Skip to content

Open Source · Developed at Fraunhofer AISEC

Minimal and Secure OS‑level Virtualization

GyroidOS is a multi-arch OS-level virtualization solution with a strong focus on platform security based on hardware features. Built with Linux and Yocto, it isolates guest operating systems in containers on a single, hardened kernel — with a far smaller footprint than conventional container stacks.

Get Started View on GitHub

Service Container Service Container Core unprivileged Container Management Layer (CML) Hardened Linux Kernel namespaces · cgroups · capabilities Hardware TPM · Secure Boot · x86 / ARM / RISC-V

Multi-arch
x86 · ARM · RISC‑V

Hardware-backed
TPM, secure & measured boot

Minimal TCB
Small, auditable codebase

Fully open source
GPL-2.0 licensed

What is GyroidOS?

GyroidOS is a virtualization platform on the operating-system level, developed and maintained at Fraunhofer AISEC. Its virtualization layer builds on Linux kernel features — namespaces, cgroups and capabilities — to isolate complete guest operating system stacks on top of a single, shared kernel.

In contrast to general-purpose container solutions such as Docker, GyroidOS provides a much smaller footprint, strict separation of privileged components, and integrates platform-specific hardware security mechanisms directly into the virtualization layer. Even the core container, which contains administration interfaces, is already unprivileged and accesses the CML only through its control interface. Each container is strongly isolated, so applications with different trust levels can run side by side on the same device without compromising one another.

The project has been developed since the early 2010s (formerly known as trust|me) and serves as the reference implementation of the Trusted Connector in the International Data Spaces (IDS).

Typical use cases

  • Application separation — run untrusted and critical workloads in parallel with a clearly defined level of isolation.
  • IoT & edge devices — a secure, remotely manageable platform for embedded devices in the field.
  • Certifiable systems — a baseline that supports security certification processes such as Common Criteria (ISO/IEC 15408), IEC 62443 and DIN SPEC 27070.
  • Trusted data exchange — reference implementation of the IDS Trusted Connector.

Architecture

A minimal, privileged Container Management Layer controls strongly isolated guest containers — anchored in hardware security features from the very first boot stage.

  • Container Management Layer

    The heart of GyroidOS is the CML, a set of lean daemons written in C that manage the container lifecycle. Privileged functionality is kept out of guest containers, shrinking the attack surface and the trusted computing base.

  • Secure & measured boot

    A complete chain of trust — from bootloader through kernel and signed kernel modules to containers — can be verified via secure boot and recorded via measured boot with TPM-based remote attestation.

  • Encrypted storage

    Container data volumes are protected with storage encryption, with keys bound to the platform's hardware trust anchor.

  • PKI & remote management

    A project-owned PKI underpins signed guest OS images, device provisioning and flexible remote management of containers in the field.

Key Features

  • Minimal footprint

    A deliberately small software stack built with Yocto — less code, fewer vulnerabilities, easier audits.

  • Hardware-backed security

    TPM integration, secure boot, measured boot and kernel module signing are built into the platform, not bolted on.

  • Strong isolation

    Guest OS stacks are confined via namespaces, cgroups and capabilities, with a reduced syscall surface toward the shared kernel.

  • Multi-architecture

    One platform for x86, 32/64-bit ARM and RISC-V — from developer VMs in QEMU to embedded boards in production.

  • Certification support

    Designed to ease security certification: Common Criteria (ISO/IEC 15408), IEC 62443 and DIN SPEC 27070 profiles.

  • Fully open source

    The complete, portable software stack is developed in the open on GitHub under GPL-2.0, including a converter for Docker containers.

Supported Platforms

GyroidOS runs on generic hardware of all major architectures. Ready-to-follow deployment guides exist for:

Get Started in Three Steps

  • Set up your host

    Prepare your build machine with the required tools for Yocto-based builds.

    Host setup

  • Build an image

    Use the quick-build workflow to create a complete GyroidOS image for your target.

    Quick build

  • Deploy & operate

    Boot the image in QEMU or on real hardware and manage containers with the control interface.

    Deploy to QEMU

Resources

  • Documentation

    Architecture, build, deployment and operation guides.

    Read the docs

  • Source code

    All repositories — CML, build system and Yocto layers — on GitHub.

    github.com/gyroidos

  • Certification

    How GyroidOS supports Common Criteria and IEC 62443 processes.

    Certification

  • Talks & publications

    Conference talks and academic research behind the platform.

    Talks & publications

Questions, feedback or interest in collaboration?

Contact the team