Ginux: A Userspace Kernel for Selective Linux Compatibility

Ginux is a configurable userspace kernel that runs as a normal Linux process and establishes a clear, versioned contract between managed workloads and the host kernel.

Background

• Originally an independent Rust kernel that booted via UEFI and ran a Rocky Linux 10 userspace.
• The research phase is finished; the final source lives on the *bootable-kernel* branch and the *bootable-kernel-final* tag.
• Current development focuses on a userspace kernel that can be launched from an ordinary Linux process.

Design Goals

• Preserve Linux ABI: Linux must not break user space. Ginux deliberately offers a smaller, explicit contract to each instance.
• Explicit, versioned boundaries: Every syscall is either emulated, mediated, or denied based on the instance’s contract.
• Containment for AI agents: Operators can place an agent inside an instance that only exposes the operations and virtual resources required for the task.

Core Components

• x86‑64 interpreter with a balanced native ptrace backend.
• Strict, versioned instance configuration and lifecycle.
• Digest‑pinned OCI root, immutable filesystem index, bounded overlay.
• Ginux‑owned process, credential, signal, synchronization, timer, and event models.
• Virtual devices with explicit assignment, ownership, and revocation.
• Bounded virtual /proc, /sys, cgroup v2, mount, namespace, machine, and boot‑identity views.
• Host‑shared network backend that remains syscall‑mediated.
• A pinned Rocky Linux 10 systemd baseline that reaches *multi‑user.target*.

Usage

1. Build and run: `make run-host` boots a QEMU Rocky host and logs you into its shell.
2. Create an instance: `ginux instance create rocky` downloads and verifies the pinned Rocky OCI image.
3. Interact: Log in as root (`password: ginux`), explore, and detach with `Ctrl‑]`.
4. Shutdown: `kill -RTMIN+4 1` stops systemd and returns to the host.

Current Status

• Ginux is research software; it has not received independent security certification.
• It does not provide complete Linux compatibility and is not ready for production workloads.
• The contract inventory, configurable policy, adversarial tests, performance costs, and escape boundaries are tracked through the HDAE gates.

Verification

• The contract is part of the instance definition; validate it before launch.
• The `make demo-gate-9` and `make test-systemd-interactive` targets provide automated regression tests.
• The full intent, threat model, and gate plan live in the `hdae/` directory.

Licensing

Ginux is available under the Apache License 2.0.

Key Takeaways

• Ginux offers a controlled, explicit boundary between workloads and the host kernel.
• It is useful for experimenting with containment of AI agents and other automated software.
• Production use requires further development and independent security assessment.