Less, by design
Single Purpose OS
A computer with nothing else to do.
One device. One job. Only the software it needs. NoWayOS brings deliberate simplicity to dedicated devices, built on the seL4 microkernel, in Rust.
In development · QEMU + Raspberry Pi 5 · Intended to be open source
01 / The one-job principle
What we mean
Purpose is built in. Everything else is left out.
A Single Purpose OS is built for one device's one job, rather than built to run anything and then locked down to one thing. Three things make it one.
Built for one job
The device image holds its application, the drivers that application uses and the kernel. Nothing another job might need is there: no browser, desktop, shell, package manager or user account.
Sealed inside
Each part (the screen, the input, the network, the application) runs in a compartment of its own and reaches only what it was granted. A fault in one part is designed to stay there.
Shows its working
It comes with the evidence of what is inside and what each part may do: every grant written down, every component listed, and checks anyone can run.
Not kiosk mode, which locks a general-purpose system to one app and leaves everything else in place. Not a single-user OS, which limits who uses a computer, not what is in it.
What isn't there
Less software. By design.
A dedicated device deserves software built around its job. NoWayOS starts with the application, adds the parts it needs, and leaves the rest out. Here is how that differs from a typical general-purpose system locked to one application.
| A typical locked-down device | A NoWayOS device | |
|---|---|---|
| Web browser and JavaScript engine | Included | Not built in |
| Desktop and window system | Included | Not built in |
| Shell and command line | Included | Not built in |
| Package manager | Included | Not built in |
| User accounts and logins | Included | Not built in |
| Background services | Included | Not built in |
| Settings to lock it all down | Included | Not built in |
| Kernel | General-purpose: tens of millions of lines | seL4: about 10,000 lines |
| Drivers | For hardware it might meet | Only for the hardware it uses |
| Your application | Included | Included |
Why it matters
One job. And that's enough.
A computer that does one thing can be built very differently from one that might do anything. Here is what that buys.
More secure
Less to attack, and what remains is sealed in compartments.
- What is not in the image cannot be used against it: no browser engine, window system, shell, package manager or user account.
- The screen, the input, the network and your application each run in a protection domain of their own on seL4. A part reaches only what its system description grants it, so a bug in one part is designed to stay there.
- Rust throughout. Unsafe code is allowed only in a handful of reviewed crates, a list CI enforces.
More efficient
Nothing idle, nothing in the way.
- No background services and no updater for software you never use: the device starts into its one job.
- Memory is fixed at build time. Device code allocates nothing; every buffer and queue has a set size.
- A light, native user interface that repaints only what changed, on low-cost hardware such as the Raspberry Pi 5.
Easier to work with
One language, one container, emulator first.
- Rust from the drivers to the user interface.
- The toolchains, the Microkit SDK and QEMU are pinned in one dev container. Your machine needs only Podman and make.
- Design screens in React and convert them at build time with the Screen Compiler, or build them in Rust.
Easier to prove
Every grant written down, every image itemised.
- Each system lists every capability it grants in a file the build checks.
- Every image comes with a software bill of materials and a record of its seL4 configuration.
- Bounded proofs of every message decoder, fuzzing, and licence and advisory checks run in CI, with the commands to run them yourself.
When everything depends on it, give it one job.
Some devices have work too important to share with distractions. NoWayOS is designed around the role each device needs to perform, with the evidence to help you understand what is inside.
Proof, not adjectives
It minds its own business. You can check.
A security claim is only as good as the evidence behind it. NoWayOS writes the evidence down, and every piece of it comes from a command you can run.
Every grant written down
Each system's grants file lists every priority, memory region, device, interrupt and channel it grants. The build fails if the system and the list disagree.
Isolation tested to fail
Isolation tests reach for what they were not given, and seL4 must stop them. A variant with a grant widened on purpose must fail, which shows the test can.
Every image itemised
A CycloneDX software bill of materials for every image: the kernel, the loader, each protection domain and the crates in it, each with its hash.
No borrowed credibility
seL4's proofs cover specific configurations. Every image records the one it uses, and today's images say plainly that they are outside the completed proofs.
In the open
Three projects. One job each.
NoWayOS is developed under the NoWayOS organisation on GitHub. The projects are intended to be open source, and their publication is being prepared.
NoWayOS
The Single Purpose OS.
Protection-domain patterns on seL4 and Microkit, typed messages, drivers, networking and a native user interface, with the dev container and the checks that every NoWayOS repository builds with.
- Status
- In development
- Licence
- MIT OR Apache-2.0 (intended)
Screen Compiler
Design in React. Ship native Rust. No browser on the device.
Converts React screens, written in TSX to a declared subset, into Rust for NoWayOS's user interface. It runs at build time, on your machine or in CI, and never ships.
- Status
- In development: subset v0 and the first parts of v1
- Licence
- MIT
Showcase
Secure kiosks you can run on a Raspberry Pi.
A kit for secure form kiosks, a reference kiosk to build on, and a launcher of example kiosks under fictional brands that the Raspberry Pi 5 boots into.
- Status
- Early, and not deployable
- Licence
- MIT OR Apache-2.0 (intended)
Where it stands
In development, and honest about it.
NoWayOS is not ready for production. Every API is provisional and will change.
- In QEMU
- Over fifty systems boot and check their own output, from a first protection domain to the network stack taking a DHCP lease, the supervisor's fail-safe state and a clickable user interface.
- On the Raspberry Pi 5
- The user interface on an HDMI screen, a USB keyboard and mouse, timers, the watchdog and the supervisor's reset all run on the board. More of its hardware is being brought up.
- Still to come
- Secure boot, signed updates applied on the device, and industrial hardware (NXP i.MX8).
- seL4's proofs
- Every system runs on seL4, but no NoWayOS image yet uses a configuration that seL4's completed proofs cover. Each image records the one it uses.
Follow the work
One purpose. Plenty to explore.
Start with the design, inspect the evidence, or explore the developer guides. NoWayOS is in development; the repositories are being prepared for publication.