Less, by design
Single Purpose OS
A computer with nothing else to do.
No browser. No desktop. No shell. No logins. Just one job, built from only the code it needs, sealed in compartments on the seL4 microkernel and written in Rust.
Running today in QEMU and on the Raspberry Pi 5 · Open source on GitHub
01 / The one-job principle
How we got here
It began with the places that can't afford a bad day.
We didn't set out to write an operating system. We set out to protect a few very important devices, and kept finding the same problem underneath them.
- The brief
- Protect the systems a country runs on: the controls that keep power flowing and water clean, the networks a hospital depends on, the gateways that carry their data out, the terminals in the control room, and every device around them, down to the screen a stranger walks up to in a public place. Every one of them had one job. Every one ran an operating system built to do thousands.
- The catch
- A general-purpose system arrives with everything it might ever need: a browser, a desktop, a shell, logins, background services. Lock it down to one app and all of that is still there underneath, waiting for someone to find a way back to it. Every extra line is something to patch, and something to attack.
- The turn
- So we asked the opposite question: what if the device held only its one job? We started from seL4, wrote everything of ours above it in Rust, sealed each part in a compartment of its own and left out everything else. Then we wrote down the evidence, so nobody has to take our word for it.
- The surprise
- Then we looked around. The gateway in the substation, the terminal in the control room, the panel on the side of a pump, the box between two networks, the display on the station wall: nearly every dedicated device has one job. What began as armour for critical infrastructure turned out to be a better way to build all of them. We call it a Single Purpose OS.
Less to attack. Far less to patch. Nothing else to do.
What we mean
Purpose is built in. Everything else is left out.
A Single Purpose OS is built for one device's one job, rather than built to run anything and then locked down to one thing. Three things make it one.
Built for one job
The device image holds its application, the drivers that application uses and the kernel. Nothing another job might need is there: no browser, desktop, shell, package manager or user account.
Sealed inside
Each part (the screen, the input, the network, the application) runs in a compartment of its own and reaches only what it was granted. A fault in one part is designed to stay there.
Shows its working
It comes with the evidence of what is inside and what each part may do: every grant written down, every component listed, and checks anyone can run.
Not kiosk mode, which locks a general-purpose system to one app and leaves everything else in place. Not a single-user OS, which limits who uses a computer, not what is in it.
What isn't there
Less software. By design.
Most dedicated devices run a general-purpose system with one application on top, and everything else still underneath. NoWayOS starts from the job, adds only what it needs, and leaves the rest out. Here is the difference.
| A typical locked-down device | A NoWayOS device | |
|---|---|---|
| Web browser and JavaScript engine | Included | Not built in |
| Desktop and window system | Included | Not built in |
| Shell and command line | Included | Not built in |
| Package manager | Included | Not built in |
| User accounts and logins | Included | Not built in |
| Background services | Included | Not built in |
| Settings to lock it all down | Included | Not built in |
| Kernel | General-purpose: tens of millions of lines | seL4: about 10,000 lines |
| Drivers | For hardware it might meet | Only for the hardware it uses |
| Your application | Included | Included |
Screen Compiler
You love React. So do we.
Want rich, modern interfaces, built in the workflow you already know? Write your screens in React. The Screen Compiler turns them into native Rust components that run directly on NoWayOS: no browser, no JavaScript, no web page to attack.
- Keep your tools: components, props, design tokens and the editor you already use.
- Real building blocks: layouts, text, buttons, text inputs, checkboxes, radio groups, cards, notices, progress bars and icons.
- Exact or nothing. It converts its subset exactly and refuses anything else with the file, line and column. It never guesses.
- Checked to the pixel. Every converted screen is drawn by NoWayOS and compared with its approved image.
<Column gap={SPACE_SM} padding={SPACE_LG}>
<Text id="title">Welcome</Text>
<Text>Touch Start to begin.</Text>
<Button id="start" onPress={onStart}>
Start
</Button>
</Column>let n1 = b.text("Welcome")?; // welcome.tsx:17:9
let n2 = b.text("Touch Start to begin.")?;
let n5 = b.button("Start", actions::START)?;
let n0 = b.column(
ui::Layout::new()
.gap(super::tokens::SPACE_SM)
.padding(super::tokens::SPACE_LG),
&[n1, n2, n5],
)?;Shortened from one of the Screen Compiler's test screens and the Rust it generates.
Why it matters
One job. And that's enough.
Build a computer for one thing and you can build it very differently. Here is what that buys you.
More secure
No way to exploit what was never built in.
- No browser engine, no window system, no shell, no package manager, no user accounts. What isn't in the image can't be used against it.
- The screen, the input, the network and your application each live in a sealed compartment of their own, reaching only what they were granted. It is built so that a fault in one part stays in that part.
- At its heart is seL4, which the seL4 Foundation calls “the world's most highly assured and fastest operating system kernel”.
- Rust throughout. Unsafe code lives only in a handful of reviewed crates, and the build enforces the list.
More efficient
Nothing idle. Nothing in the way.
- No background services, and no updater for software you never use. Power on, and it gets straight to its one job.
- Every byte is decided at build time: each part gets a fixed amount of memory and can never take more. Most device code allocates nothing at all, and even the TLS client gets a fixed budget: if it is ever spent, it stops cleanly rather than grow.
- A crisp, native interface that repaints only what changed, at home on low-cost hardware like the Raspberry Pi 5.
Easier to work with
One language. One container. Emulator first.
- Rust from the drivers to the user interface.
- Design screens in React. The Screen Compiler turns them into native Rust at build time: a modern interface with no browser engine and no JavaScript on the device. Or write them in Rust.
- The toolchains, the seL4 Microkit SDK and QEMU come pinned in one dev container. Your machine needs only Podman and make, and Python to drive a Raspberry Pi.
Easier to prove
Every grant written down. Every image itemised.
- Every capability a system grants is listed in a file, and the build fails if the two disagree.
- Every image ships with a software bill of materials and a record of its seL4 configuration.
- Bounded proofs that every message decoder never panics, overflows or reads out of bounds, plus fuzzing and licence and advisory checks: each one a command you can run yourself.
When everything depends on it, give it one job.
Some devices have work too important to share with distractions: the controls of a power network, the gateway out of a water works, the terminal in a control room, the boundary between two networks. NoWayOS is designed around the role each device needs to perform, with the evidence to help you understand what is inside.
Proof, not adjectives
It minds its own business. You can check.
A security claim is only as good as the evidence behind it. NoWayOS writes the evidence down, and every piece of it comes from a command you can run.
Every grant written down
Each system's grants file lists every priority, memory region, device, interrupt and channel it grants. The build fails if the system and the list disagree.
Isolation tested to fail
Isolation tests reach for what they were not given, and seL4 must stop them. A variant with a grant widened on purpose must fail, which shows the test can.
Every image itemised
A CycloneDX software bill of materials for every image: the kernel, the loader, each protection domain and the crates in it, each with its hash.
Gates kept out of reach
The checks every contribution must pass live in Defence Agent, a public repository of their own, and a pull request that touches a gate is flagged for the maintainer.
In the open
Four projects. One job each.
All four are open source, developed in the open under the NoWayOS organisation on GitHub. Clone them, build them and check every line for yourself.
NoWayOS
The Single Purpose OS.
Protection-domain patterns on seL4 and Microkit, typed messages, drivers, networking and a native user interface, with the dev container and the checks that every NoWayOS repository builds with.
- Status
- In development
- Licence
- MIT OR Apache-2.0
Screen Compiler
Design in React. Ship native Rust. No browser on the device.
Converts React screens, written in TSX to a declared subset, into Rust for NoWayOS's user interface. It runs at build time, on your machine or in CI, and never ships.
- Status
- In development: subset v0 and the first parts of v1
- Licence
- MIT
Showcase
Secure applications you can run on a Raspberry Pi.
A kit for secure self-service screens, a reference application to build on, and a launcher of examples under fictional brands that the Raspberry Pi 5 boots into.
- Status
- Early, and not deployable
- Licence
- MIT OR Apache-2.0
Defence Agent
The gates every contribution must pass, out of reach of the pull request.
Every security gate a change to NoWayOS's open projects must pass, written down with the threat it answers and who may change it, and the agent that runs them. A pull request never changes or supplies what judges it.
- Status
- Public: the gates written down; the agent and its tools come next
- Licence
- MIT OR Apache-2.0
Commercial partners
Commercial products, built on NoWayOS.
Adappt.ai, NoWayOS's sponsor, is its first commercial partner. It is building two commercial products on NoWayOS, and both are in development.
Interested in becoming a commercial partner? Email partners@nowayos.com
- Remote Desktop
- A toughened view. A secure station for a remote Windows desktop, designed to seal the connection in a compartment of its own and keep the credentials out of its reach.
- Data Diode
- There is no way back. A one-way boundary for getting data out of a protected network, designed around a link that carries light in one direction only.
Where it stands
Running today. Not finished yet.
NoWayOS is in development and not yet ready for production, and its APIs will change. Here is what runs today, and what comes next.
- In QEMU
- Over fifty systems boot and check their own output, from a first protection domain to the network stack taking a DHCP lease, the supervisor's fail-safe state and a clickable user interface.
- On the Raspberry Pi 5
- The user interface on an HDMI screen, a USB keyboard and mouse, timers, the watchdog and the supervisor's reset all run on the board. More of its hardware is being brought up.
- Still to come
- Secure boot, signed updates applied on the device, and industrial hardware (NXP i.MX8).
- seL4's proofs
- Every system runs on seL4, but no NoWayOS image yet uses a configuration that seL4's completed proofs cover. Each image records the one it uses.
Follow the work
One purpose. Plenty to explore.
Start with the design, inspect the evidence, or build your first system with the developer guides. This site keeps to the same rule, by the way: no scripts, no cookies, nothing else to do.