credkellar/osx repository overview

⁠Docker Hub pack — credkellar/osx

OSx Forge: zero-dependency Rust builder for an immutable-core microkernel OS. Manifest to ISO plans.

⁠Categories

Operating Systems · Developer Tools · Integration & Delivery

OSx: Forge, a zero-dependency Rust OS builder (TOML manifest, sandbox plans, ISO assembly, PXE deploy), plus custom-os-root, the immutable-core microkernel OS it builds - dedup + ARC storage, DPDK bypass, TPM enclave, on-device AI.

⁠Full overview

OSx is two things in one repository:

1. Forge (OSx/) — a zero-dependency Rust tool that builds an operating system: it parses a strict TOML manifest (zero_bloat_manifest.toml), builds the dependency graph, pins every input by SHA-256 in a deterministic lockfile, plans isolated sandbox builds (with cross-compilation between x86_64 and aarch64), assembles the read-only /core and /apps images plus a UEFI boot stub into a bootable ISO plan, and plans deployment — PXE fleet flashes (up to 100 targets) or small delta updates when only a config changed.

2. The OS (custom-os-root/) — an immutable-core, microkernel-based OS source tree: read-only /core with A/B immutable-swap updates and rollback, sandboxed /apps, deduplicated storage behind a real ARC cache, LZ4 inline block decompression, a kernel-bypass DPDK fast path with tuning profiles (including a pre-configured microsecond-latency profile for Monad HFT nodes — audio/UI stripped, CPU cores pinned, hugepages on), a TPM-backed enclave for keys and biometric hooks, a universal execution layer that parses and plans ELF, PE, and Mach-O binaries, per-app containers with a capability permission broker, and a privacy-first on-device AI daemon.

⁠The image

This Docker image packages Forge (the builder), built from OSx/Cargo.toml:

docker run --rm credkellar/osx --help
docker run --rm -v "$PWD:/work" credkellar/osx build

⁠Honest status

Early-stage, coherent source. Forge's parser, dependency graph, lockfile, and delta updater are real unit-tested logic; the sandbox, assembler, and PXE deployer produce deterministic plans rather than executing namespaces, ISO writes, or network flashes in this build (PXE flashing is additionally gated behind an arm flag that is never set). In the OS tree, the pure-logic modules (ARC, LZ4 codec, ELF/PE/Mach-O header parsers, page allocator, swap state machine) are real; hardware-touching roles (TPM transport, LLM runner) are plan/spec modules and say so in their headers.