CipherOS

Security-Focused, Container-First Operating System

CipherOS delivers a hardened, reproducible environment for developers, security researchers, and edge computing with minimal attack surface and maximum control | Planned Release Date: 2026 June.

Stay updated on releases and security announcements

Hardened Defaults

Container-First

Fast Boot

Reproducible

About CipherOS

CipherOS is a security-focused operating system designed from the ground up for modern development workflows, security research, and edge computing deployments. Our philosophy centers on minimal attack surfaces, reproducible builds, and container-native workflows.

The system is built for technical users who require full control over their environment without compromising on security or performance. We prioritize transparency in our design decisions and maintainability through a clear governance model and contribution guidelines.

CipherOS targets developers working with containerized applications, security researchers requiring isolated environments, and organizations deploying to edge locations where security and reliability are paramount. The design intentionally avoids unnecessary complexity while providing powerful customization options.

Our maintainability model follows a rolling release pattern with versioned base images that can be pinned for production deployments. The governance structure is community-driven with a core team responsible for security updates and architectural decisions.

The operating system is designed to run efficiently on a wide range of hardware, from developer workstations to resource-constrained edge devices, without sacrificing security features or development tooling.

~1.3GB

Base Image Size

x86_64, ARM64

Supported Architectures

Linux 6.6 LTS

Kernel Version

Init Systems

Core Principles

Security by Default

All system components are configured with security as the primary consideration, not an afterthought. This includes kernel hardening, minimal services, and principle of least privilege.

Applications run in isolated contexts by default, with careful control over system capabilities and network access.

sysctl -w kernel.kptr_restrict=2

Container-Native Design

The system is designed around container workflows with first-class support for Docker, Podman, and other container runtimes.

Base images are optimized for container deployment with minimal overhead and fast startup times.

FROM cipheros/base:latest

Reproducible Builds

Every component and the entire system can be rebuilt from source with bit-for-bit identical results, ensuring verifiable integrity.

Build environments are containerized and version-pinned to eliminate dependency drift and ensure consistency.

cipher-build --verify --reproducible

Performance Focus

System components are optimized for fast boot times and minimal resource usage while maintaining security guarantees.

Careful selection of dependencies and compilation flags ensures optimal performance for target workloads.

systemd-analyze critical-chain

Explicit Configuration

All system configuration is explicit and version-controlled, with no hidden defaults or magic behavior.

Configuration changes are transactional and can be rolled back, with clear audit trails for all modifications.

/etc/cipheros/config.d/90-network.conf

Modular Architecture

The system is composed of discrete, swappable modules that can be independently updated and verified.

This allows for custom distributions tailored to specific use cases while maintaining core security properties.

cipher-module install security-hardening

Core Features

Curated Dev Toolchain

Pre-configured development environments with modern tooling, debuggers, and language runtimes optimized for containerized development workflows.

Integrated development containers with hot-reload capabilities
Multi-language support with version management
Pre-configured IDE configurations and extensions

Reduces setup time and ensures consistent development environments across teams.

Container-First Workflows

Native integration with container runtimes and orchestration platforms, with optimized kernel settings and filesystem drivers.

Direct integration with Docker, Podman, and containerd
Optimized overlay filesystems and namespace handling
Built-in container networking and service discovery

Streamlines container development and deployment with minimal configuration.

Reproducible Images & Package Pinning

Deterministic builds that produce identical artifacts regardless of build environment, with cryptographic verification of all components.

Bit-for-bit reproducible builds from source
Cryptographic verification of package integrity
Version pinning with dependency resolution

Ensures system integrity and enables secure software supply chains.

Hardened Defaults

Security-hardened configuration applied out-of-the-box, including kernel parameters, service configurations, and user permissions.

Kernel self-protection mechanisms enabled
Minimal attack surface with disabled unnecessary services
Mandatory Access Control with customizable policies

Provides strong security baseline without requiring expert configuration.

Fast Boot & Snapshot Recovery

Optimized boot process with parallel service initialization and instant system state recovery from snapshots.

Parallel service startup with dependency optimization
Instant recovery from system snapshots
A/B system updates with rollback capability

Minimizes downtime and enables rapid recovery from failures.

Lightweight UI/Session Management

Minimal graphical environment focused on performance and security, with optional desktop environments available as modules.

Minimal window manager with essential utilities
Secure remote desktop access
Session isolation and clean-up

Balances usability with security and performance requirements.

Custom Kernel Tuning

Pre-tuned kernel configurations for different workloads, with easy customization and module management.

Workload-optimized kernel configurations
Dynamic kernel module loading
Live kernel patching for critical updates

Optimizes performance and resource usage for specific use cases.

Package Overlay System

Layered package management that allows custom packages and configurations without modifying base system components.

Layered package management with conflict resolution
Custom package repositories with signing
Atomic updates with rollback capability

Enables customization while maintaining system integrity and updateability.

Secure Update Model

Cryptographically verified updates with minimal downtime, supporting both rolling and versioned release models.

Cryptographic verification of update integrity
A/B updates with automatic rollback on failure
Delta updates to minimize bandwidth usage

Ensures secure and reliable system updates with minimal disruption.

Configuration-as-Code

Entire system configuration managed through declarative files that can be version-controlled and automatically applied.

Declarative configuration with validation
Git-integrated configuration management
Automated configuration deployment

Enables infrastructure-as-code practices for system management.

Use Cases

Individual Developers

CipherOS provides developers with a consistent, secure environment that works identically across machines. The container-native design means development environments are isolated, reproducible, and easily shareable.

Development tooling is pre-configured with modern editors, debuggers, and language runtimes. The system supports multiple programming languages and frameworks out of the box, with easy management of versions and dependencies.

The reproducible builds ensure that what developers test locally matches what runs in production. The lightweight design means more resources available for development workloads rather than system overhead.

Security features protect developers from supply chain attacks and provide safe environments for testing potentially malicious code. The snapshot functionality allows easy rollback of experimental changes.

Example development environment configuration

# ~/.config/cipheros/dev-env.conf
[language]
python = "3.11"
nodejs = "18"
go = "1.20"

[tooling]
editor = "vscode"
containers = "docker"
orchestration = "kubernetes"

[aliases]
dc = "docker compose"
k = "kubectl"
lg = "lazygit"

Cloud & CI Environments

CipherOS is optimized for cloud and continuous integration environments where consistency, security, and fast startup times are critical. The minimal base image reduces attack surface and resource consumption.

The container-native design means CipherOS can serve as both host OS for container orchestration and as a base for application containers. The reproducible builds ensure identical environments across development, testing, and production.

Fast boot times and efficient resource usage make CipherOS ideal for ephemeral cloud instances and CI runners. The secure update model ensures systems can be safely updated without service disruption.

Integration with cloud init and configuration management tools allows automated provisioning of instances with specific security policies and application requirements.

Example CI pipeline configuration

# Dockerfile for CI runner
FROM cipheros/base:latest

# Install CI dependencies
RUN cipher-pkg install git docker kubectl

# Set up build environment
COPY . /build
WORKDIR /build

# Run security scan
RUN cipher-scan --security

# Build application
RUN make build

# Run tests
RUN make test

# Create deployment artifact
RUN make package

Security Research

For security researchers, CipherOS provides isolated, instrumented environments for analyzing malware, testing exploits, and developing security tools. The hardened defaults protect researchers from accidental system compromise.

The container and namespace isolation allows researchers to safely analyze potentially malicious code without risking the host system. Snapshot functionality enables quick restoration to known good states after analysis.

Built-in instrumentation and debugging tools help researchers understand system behavior during security testing. The reproducible builds ensure that research environments can be exactly replicated by other researchers.

Integration with security frameworks and tooling makes CipherOS suitable for both offensive and defensive security research. The minimal base reduces noise during analysis and makes anomalous behavior easier to detect.

Example isolation configuration

# Create isolated research environment
cipher-ns create research-env \
  --net none \
  --cap-drop ALL \
  --security-profile hardened

# Enter the namespace
cipher-ns enter research-env

# Analysis tools available in isolated context
cipher-pkg install strace ltrace gdb radare2

# Run analysis with full isolation
./suspicious-binary --analyze

Embedded & Edge Computing

CipherOS is designed for resource-constrained embedded and edge computing environments where security, reliability, and efficient resource usage are paramount. The minimal base image fits small storage devices while providing full functionality.

Support for multiple architectures including ARM and RISC-V makes CipherOS suitable for a wide range of embedded devices. The customizable kernel allows optimization for specific hardware and workload requirements.

The secure update model ensures edge devices can be safely updated even with unreliable network connections. A/B updates with rollback capability prevent bricking devices during failed updates.

Container support allows applications to be deployed consistently across diverse hardware while maintaining isolation between components. The reproducible builds ensure identical behavior across all deployed devices.

Example embedded image customization

# Build configuration for Raspberry Pi
[board]
architecture = "arm64"
model = "raspberrypi-4"

[kernel]
config = "minimal"
modules = ["wifi", "bluetooth", "gpio"]

[packages]
base = ["docker", "network-manager"]
app = ["edge-runtime", "sensors-service"]

[storage]
rootfs = "ext4"
size = "2GB"

# Cross-compile for target
cipher-build --arch arm64 --target raspberrypi-4

Performance & Benchmarks

CipherOS performance measurements follow a rigorous methodology focused on real-world usage scenarios rather than synthetic benchmarks. All tests are conducted on standardized hardware with minimal external variables.

Our benchmarking approach emphasizes consistency and reproducibility. Each test is run multiple times with statistical analysis to account for variance. The testing environment is carefully controlled to minimize external influences on results.

Key metrics include boot time, application startup latency, container creation time, memory usage under load, and I/O throughput. These measurements provide a comprehensive view of system performance across different workload types.

It's important to note that performance can vary based on hardware configuration, workload characteristics, and system tuning. The provided metrics should be considered representative rather than absolute guarantees.

Recommended Performance Commands

# Analyze boot performance
systemd-analyze time
systemd-analyze critical-chain
systemd-analyze blame

# Measure application startup
time application --version

# Monitor system resources
iostat -x 1
vmstat 1
htop

# Container performance
docker run --rm cipheros/base time uname -a

# Network performance
iperf3 -c target-host
netperf -H target-host

Example Performance Metrics

Note: These are example metrics from standardized test environments. Your results may vary.

System Boot Time (Example)

Kernel initialization: 1.2s
Init system startup: 0.8s
Service initialization: 2.1s
Total boot time: 4.1s

Measured on Intel i5-8300H with NVMe SSD

Reproducing Metrics

To reproduce these metrics in your environment, use the standardized testing scripts available in the CipherOS benchmarking repository. Ensure consistent hardware configuration and minimize background processes during testing.

For accurate comparisons, test under similar conditions to your expected production environment. Consider factors like storage type (SSD vs HDD), memory capacity, and CPU performance characteristics.

When reporting performance issues, include detailed system information, workload characteristics, and the exact commands used for measurement. This information helps identify optimization opportunities.

Security & Privacy

Secure Defaults

CipherOS applies security hardening measures by default, eliminating the need for manual configuration of basic security settings. The system is designed with a minimal attack surface, with unnecessary services disabled and network ports closed.

Kernel security features like ASLR, stack protection, and kernel module signing are enabled out of the box. The principle of least privilege is applied to system services and user applications.

Mandatory access control systems provide additional protection against privilege escalation and unauthorized resource access. These controls are configured with balanced policies that provide security without breaking legitimate applications.

Secure Update Model

CipherOS uses a cryptographically verified update system that ensures only authentic packages from trusted sources are installed. All updates are signed with strong cryptography and verified before application.

The update system supports both rolling releases for latest features and versioned releases for stability. A/B updates with automatic rollback protect against failed updates and ensure system reliability.

Security updates are delivered promptly with clear documentation of vulnerabilities and mitigation strategies. The reproducible build system allows independent verification of update integrity.

Application Sandboxing

Applications run in isolated contexts by default, with careful control over system resources and capabilities. Container technology provides strong isolation between applications and the host system.

Fine-grained security policies control application access to sensitive resources like network, filesystem, and hardware devices. These policies can be customized based on application requirements and security needs.

The system includes tools for analyzing application behavior and generating appropriate sandboxing policies. This balances security with functionality, ensuring applications work correctly while maintaining system integrity.

Telemetry Policy

CipherOS does not collect any telemetry data by default. The system is designed with privacy as a core principle, and no information is transmitted to external servers without explicit user consent.

Any optional data collection for improvement purposes is strictly opt-in with clear documentation of what data is collected and how it is used. Users have full control over any data sharing decisions.

The system includes tools for monitoring network traffic to verify no unexpected communications occur. All network connections made by the system are documented and can be inspected by users.

Verification & Auditing

CipherOS provides comprehensive tools for verifying system integrity and auditing security configuration. These tools help ensure the system remains in a known secure state and detect potential security issues.

Regular security scans check for vulnerabilities and misconfigurations. The system includes automated compliance checking against security benchmarks from organizations like CIS and NIST.

All system components can be independently verified through cryptographic hashes and digital signatures. The reproducible build system allows anyone to verify that the distributed images match the published source code.

Example verification commands

# Verify ISO checksum
sha256sum cipheros-amd64.iso
# Compare with published checksum

# Verify GPG signature
gpg --import cipheros-public-key.asc
gpg --verify cipheros-amd64.iso.sig cipheros-amd64.iso

# Verify installed packages
cipher-pkg verify --all

# Security scan
cipher-scan --security

# Check system compliance
cipher-audit --profile cis-level1

Development Roadmap

Concept & Design

Completed

Initial system architecture design, security model definition, and core component selection. Established development workflows and contribution guidelines.

Artifacts:

System architecture documentation
Security model specification
Initial build system prototype

Test Criteria:

Architecture review by security experts
Build system reproducibility verification
Component compatibility assessment

Alpha Release

In Progress

Initial implementation of core system components, basic package management, and minimal boot environment. Early security features and container support.

Artifacts:

Bootable ISO images for x86_64
Basic package repository
Initial documentation

Test Criteria:

Boot success on reference hardware
Basic package installation and removal
Container runtime functionality

Beta Release

Planned

Expanded hardware support, additional architecture targets, and more comprehensive package ecosystem. Enhanced security features and developer tooling.

Artifacts:

ARM64 support
Expanded package repository
Developer SDK

Test Criteria:

Hardware compatibility testing
Application compatibility verification
Security feature effectiveness

Release Candidate

Future

Feature complete with all planned security measures implemented. Comprehensive testing and bug fixing. Performance optimization and documentation completion.

Artifacts:

Release candidate ISOs
Complete documentation
Migration guides

Test Criteria:

Stability under extended load
Security audit completion
User acceptance testing

Stable Release

Future

Production-ready release with long-term support commitment. Regular security updates and maintenance releases. Enterprise support options available.

Artifacts:

Stable release ISOs
Long-term support commitment
Commercial support options

Test Criteria:

Production deployment validation
Security certification completion
Support readiness verification

Maintenance & Evolution

Future

Ongoing security updates, hardware enablement, and incremental improvements. Community-driven feature development and ecosystem expansion.

Artifacts:

Regular security updates
New hardware support
Community packages

Test Criteria:

Update mechanism reliability
Backward compatibility maintenance
Community contribution process

Installation

CipherOS can be installed on physical hardware, virtual machines, or run directly from live media. The installation process emphasizes security verification and reproducibility.

Before installation, verify the integrity of the installation media using the provided checksums and cryptographic signatures. This ensures the image has not been tampered with during download.

The installation process is streamlined but provides advanced options for custom partitioning, network configuration, and security settings. Most users can accept the default configuration for a secure, functional system.

Quick Installation Reference

Verification and installation commands

# SOON

Virtualization

CipherOS runs well in virtualized environments with minimal performance overhead. For best results, enable hardware virtualization extensions and allocate sufficient resources.

QEMU/KVM: Use virtio drivers for disk and network for optimal performance. Enable nested virtualization if running containers inside the VM.

VirtualBox: Enable PAE/NX and allocate at least 2GB RAM. Use the provided Guest Additions for better integration.

VMware: Use hardware version 15 or later for best compatibility. Install open-vm-tools for enhanced functionality.

Bare Metal

Before installation on physical hardware, verify compatibility and prepare necessary drivers for specialized hardware. p>

Pre-installation checks: Test hardware compatibility with the live environment. Check network, storage, and graphics functionality before proceeding with installation.

UEFI vs BIOS: CipherOS supports both UEFI and legacy BIOS systems. UEFI with secure boot is recommended for enhanced security.

Driver availability: Most common hardware is supported out of the box. Proprietary drivers are available for some graphics cards and specialized hardware.

Frequently Asked Questions

What package manager does CipherOS use?

CipherOS uses a custom package manager designed for security and reproducibility. It supports both binary packages and source-based builds, with cryptographic verification of all packages. The package manager uses content-addressable storage and supports atomic updates with rollback capability.

What hardware architectures are supported?

Currently, CipherOS supports x86_64 with ARM64 support in development. The minimal system requirements are 1GB RAM and 2GB storage, though 2GB RAM and 10GB storage are recommended for typical usage. Support for additional architectures like RISC-V is planned for future releases.

How customizable is CipherOS?

CipherOS is highly customizable through its modular architecture. Users can select from predefined profiles or build custom configurations using the package overlay system. The kernel can be customized with compile-time options, and the entire system configuration is managed through declarative files.

What is the update policy?

CipherOS follows a rolling release model with periodic long-term support versions. Security updates are delivered promptly, and the system supports both automatic and manual update processes. The A/B update system ensures reliable updates with automatic rollback in case of failures.

How can I contribute to CipherOS?

Contributions are welcome through our GitHub repository. We accept code contributions, documentation improvements, bug reports, and security advisories. All contributors must agree to our code of conduct, and significant changes require design documents and community review before implementation.

What happens if my system fails to boot?

CipherOS includes multiple recovery options. The bootloader provides previous kernel versions, and the A/B update system maintains a working previous system state. For severe issues, the live environment can be used to chroot into the installed system for repair.

What license does CipherOS use?

CipherOS is open source and primarily uses GPLv3 and Apache 2.0 licenses for system components. Some included applications may use other open source licenses. The build system and documentation are also open source, allowing complete verification and customization.

Does CipherOS collect any telemetry?

No, CipherOS does not collect any telemetry by default. The system is designed with privacy as a core principle. Any optional data collection for improvement purposes is strictly opt-in with clear documentation of what data is collected and how it is used.

Is CipherOS suitable for enterprise use?

Yes, CipherOS is designed with enterprise requirements in mind. It includes features like centralized management, security compliance tools, and commercial support options. The reproducible builds and secure update model make it suitable for regulated environments.

How does container support work?

CipherOS has first-class container support with Docker, Podman, and other container runtimes. The kernel is optimized for container workloads, and the system includes tools for container management and orchestration. Container images can be built using CipherOS as a base.

Can I use CipherOS for CI/CD pipelines?

Yes, CipherOS is well-suited for CI/CD environments. The minimal base image reduces resource usage, and the container-native design integrates well with modern CI systems. Pre-built CI images are available with common development tools pre-installed.

Are kernel patches applied to CipherOS?

Yes, CipherOS includes selected kernel patches for security hardening, performance optimization, and hardware support. All patches are clearly documented, and the kernel configuration is available for review. The kernel can be customized with additional patches if needed.

How are packages signed and verified?

All packages are cryptographically signed using strong cryptography. The package manager verifies signatures before installation, and the build system reproduces packages to ensure integrity. Users can verify the entire package repository against published cryptographic hashes.

Are there mirror servers for downloads?

Yes, CipherOS uses a global content delivery network with mirrors in multiple regions. Users can select their preferred mirror, and the system automatically falls back to other mirrors if needed. All mirrors are regularly synchronized and verified for integrity.

What support channels are available?

Community support is available through our forums, Discord server, and GitHub issues. Documentation includes troubleshooting guides and how-to articles. Commercial support with SLAs is available for enterprise users through certified partners.

Can I run CipherOS alongside another OS?

Yes, CipherOS can be dual-booted with other operating systems. The installer provides options for manual partitioning, and the bootloader automatically detects other installed systems. For testing, running CipherOS in a virtual machine is recommended.

How are security vulnerabilities handled?

Security vulnerabilities are addressed promptly with coordinated disclosure. Security advisories are published with detailed information and mitigation guidance. The reproducible build system allows independent verification of fixes, and updates are delivered through the secure update channel.

What desktop environments are available?

CipherOS includes a minimal desktop environment by default, with options for more comprehensive environments available as packages. The system is desktop-agnostic and supports popular environments like GNOME, KDE, and XFCE through the package repository.

Is secure boot supported?

Yes, CipherOS supports UEFI secure boot. The boot components are signed with recognized certificates, and users can enroll their own keys for custom builds. Secure boot enhances system integrity by verifying all boot components before execution.

How does CipherOS handle proprietary software?

CipherOS focuses on open source software but provides mechanisms for installing proprietary software when necessary. Proprietary components are clearly marked in the package repository, and users can enable additional repositories for proprietary software.

Contribution & Governance

CipherOS is developed as an open source project with community involvement and transparent governance. Contributions are welcome from anyone following our contribution guidelines and code of conduct.

The project is managed by a core team responsible for security, architecture decisions, and release management. Major decisions are made through community discussion and consensus when possible.

All contributors are expected to follow the code of conduct, which emphasizes respectful communication and inclusive collaboration. The project values diverse perspectives and aims to create a welcoming environment for all contributors.

Contribution Process

Contributions start with an issue or discussion on the project forums. For code changes, fork the repository and create a feature branch. All changes require tests and documentation updates where applicable.

Pull requests are reviewed by maintainers and must pass automated testing before merging. Significant changes require design documents and community review. Security-related changes follow a separate disclosure process.

Example CONTRIBUTING.md excerpt

# Contribution Guidelines

## Code Standards
- Follow existing code style and conventions
- Include tests for new functionality
- Update documentation for user-facing changes

## Submission Process
1. Create an issue describing the change
2. Fork the repository and create a feature branch
3. Implement changes with tests
4. Submit a pull request for review

## Review Process
- Two maintainers must approve changes
- All tests must pass
- Security implications are assessed
- Documentation is verified

## Communication
- Use inclusive language
- Be respectful of different perspectives
- Focus on technical merit

Governance Model

CipherOS uses a meritocratic governance model where contributors gain influence through sustained, quality contributions. The core team is responsible for project direction and technical decisions.

Major decisions are made through community discussion with a focus on consensus. When consensus cannot be reached, the core team makes the final decision with transparent rationale.

The project follows a code of conduct that applies to all community spaces. Enforcement is handled by a dedicated committee separate from technical leadership.

Testing Expectations

All code changes must include appropriate tests. The project maintains comprehensive test suites for unit testing, integration testing, and system testing.

Tests are automatically run on all pull requests, and must pass before merging. The test infrastructure includes multiple hardware platforms and configuration variants to ensure broad compatibility.

Performance regression testing ensures that changes do not negatively impact system performance. Security testing verifies that security properties are maintained.

Stay Updated

Get notified about releases, security updates, and important announcements from the CipherOS team.

We respect your privacy. Unsubscribe at any time.