nano-container-linux

A minimal Linux whose machines boot from an OCI registry — the image is pulled at boot, not baked into a disk.

pure-Go PID 1OCI over HTTPHCL-configured DNSOpenPubkey SSH certs
GitHub

The idea is small and load-bearing: if a machine can pull its root image from a registry at boot, then a fleet is updated by pushing a tag, and the disk stops being the unit of deployment.

Around that sit the pieces such a fleet needs anyway — authoritative DNS it can configure from files, and short-lived SSH certificates so operators do not carry long-lived keys.

Repositories

oci-initrd boot

initramfs /init, PID 1, pure Go

Boots a machine by pulling its image over HTTP, extracting it into the ramdisk and handing off to the real init.

CI Go reference BSD-3-Clause

dnsd dns

HCL files under etc/dnsd/

An authoritative DNS server configured entirely from HCL files, scanned in three kinds.

CI Go reference BSD-3-Clause

dnsctl dns

command-line control for dnsd

The control tool for dnsd.

CI Go reference BSD-3-Clause

libdnsd dns

shared library for dnsd + dnsctl

The code dnsd and dnsctl both need, in one place rather than two.

CI Go reference BSD-3-Clause

openpubkey-agent identity

OIDC login → short-lived SSH certificates

A native macOS menu-bar agent: it logs you in through an OIDC provider and issues short-lived SSH certificates, so no long-lived private key sits on the laptop.

CI BSD-3-Clause

oci-pxe boot

Network boot for the same OCI images.

Placeholder — the repository exists but holds no code yet.

BSD-3-Clause

nano-container-linux boot

The distribution itself.

Placeholder — the repository exists but holds no code yet.

BSD-3-Clause

Some repositories here are placeholders and are marked as such below. It is more useful to say which ones than to present an org of equal-looking cards.