v0.0.6a · phases 0–11 done · phase 12 next · 0.0.6b in development

An operating system, written from scratch.

Cerberus is a 64-bit OS with its own kernel, its own file system, its own drivers and its own desktop. Nothing here is Linux, BSD or Windows underneath.

See what works Roadmap

Settings: a custom accent colour, the Aurora wallpaper and the Chase window border

21nscontext switch

30nssystem call

0%CPU on an idle desktop

74system calls

Why

Three goals, in this order.

Private and secure by design

No telemetry. Nothing leaves the machine unless you ask. Memory is never writable and executable at once, and every system-call argument is treated as hostile.

Fast and small

A message between two programs takes well under a microsecond. Every performance budget is measured and recorded, so a regression is visible.

Understandable

One small system, with a written specification and the reasoning behind every decision written down.

What works today

A real system, from the boot sector to the window shadows.

It runs in QEMU and VirtualBox today, brings up every CPU core, and runs protected user programs. Each card is the first line of its section in the feature inventory.

Boot and hardware

Boots from the hybrid ISO on BIOS and UEFI (Limine); straight into the kernel, no menu wait.

Files

VFS: one tree, mounts, ./.., symbolic links, permissions, mount flags (ro, noexec, nodev, nosuid), name cache.

Programs and IPC

Ring-3 processes from position-independent ELF files; ASLR; fork, execve, waitpid; 74 system calls (docs/SYSCALLS.md); a small libc.

Kernel shell

Commands grouped by help; help <command>, help tests.

Desktop

Move by the title bar; resize at any edge or corner (cursor changes); minimise / maximise / close buttons (Windows style); stacking; focus follows clicks.

Pane, the window server as a program

pane in the shell (or pane --demo for four demo windows): the kernel desktop hands over the screen, /bin/pane composites windows from programs, Ctrl+Alt+Q (or the…

Security and privacy

W^X everywhere, SMEP/SMAP/UMIP, stack protectors, zeroed memory, heap free-list encoding, guard pages, user-copy routines only, ASLR, CSPRNG.

Not there yet: Networking, user accounts and login, sound, USB, printing, real hardware, an installer, the Spec compiler, images or any file type but text in the built-in apps.

What's new

Version 0.0.6a, released 2026-10-13.

The release notes, straight from the changelog.

Fixed

VirtualBox: the mouse pointer follows the host's pointer again instead of jumping only when a button is clicked (B-016). The desktop now asks the guest device for the pointer position on every tick.

The full release notes Every release

Security and privacy

Nothing leaves the machine unless you ask.

In Cerberus, security rules are requirements with tests, not afterthoughts. Every one of them below is enforced in the current build.

Zero telemetry.

Cerberus collects nothing and reports nothing. No usage data, no account to sign in to, no background phone-home. Today it has no network stack at all.

Never writable and executable

No memory can be both at once. Every request for such a mapping is refused, in the kernel and in every program.

Every argument is hostile

Each system-call argument is checked. Bad pointers, lengths that wrap and unknown flags get an error, never kernel code.

Walls in the processor

SMEP, SMAP and UMIP are on wherever the CPU has them: the kernel can neither run nor casually touch program memory.

A different layout every run

A program's code, stack and mapped memory land at different addresses each time it starts.

Nothing left behind

Memory is zeroed before a program gets it, and a new disk block never shows what a deleted file left in it.

Identity that cannot be faked

A program receiving a message learns the sender's process and user from the kernel, not from the message.

Disks are not trusted

cerfs checks every field and checksums its metadata. A damaged disk gives an error, never a crash.

Attacked on every release

Fuzzers hammer the program loader, the archive reader, the file system and the system-call interface; 54 integration tests run on every build.

Real randomness

A ChaCha20 generator in the kernel, seeded from the CPU's hardware generator and interrupt timing.

Planned, and already written into the specification

phase 12Private windows. Screenshots, screen recording and clipboard history need your permission per app, denied by default.

phase 14Quiet network. Incoming connections blocked by default, and nothing sent at boot except DHCP.

phase 15Sandboxed apps. Each app declares what it needs and can be denied network, files or devices.

phase 18Your disk, your updates. Optional full-disk encryption, and signed updates that never install on their own.

Open bugs, from the ledger

B-016 On VirtualBox the pointer only moved when a button was clicked

B-010 eventtest misses its 1 ms wake-up limit on VirtualBox

Architecture

A hybrid kernel, in clear layers.

Anything that needs sub-microsecond speed or special processor instructions stays in the kernel. Everything else runs as an ordinary, protected program.

Each layer only talks to the one below it through well-defined, checked doors.

ApplicationsTerminal, file manager, editorphase 13

ServersPane (windows), netd (network)phases 12, 14

KernelMemory, scheduling, system calls, files, drivers, messaging, and a preview desktopworking today

HardwareProcessor cores, memory, disk, screenx86-64

Measured

Every budget is measured and written down.

The newest block of the benchmark record (0.0.5j — 2026-10-13 (hard links; polish round 4)), on QEMU/KVM with 4 cores. Each number is checked against a written budget.

1,161ns

first touch of a memory page (minor page fault)

10µs

to wake an interactive thread

67ns

for a kernel heap allocation and free

300µs

to composite a desktop frame

The desktop

The desktop, so far.

A floating taskbar, a launcher with app search, a calendar with reminders, a lock screen, virtual desktops, and a Settings window that changes the look live. Today it is a preview that runs inside the kernel; phase 12 moves it into its own protected program.

SuperOpen the launcher

SuperTOpen a terminal

AltTabSwitch windows

Super←→Snap a window to half the screen

Super1…4Switch virtual desktop

SuperLLock the screen

PrintSave a screenshot

The calendar with a reminder, opened from the taskbar clock

The launcher with app search and the floating taskbar

Dragging a window to the screen edge: the snap outline

Roadmap

Built in numbered phases. 0 to 11 are done.

Each phase ends in a tested release, and no phase starts until the one before it passes its acceptance tests.

phase 0phase 12 nextphase 19

12 · nextPane: window server as a userland processMove the compositor out of the kernel behind the port protocol (docs/SPEC.md §9); per-window shm buffers, libpane.

13Facet toolkit, shell, applicationsWidget toolkit, desktop shell, and the apps in §12 (Ember terminal, Crate files, Slate editor, Gauge, Dial, Tally, Frame, Daub, Chronos, Warren, lsh, CLI utils).

14Networkingvirtio-net + e1000; netd userland stack (Ethernet, ARP, IPv4, ICMP, UDP, TCP, DHCP, DNS, loopback); socket syscalls 70–83; default-deny inbound firewall; per-app network permission…

15Security model, users, encrypted transportUsers and groups, Argon2id password hashes, credentials, authd broker (no setuid), login and lock screens, restrict sandbox, permission prompts, keyring, TLS client with certificate store, audit log.

15BOur own web browser.

16Spec native backend(was phase 14).

17Software platformDynamic linking with full RELRO, POSIX-subset libc (docs/LIBC.md), ptys and job control, full signals, signed package manager pkg; proof ports: zlib, Lua, tinycc, make.

18Installer, updates, storage encryption, recoveryLive-ISO installer (GPT, cerfs + FAT32 EFI), optional full-disk encryption, signed updates with a fallback kernel, recovery boot entry and repairing fsck.cerfs, service manager with per-service sandbox.

19Stretch(was phase 15).

Read the full roadmap

Spec

A language designed with its operating system.

Spec is the systems language planned for writing Cerberus's own programs. Compiled to native code, statically typed, no garbage collector.

Regions. Memory allocated in a region is freed at its closing brace.
Typed system calls. Part of the language, with no C layer between.
Capability types. A handle cannot be copied by accident or used after it is closed.
Checked register layouts. The compiler refuses a write to a read-only register.

ahci.specplanned syntax

trait Show { fn show(self) -> str }
fn dump[T: Show](v: T)

region r { let x = r.alloc(...); }

syscall write(fd: Fd, buf: &[u8]) -> Result[usize, Errno]

mmio struct AhciPort {
    0x00: clb: u32 rw,
    0x10: is:  u32 rw1c,
}

The compiler has not been started (phase 16) and the syntax is not final. Until then the system is freestanding C++20.

Cerberus

Next: phase 12, Pane.

Move the compositor out of the kernel behind the port protocol (docs/SPEC.md §9); per-window shm buffers, libpane.

Read the full roadmap Release history