Our source code is now hosted at forgejo.lain.rocks/lainOS

lainOS layer 02 is available at https://forgejo.lain.rocks/lainOS/lainOS-layer-02/releases

lainOS layer 01 with systemd is available at https://forgejo.lain.rocks/lainOS/lainOS/releases

A systemd-free Arch Linux derivative built with OpenRC as PID 1, offering full ABI compatibility for systemd-linked software via the Protocol 7 compatibility architecture.

LainOS is a community-driven Linux project led by Grayson Giles (@amnesia1337) and built by developers from the global Serial Experiments Lain community. Originally derived from the 2002 LainOS.org coding experiments, the project has evolved into a genuine init-system replacement instead merely a themed respin.

Layer 02 is our current focus: a daily-driver distribution that balances usability, privacy, and security. Security hardening is a first-class concern, not an afterthought ~ but this is not a specialized security distribution like Qubes or Whonix. It is built to be usable, with hardening that does not get in the way.

If you like what we are doing, consider donating: lainos.net/#donate

Layer 02 ships with defense in depth at every layer:

• OpenRC process isolation/containment stack ~ written in rust. covers full network stack and core services
• Protocol 7 Core fuzz tested ~ dfuzzer 2.6 full interface PASS, AddressSanitizer PASS, libFuzzer 9M+ combined executions, zero crashes
• Filesystem isolation ~ hand-rolled mount namespaces (read-only root, private /tmp, hidden /home//root, minimal /dev)
• Capability bounding set cleared ~ all five capability fields zeroed after privilege drop
• Seccomp whitelisting ~ socket() restricted to AF_UNIX only; personality()/unshare()/setns() blocked
• AppArmor MAC ~ per-daemon profiles for all external-input components, loaded at boot before daemons start
• hardened_malloc ~ GrapheneOS light variant, preloaded for sensitive applications
• RAM wipe ~ Kicksecure/Whonix-ported dracut shutdown hook + continuous init_on_alloc/init_on_free
• Kernel hardening ~ Full ASLR, ptrace restriction (yama.ptrace_scope=1), kexec disabled, unprivileged user namespaces disabled, core dumps disabled, kernel pointer restriction (kptr_restrict=2)

Verify it yourself:

doas lainos-security-status              # read-only status dashboard
doas protocol7-core-security-status      # 36-test adversarial suite

Layer 02 ships with an OpenRC-native service isolation stack that provides systemd-equivalent containment (ProtectSystem=, PrivateTmp=, capability bounding, resource limits, syscall filtering) without systemd, without compatibility layers, and without forking OpenRC.

The stack composes four kernel primitives per service, driven by declarative rc_* variables in /etc/conf.d/<service>:

Both rc-sandbox and lainos-sandbox-wrap are written in Rust and compiled to statically-linked, memory-safe binaries. No shell scripts or interpreted code exist in the isolation chain between OpenRC and the target service.

All lainOS-shipped services are sandboxed by default. A service runs unsandboxed only if explicitly opted out:

# /etc/conf.d/<service>
rc_sandbox="NO"   # Opt out of all isolation

The following core services run inside the isolation stack with per-service profiles:

Service isolation is configured entirely through variables in /etc/conf.d/<service>:

# /etc/conf.d/dnsmasq
rc_private_tmp="YES"                    # Private /tmp
rc_protect_home="YES"                   # Hide /home and /root
rc_protect_system="STRICT"              # Read-only /usr and /boot
rc_capability_bounding_set="CAP_NET_BIND_SERVICE,CAP_NET_RAW"
rc_memory_max="256M"                    # Memory limit
rc_pids_max="20"                        # Process count limit
rc_seccomp_profile="lainos-network"     # Syscall allowlist
rc_network_access="YES"                 # Host network namespace
rc_unshare_pid="YES"                    # Isolated PID namespace (foreground required)

openrc-security-status verifies every layer at runtime:

doas openrc-security-status

Example output:

=== dnsmasq ===
  process               running as PID 8606 (comm=dnsmasq)
  namespace: mount      ISOLATED (own mount ns)
  namespace: network    shared with host (rc_network_access=YES, correct)
  namespace: pid        ISOLATED (own PID namespace)
  cgroup limits         ENFORCED (memory.max=67108864 pids.max=20)
  seccomp-bpf           ACTIVE (filter mode, 1 filter(s) loaded, no_new_privs set)
  capabilities          NARROWED (CapEff=0x0000000000002400 CapBnd=0x00000000000024c3)
  AppArmor              CONFINED (/usr/bin/dnsmasq)

• Services are sandboxed by default ~ opt-out, not opt-in
• Four independent layers ~ failure of one does not compromise the others
• Landlock backstop ~ LSM-level path enforcement survives a namespace escape (systemd does not have this)
• Runtime verification ~ openrc-security-status confirms every layer is active and enforcing
• Rust implementation ~ memory-safe, statically-linked, no shell scripts in the critical path
• AppArmor complement ~ independent path-based MAC layer on top of namespace isolation

LainOS provides a localized, stateless DNS forwarding architecture built around dnsmasq. Rather than exposing upstream resolver information directly to applications, the operating system presents a single, stable resolver endpoint (127.0.0.1:53) and centralizes DNS policy within a dedicated forwarding layer.

Applications never communicate directly with upstream DNS servers. The resolver architecture remains identical regardless of operational mode; only the forwarding destination changes.

All DNS resolution follows a single deterministic path:

                +----------------------+
                |   Local Application  |
                +----------+-----------+
                           |
                           v
                    /etc/resolv.conf
                           |
                           v
                      127.0.0.1:53
                           |
                           v
                        dnsmasq
                           |
               +-----------+-----------+-----------+
               |                       |           |
               |                       |           |
         Plaintext Mode          Encrypted Mode  Private Mode
               |                       |           |
               v                       v           v
     DHCP / Manual Fallback     Local Proxy    Tor DNSPort
     (1.1.1.1, 9.9.9.9)        (127.0.0.1:5053)  (9059)
                                  |
                                  v
                               unbound
                           (127.0.0.1:5053)
                                  |
                                  v
                            dnscrypt-proxy
                           (127.0.0.1:5300)
                                  |
                    +-------------+-------------+
                    |                           |
                    v                           v
              Anonymized Relay              Resolver
              (IP hiding)              (DNSCrypt, no-log)

dnsmasq operates as a forwarding resolver rather than a caching resolver:

cache-size=0
no-negcache

This intentionally avoids retaining successful or negative DNS query history in memory. All caching, prefetching, and TTL management is delegated to unbound. If compromised, dnsmasq leaks no historical query data.

The resolver is bound exclusively to the loopback interface and is never exposed externally.

In encrypted mode, the DNS chain splits responsibilities so no single component sees both the user's IP and their plaintext query:

• dnsmasq — sees the user's IP but has no cache and no query history
• unbound — validates DNSSEC, caches, and forwards to dnscrypt-proxy; does not see the user's IP
• dnscrypt-proxy — encrypts and routes through an anonymized relay; sees neither the query nor the user's IP
• Relay — knows the user's IP but not the query
• Resolver — knows the query but not the user's IP

This is a stronger privacy model than direct DoT or DoH to a single provider, where one entity sees both.

The lainos-dns utility manages transitions between plaintext and encrypted modes, persisting the active mode to /var/lib/lainos/dns-mode.

private-mode saves the previous DNS mode before switching to Tor, and restores it on exit. This ensures a user who prefers encrypted DNS does not silently revert to plaintext after using private mode.

The entire DNS forwarding layer is confined under AppArmor:

• /usr/bin/dnsmasq — limited to loopback networking and necessary configuration paths
• /usr/bin/unbound — restricted to resolver operations and cache directories
• /usr/bin/dnscrypt-proxy — restricted to encrypted socket operations and relay lists

These profiles reduce attack surface by limiting filesystem access, network capabilities, and system calls to only what is required for DNS forwarding operations.

lainos-dns plaintext    # Plaintext fallbacks
lainos-dns encrypted    # Encrypted: unbound + dnscrypt-proxy
lainos-dns private      # Tor DNSPort, via private-mode
lainos-dns status       # Show current mode and full chain status

Mode transitions are explicit and stateful; private-mode remembers and restores your previous mode on exit.

The DNS mediation architecture provides:

• Stateless forwarding — dnsmasq has no cache and no query history
• Loopback isolation — resolver never exposed externally
• Split-controller privacy — no single component sees both IP and query
• Explicit mode transitions — user always knows which mode is active
• AppArmor confinement — all DNS daemons are AppArmor-enforced
• Application transparency — applications see only 127.0.0.1:53

BIOS/UEFI → GRUB/Syslinux → kernel + initramfs
  → Dracut: dmsquash-live mounts squashfs, execs /sbin/openrc-init
     → OpenRC sysinit: dbus, lainos-notifyd, lainos-machine-id
        → OpenRC boot: rfkill-unblock, cgroup-delegate, lainos-ghost-units, syslog-ng
           → OpenRC default: seatd, lainos-dbus-bridge, greetd, chrony, nftables, acpid, polkit
              → greetd → tuigreet → Sway session
                 → lainos-session-sway → lainos-init → Sway

Protocol 7 is the architectural foundation enabling systemd-free operation while maintaining compatibility with software expecting systemd interfaces.

Protocol 7 is not in a position to own your whole system. systemd, by contrast, is.

Real systemd-libs provide ABI compatibility — the client libraries function fine without systemd running as PID 1. eudev is a genuine, functional udev implementation. Custom C daemons handle responsibilities that systemd would otherwise own:

• Sway tiling compositor with autotiling
• i3status-rs themed status bar
• wofi application launcher
• alacritty terminal emulator (tmux by default)
• mako notification daemon
• swaylock screen locker with wallpaper background
• wlogout session/power menu
• Powerlevel10k zsh prompt
• CoplandOS-GTK dark theme with StarLabs cursor
• PipeWire audio (orchestrated by lainos-audio-init)

Keybindings:

• WiFi off by default ~ iwd does not start automatically; toggle with wifi on / wifi-autostart
• MAC randomization ~ new MAC every time iwd starts; ethernet via eth0 toggle
• DNS mediation ~ centralized via dnsmasq at 127.0.0.1:53
  • Plaintext (default) — DHCP with 1.1.1.1/9.9.9.9 fallbacks
  • Encrypted ~ dnsmasq → unbound → dnscrypt-proxy (no single component sees both IP and query)
  • Private ~ Tor DNSPort via private-mode
• Tor stream isolation ~ dedicated circuits tor1-tor4 for per-application isolation
• Optional Tor time sync ~ sdwdate (opt-in, fingerprint-resistant)
• Pluggable transports ~ snowflake/obfs4 toggles for censorship resistance
• nftables ~ default-deny firewall
• IPv6 disabled by default (prevents VPN leaks)
• Boot clock randomization ~ ±180 seconds jitter before networking

doas dd if=~/lainos-out/lainOS-layer-02-*.iso of=/dev/sdX bs=4M status=progress oflag=sync

Boot from USB, login as liveuser (no password) at tuigreet. Calamares launches automatically.

Tested on: QEMU/KVM with Virtio GPU, ThinkPad T480 (Libreboot) — baremetal confirmed, UEFI and BIOS, including LUKS FDE.

wifi on          # Enable WiFi (off by default)
wscan            # Scan and connect with numbered menu
lainos-dns encrypted   # Switch to encrypted DNS
private-mode on      # One-command sensitive-work mode

• Privilege escalation: doas (not sudo)
• Power menu: wlogout
• Lid close: auto-locks with swaylock and suspends
• Quick-start guide opens automatically on first terminal launch: lainos-quickstart-help
• Full guide: lainos-help

Build host: LainOS Layer 02 or Arch Linux with Protocol 7 repository configured

doas pacman -S archiso base-devel git
git clone https://forgejo.lain.rocks/lainOS/lainos-iso-layer-02.git
cd lainos-iso-layer-02
doas rm -rf ~/lainos-work ~/lainos-out
mkdir -p ~/lainos-work ~/lainos-out
yes "" | doas mkarchiso -v -w ~/lainos-work -o ~/lainos-out protocol7-profile 2>&1 | tee ~/lainos-build.log
lainos-hash-iso

ISO output: ~/lainos-out/lainOS-layer-02-YYYY.MM.DD-x86_64.iso

One-command utilities for daily operation:

LainOS is developed by Grayson Giles and the LainOS community.

• Forgejo: https://forgejo.lain.rocks/lainOS/
• Codeberg: https://codeberg.org/lainOS
• GitLab: https://gitlab.com/lainos
• GitHub: https://github.com/The-LainOS-Project
• Website: https://lainos.net
• Security verification: lainos-security-suite repository (see org links above)

Please include:

• ISO version/date
• Hardware/VM configuration
• rc-status output
• Relevant logs from /var/log/rc.log or dmesg

LainOS Layer 02 and the Protocol 7 compatibility layer are released under the GNU General Public License v3.0.

Individual components (Sway, OpenRC, Calamares, etc.) retain their respective licenses.

• Arch Linux ~ The foundation everything is built on
• OpenRC ~ Reliable, predictable init system
• GrapheneOS ~ hardened_malloc
• Sway/wlroots ~ Modern Wayland compositor ecosystem
• Calamares ~ User-friendly system installer
• Kicksecure/Whonix ~ sdwdate, bootclockrandomization, ram-wipe, and security-hardening model

Current package: protocol7-core-5.5.3-27
*Status: Stable
Last updated: 2026-07-29

Grayson Giles aka amnesia1337
PGP fingerprint: 456F268D14C9ECCE1A77355803E8F5B63BAC3998
Keyserver: https://keys.openpgp.org