Capabilities
Features
What Saphira ships, how it is built, and where it runs.
Core
The parts you would have to explain to someone at 3am.
- musl libc
- Small, strict standard C library at the base of the system.
- OpenRC
- Dependency-based init and service management written in shell.
- APK
- Fast, atomic package management with signed indexes.
- Linux
- A plain upstream kernel, configured for virtual machines.
- GRUB
- Ordinary, inspectable boot configuration.
- x86-64-v3
- AVX2-class baseline, tuned for CPUs from roughly 2015 onwards.
Build system
The part that makes the rest defensible.
- Staged bootstrap
- Stage0 through Stage4, from cross toolchain to bootable image.
- Reproducible source inputs
- Pinned sources, no floating upstream tarballs.
- Source hashes
- Every input verified before it enters a build.
- Package manifests
- Each package declares exactly what it installs.
- Package fingerprints
- Content fingerprints for change detection and audit.
- Dependency graph
- A real graph, used for ordering and impact analysis.
- Targeted rebuilds
- Rebuild only what a change actually affects.
- Package signing
- Repository indexes and packages are signed.
- Image validation
- Images are booted and exercised before publication.
Server and development
Simple does not mean incapable.
- nginx
- Serving this website from a Saphira VM right now.
- PHP
- Running real application code, not a hello-world page.
- Node.js
- Modern JavaScript tooling has been proven to run.
- Python
- Scripting and tooling available from the repository.
- MariaDB
- Relational database workloads tested.
- OpenSSH
- Remote access with the usual expectations.
- GCC
- A native compiler on the machine, not just in the build farm.
- Command-line tooling
- The usual coreutils, networking and diagnostic set.
Virtualisation
KVM/QEMU is the primary tested target. Other compatible platforms are expected to work as support is broadened.
- QEMU/KVM first
- The development and validation environment.
- VirtIO
- Disk and network use VirtIO drivers throughout.
- QCOW2 image
- Distributed as a compressed QCOW2 disk image.
- Other hypervisors
- Xen, VMware and VirtualBox where VirtIO devices are available.
Security
Fewer moving parts is itself a security property.
- TLS repository
- Package repository served over HTTPS.
- Package signing
- Signed indexes verified by apk.
- Checksums
- SHA-256 published alongside every image.
- Controlled repository
- One curated repository, built from known sources.
- Minimal service model
- Nothing runs because it happened to be installed.
- No daemon assumptions
- No background agent is required for the system to function.