Capability-secure · POSIX-compatible · built from scratch

The operating system where
UID 0 is just a number.

LoricaOS grants no ambient authority. No process — not even uid 0 — holds power it wasn't explicitly given. Authority comes only from unforgeable capability tokens, validated at the syscall boundary. A clean-slate kernel, a real desktop, and software you already know.

Download LoricaOS View source

v1 software — first public release. Not production-hardened. The C kernel likely contains real, exploitable vulnerabilities. We'd rather tell you than pretend.

The LoricaOS desktop at 1080p — wallpaper, dock, top bar, About window

Security is the architecture, not a setting

Most systems bolt access control onto an all-powerful root. LoricaOS starts from the opposite end.

No ambient authority

A process can touch the system only through capabilities granted to it at exec time. uid=0 is cosmetic — there is no "superuser" that bypasses the checks. Forge nothing, inherit nothing by default.

Checked at the boundary

Every privileged syscall validates an unforgeable capability token before it acts. Authority lives in the token, not the identity behind it. Fail closed by default.

A from-scratch kernel

Aegis is a clean-slate x86-64 kernel — no Linux or BSD lineage. Written in C with a Rust capability core, it boots, schedules, networks, and runs a real userland on its own terms.

POSIX-compatible

It speaks enough POSIX (atop musl libc) to run software you already know — shells, compilers, network tools, and ported GUI apps — without pretending to be Linux.

A real desktop

Lumen is a compositing display server with frosted-glass windows, a dock, and a suite of native apps: terminal, files, editor, settings, calculator, media, and more.

Signed packages

The herald package manager installs from a Chancery-signed repository — trust flows from a signed release down to every package hash. Add software with one command.

It's a desktop you can actually use

Not a kernel demo. A composited GUI, native apps, and a package ecosystem.

▦ Screenshot — native apps Files + Editor + Calculator open together over the dock; frosted glass + accent theming visible. ~1600×1200.

▦ Screenshot — capabilities in action Terminal: uid=0 yet a privileged syscall is DENIED (ENOCAP). The "money shot" that proves no-ambient-authority. ~1600×1200.

How it's built

LoricaOS is decomposed into independent, versioned pieces — each its own repository.

Aegis

The kernel. Capability model, scheduler, memory, sockets, drivers. Ships as a standalone aegis.elf artifact — adoptable on its own. LoricaOS/Aegis ↗

Lumen

The compositor / display server. Owns the framebuffer; every GUI app is one of its clients over an AF_UNIX protocol. LoricaOS/lumen ↗

herald + Chancery

The package manager and its signed repository. Trust chains from a signed release to every package hash. LoricaOS org ↗

Apps

Terminal, Files, Editor, Settings, Calculator, Tunes, Calendar, and more — each a standalone lumen-* repo published as a signed package.

A look around

Replace these four tiles with real captures as the desktop firms up.

The LoricaOS greeter / login screen at 1080p

▦SettingsSystem pane — Edition: Community, Kernel version, hostname.

▦Apps & games2048 / Snake / Minesweeper — installable via herald.

▦NetworkingFeeds RSS reader or Lantern browser over the native TCP/IP stack.

Editions

Community

Free & open

The full desktop and server OS, source-available, built in the open. Everything on this page. Install it, hack on it, ship it.

Get Community

Enterprise soon

Commercial

Hardened builds, signed enterprise packages, licensing, and support — for organizations that need a contract behind the capability model.

loricaos.com ↗

Get LoricaOS

Two profiles, one project. Boot the ISO in a VM, or write it to a USB stick.

Desktop ISO

The full graphical experience — Lumen, the dock, and the app suite.

Latest release ↗

Server ISO

A text-console build — zero graphical stack, for headless and minimal installs.