followed by apt upgrade and apt dist-upgrade did the job, so not big of a deal for me, but for the owner of the machine that would’ve been pretty much impossible task since they just refuse to learn even the slightest amount of their computer and have a very short temper on anything like that. And I can kind of understand that too, at least up to a point. There are things which I just can’t be arsed to learn which are equally easy to different people.

I think more important than which distro to choose is you setting up remote access for yourself. Tailscale and maybe rust desk or something would be a good idea. Or if you want to go further a vpn connection to a KVM device, some of them support being able to wire into the power button so you have full control. I would also have their account info in your password manager. Then you don’t need them to remember anything because you can do it when needed.

The distro doesn’t matter, the Desktop Environment does.

If they are used to MacOS and want something simple and “out of the way”, go with Gnome.

If they are used to Windows, go with KDE.

Fedora is probably the most straightforward to install and manage right now. You won’t need to “lock down” anything if you don’t give them sudo credentials.and just a regular user account.