The Developer-First Immutable OS

XORBANG revolutionizes immutable infrastructure by solving the fundamental tension between security and developer productivity. Build, experiment, deploy—without compromise.

🔒 Production Immutability

🚀 Developer Flexibility

⚡ 90% Less Complexity

Get Started Learn More

# Boot into development mode - experiment freely
kernel cmdline: xorbang.dev=1

# Your changes are safe in a transient overlay
apt install experimental-package
vim /etc/nginx/nginx.conf

# Reboot to discard changes or commit to base image
systemctl reboot  # Back to pristine state

Revolutionary Features

Graduated Immutability

Production systems run with dm-verity protected filesystems. Development mode enables controlled mutability via kernel parameter—no rebuilds required.

# Production: Fully immutable
/usr (dm-verity, read-only)
/etc (dm-verity + confext)

# Development: Transient overlay
mount -t overlay /usr/local

Composable Layers

Build features as independent systemd-sysext layers. Compose at runtime without rebuilding base images. Mix and match for different deployments.

/usr/lib/extensions/
├── gui.raw
├── development.raw
├── kubernetes.raw
└── monitoring.raw

Declarative Simplicity

Replace thousands of lines of Ansible with declarative systemd-repart definitions. Complex disk layouts become simple, reproducible configurations.

[Partition]
Type=linux-generic
Label=root
Encrypt=tpm2+pin
Format=btrfs

Atomic Updates

OSTree provides Git-like versioning for your OS. Atomic updates with automatic rollback on failure. Always boot into a known-good state.

ostree pull origin main
ostree admin deploy main
# Automatic rollback on failure

Host-Specific Config

Apply host configuration at boot time, not build time. Network settings, disk encryption keys, and hardware configs without image proliferation.

# /etc/xorbang/host-config.yaml
hostname: workstation-01
network:
  interfaces: [...]
disk:
  luks: [...]

Security by Default

Full chain of trust from Secure Boot to runtime. Cryptographic verification, IMA/EVM policies, and systemd sandboxing protect your infrastructure.

✓ Secure Boot → UKI
✓ dm-verity filesystems
✓ SELinux/AppArmor mandatory
✓ systemd sandboxing

How XORBANG Compares

Feature	XORBANG	NixOS	Fedora Silverblue	Talos Linux
Developer Workflow	✅ Native Linux	❌ Nix language	⚠️ Toolbox required	❌ No shell access
Learning Curve	✅ Minimal	❌ Steep	⚠️ Moderate	❌ Very steep
Package Testing	✅ Instant	⚠️ Rebuild	❌ Reboot	❌ Not supported
Config Complexity	✅ 50 lines	❌ 1000+ lines	⚠️ 500+ lines	⚠️ 200+ lines
Rollback	✅ Automatic	✅ Manual	✅ Manual	✅ Automatic
Host Variability	✅ Boot-time	⚠️ Build-time	⚠️ Build-time	❌ Limited
Migration Path	✅ Incremental	❌ Full rewrite	⚠️ Significant	❌ Full rewrite

Real-World Workflows

Development Workflow

Boot with dev flag xorbang.dev=1

Experiment freely apt install nginx-experimental

Test and validate systemctl start nginx

Commit or discard xorbang-commit-overlay

Production Deployment

Build new image mkosi build --profile=prod

Push to repository ostree push origin main

Stage deployment ostree admin deploy --stage

Automatic rollback # On failure, auto-rollback

Quick Start

1. Clone the Repository

git clone https://github.com/xoraxiom/xorbang.git
cd xorbang

2. Build Your First Image

# Build base image with OSTree
./build.sh --profile=workstation --output=/srv/images/

# Or use mkosi directly
mkosi --profile=workstation build

3. Deploy to Target System

# Boot target from ISO/PXE, then:
xorbang-installer --host=workstation-01

# System automatically:
# - Partitions disks with systemd-repart
# - Deploys OSTree image
# - Applies host configuration
# - Sets up boot entries

The Developer-First Immutable OS

The Immutable OS Dilemma

Traditional Immutable Systems

XORBANG's Solution