Agentic OS
A USB-bootable Linux appliance where the AI agent runs as PID 1 — zero network egress by construction.
- <30 ms
- boot to agent
- ~667
- tests across the crates
- 0
- network egress paths
- 5
- Rust crates, no async runtime
The lab's flagship systems research asks a blunt question: what if the agent is the operating system? Agentic OS is a deterministic, single-purpose Linux appliance whose init process is an agent daemon. The agent gets an entire OS as its sandbox — and the OS is isolated at the VM boundary, with no network escape hatch.
Zero egress is architectural, not configured: seccomp BPF profiles (including
subagent-zero-egress), cgroup v2, namespaces, and Landlock enforce it from
PID 1 down. The only way out is VSOCK to the host, where MCP servers are
surfaced as in-guest CLI tools and the LLM itself is served over an
intelligence socket — scriptable for deterministic, replayable runs.
Five crates cover the surface: the PID-1 supervisor with its epoll reactor and five state machines; the plan-act-observe harness; the host sandbox (QEMU/Firecracker lifecycle); a kubectl-style operator CLI; and a from-scratch OS-image builder producing signed, Secure Boot-chained images that boot in under 30 ms. The same artifact runs in a VM or on an ARM single-board computer — the robot-brain use case is deliberate.
(Naming note: the PID-1 crate here predates and is distinct from the agentd.dev runtime — on this site, "Agentic OS" always means the appliance.)