Zero is in development. Everything on this page is planned.

Overview

Zero is an operating system and a platform for running applications with confidence.

On each machine it is the operating system: upstream Linux and Zero’s own programs. Across machines it is the platform that runs a team’s workloads.

Linux kernelLinux distributionContainer runtimeKubernetesNetwork pluginService meshMonitoring agentsSecurity scannersYour workloadsZeroone identity per workloadnamespacescgroupsKVMLandlockseccompeBPFWireGuarddm-verityLinux kernelLinux distributionContainer runtimeKubernetesNetwork pluginService meshMonitoring agentsSecurity scannersYour workloadsZeroone identity per workloadnamespacescgroupsKVMLandlockseccompeBPFWireGuarddm-verity

Linux already has what those layers add. Zero uses it directly, and connects it through one identity per workload.

Two products

Zero OS runs on one node and is complete there without the platform. A user or an agent can drive it directly.

Zero Platform runs on a cluster of one node or many. It decides what each node should run. It does not run workloads itself.

Zero OS is like Talos or NixOS: the node, its kernel, the sandboxes, node networking and WireGuard. Zero Platform is like Kubernetes: replicas, service names, service discovery, load balancing and scheduling.

A machine running Zero OS without the platform has no service names, discovery or load balancing. Whoever needs them runs Zero Platform, even on one machine.

Who each is for

Zero Platform is for anyone running a platform for their workloads today, on Kubernetes or anything else. It gives them scheduling, replicas, rollouts, identity, networking and observability across nodes, without assembling a stack.

Zero OS is for anyone with their own machines: personal workstations, self-hosted servers and remote servers, and anyone who needs genuine sandboxing for untrusted or agent-generated code. It gives them an efficient OS with observability, identity, networking and sandboxing built in.

What Zero is not

  • A general Linux distribution.
  • A desktop.
  • Kubernetes-compatible by default.
  • A general cryptography or TLS implementation. Zero never hand-writes cryptography.

Not now: GPU and ML inference, and regulated industries that must use FIPS-validated cryptography.

Where it runs

  • First: Proxmox/KVM x86_64 guests, booted directly.
  • Bare metal and clouds each need a disk image the firmware boots (UEFI or BIOS) and real drivers.
  • One kernel per pod needs KVM. Zero runs on bare metal, on a KVM host such as Proxmox, and on cloud VMs that allow KVM inside.
  • Not in a container. Zero owns the kernel, so running its programs on another kernel does not fit.