How devomb/kryptikos works
Kryptik is a hardened Linux distribution whose core runtime places applications in named security zones. The principal desktop path is a user launch request through kryptik-launch to privileged kryptikd, which loads zone policy, prepares isolation and storage, and starts the requested program; Wayland traffic is filtered separately by a per-zone proxy. Other documented capabilities include consent-gated file transfer, clipboard movement, Wi-Fi and update mediation, and zone identity. The tree and excerpts support the daemon, compositor, launcher, EFI helper, and update-fetch components shown; broader image and installer internals are not represented here.
Main entry points: main.rs Zone daemon · session.rs Protocol session · kryptik-launch.c Desktop launcher · broker.rs Transfer broker
Components 30
Zone runtime
- Zone daemon
compartments/kryptikd/src/main.rs - Zone policy
compartments/kryptikd/src/policy.rs - Zone registry
compartments/kryptikd/src/registry.rs - Zone filesystem
compartments/kryptikd/src/rootfs.rs - Zone files
compartments/kryptikd/src/files.rs - Resource limits
compartments/kryptikd/src/cgroup.rs - Capabilities
compartments/kryptikd/src/caps.rs - Filesystem rules
compartments/kryptikd/src/landlock.rs - Syscall filter
compartments/kryptikd/src/seccomp.rs - Namespace setup
compartments/kryptikd/src/isolate.rs - Zone process
compartments/kryptikd/src/spawn.rs - Encrypted volumes
compartments/kryptikd/src/volume.rs
Desktop isolation
- Desktop launcher
tools/desktop/kryptik-launch.c - Wayland proxy
compositor/wlproxy/src/main.rs - Protocol session
compositor/wlproxy/src/session.rs - Protocol tables
compositor/wlproxy/src/protocol.rs - Wire framing
compositor/wlproxy/src/wire.rs - Zone color identity
compositor/zoneid/src/identity.rs - Color palette
compositor/zoneid/src/palette.rs
Zone services
- Transfer broker
compartments/kryptikd/src/broker.rs - Transfer consent
compartments/kryptikd/src/consent.rs - Update mediation
compartments/kryptikd/src/update.rs - Update fetcher
tools/net/update-fetch.py - Network zones
compartments/kryptikd/src/netzone.rs - Wi-Fi control
compartments/kryptikd/src/wifi.rs
Boot management
- EFI boot entries
tools/efi/kryptik-efiboot.c
Other components
- User
- Zone application
- Wayland compositor
- Update channel
Connections 31
- User → Desktop launcher: launches
- Desktop launcher → Zone daemon: sends request
- Zone daemon → Zone policy: loads policy
- Zone daemon → Zone registry: checks zone
- Zone daemon → Zone filesystem: prepares root
- Zone daemon → Zone files: sets up files
- Zone daemon → Resource limits: limits resources
- Zone daemon → Capabilities: sets capabilities
- Zone daemon → Filesystem rules: sets filesystem rules
- Zone daemon → Syscall filter: installs filter
- Zone daemon → Namespace setup: creates namespaces
- Zone daemon → Encrypted volumes: manages storage
- Zone daemon → Zone process: starts process
- Desktop launcher → Wayland proxy: starts proxy
- Zone application → Wayland proxy: connects
- Wayland proxy → Protocol session: creates session
- Protocol session → Protocol tables: checks messages
- Protocol session → Wire framing: frames messages
- Protocol session → Wayland compositor: forwards allowed traffic
- Wayland compositor → Protocol session: returns events
- Protocol session → Zone application: forwards events
- Zone daemon → Transfer broker: serves broker
- Transfer broker → Transfer consent: requests approval
- Desktop launcher → Transfer broker: requests clipboard move
- Update fetcher → Update channel: fetches release data
- Update fetcher → Transfer broker: submits update data
- Transfer broker → Update mediation: dispatches update requests
- Desktop launcher → Wi-Fi control: requests Wi-Fi action
- Wi-Fi control → Network zones: controls radio zone
- Zone color identity → Color palette: uses colors
- EFI boot entries → Update channel