Subgraph Citadel / Subgraph OS

Citadel (also called Subgraph OS) is a Linux-based operating system designed for use in hostile network environments and against sophisticated adversaries. It is built around a read-only, immutable base system protected by dm-verity, a Linux kernel integrity mechanism that prevents the OS from booting if any modification is detected, ensuring a cryptographically verified clean state on every restart. Key architectural layers: - Citadel Base: A minimal, immutable kernel providing only essential services (kernel, init system, graphical display) with no user applications or persistent data - Isolation Layer: Supports both container-based realms (using Linux namespaces and cgroups) and hypervisor-based realms (using a custom Rust-implemented hypervisor) for hardware-level isolation - User Realms: Fully isolated computing environments where user work takes place, each with separate process, network, filesystem, and PID namespaces Security features: - dm-verity filesystem integrity verification on every block of the base filesystem - UEFI Secure Boot for verified boot chain - Kernel hardening: KASLR, SMEP, SMAP, Control Flow Integrity - Memory protections: ASLR, stack canaries, heap protection - Compiler security: stack protector, fortify source, PIE - SELinux/AppArmor integration at runtime - seccomp-bpf syscall filtering per realm - Per-realm virtual network isolation - TPM 2.0 integration for secure key storage and attestation - 100% reproducible builds verifiable from source by independent researchers - Atomic signed binary updates (fully applied or fully rolled back) The system targets system administrators, security researchers, software developers, government/classified operations, financial services, and embedded systems deployments. Built in Montreal, Quebec, Canada. Open source.