Capabilities
Features
An overview of what Saphira ships in the base system, how the distribution is assembled from source, and the hardware and virtual platforms it is built to run on.
Core
The parts you would have to explain to someone at 3am.
- musl libc
- Small, strict standard C library at the base of the system.
- OpenRC
- Dependency-based init and service management written in shell.
- APK
- Fast, atomic package management with signed indexes.
- Linux
- A plain upstream kernel, configured for virtual machines.
- GRUB
- Ordinary, inspectable boot configuration.
- x86-64-v3
- AVX2-class baseline, tuned for CPUs from roughly 2015 onwards.
Build system
The part that makes the rest defensible.
- Staged bootstrap
- Stage0 through Stage4, from cross toolchain to bootable image.
- Reproducible source inputs
- Pinned sources, no floating upstream tarballs.
- Source hashes
- Every input verified before it enters a build.
- Package manifests
- Each package declares exactly what it installs.
- Package fingerprints
- Content fingerprints for change detection and audit.
- Dependency graph
- A real graph, used for ordering and impact analysis.
- Targeted rebuilds
- Rebuild only what a change actually affects.
- Package signing
- Repository indexes and packages are signed.
- Image validation
- Images are booted and exercised before publication.
Server and development
Simple does not mean incapable.
- nginx
- Serving this website from a Saphira VM right now.
- PHP
- Running real application code, not a hello-world page.
- Node.js
- Modern JavaScript tooling has been proven to run.
- Python
- Scripting and tooling available from the repository.
- MariaDB
- Relational database workloads tested.
- OpenSSH
- Remote access with the usual expectations.
- GCC
- A native compiler on the machine, not just in the build farm.
- Command-line tooling
- The usual coreutils, networking and diagnostic set.
- Free, shell-based mail server (MailDragon): Postfix, Dovecot, Rspamd, ClamAV and custom Roundcube. No dashboard, no SaaS — free forever. MailDragon →
- AI agents
- aiDragon makes Saphira a practical workspace for coding and operations agents, MCP tools and persistent project context. MailDragon →
- VPN
- vpnDragon makes WireGuard on infrastructure you control understandable, from one client to routed IPv6 networks. MailDragon →
- Databases
- databaseDragon makes SQLite, MariaDB and PostgreSQL on infrastructure you control easier to choose, understand and operate. MailDragon →
Virtualisation
KVM/QEMU is the primary tested target. Other compatible platforms are expected to work as support is broadened.
- QEMU/KVM first
- The development and validation environment.
- VirtIO
- Disk and network use VirtIO drivers throughout.
- QCOW2 image
- Distributed as a compressed QCOW2 disk image.
- Other hypervisors
- Xen, VMware and VirtualBox where VirtIO devices are available.
Security
Fewer moving parts is itself a security property.
- TLS repository
- Package repository served over HTTPS.
- Package signing
- Signed indexes verified by apk.
- Checksums
- SHA-256 published alongside every image.
- Controlled repository
- One curated repository, built from known sources.
- Minimal service model
- Nothing runs because it happened to be installed.
- No daemon assumptions
- No background agent is required for the system to function.