# devomb/kryptikos architecture

> Architecture diagram of the GitHub repository devomb/kryptikos, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/devomb/kryptikos
- Repository: https://github.com/devomb/kryptikos
- Video tour (about a minute): https://gitdiagram.com/devomb/kryptikos/video

## Overview

Kryptik is a hardened Linux distribution whose core runtime places applications in named security zones. The principal desktop path is a user launch request through `kryptik-launch` to privileged `kryptikd`, which loads zone policy, prepares isolation and storage, and starts the requested program; Wayland traffic is filtered separately by a per-zone proxy. Other documented capabilities include consent-gated file transfer, clipboard movement, Wi-Fi and update mediation, and zone identity. The tree and excerpts support the daemon, compositor, launcher, EFI helper, and update-fetch components shown; broader image and installer internals are not represented here.

Main entry points: [`compartments/kryptikd/src/main.rs`](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/main.rs) (Zone daemon), [`compositor/wlproxy/src/session.rs`](https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/session.rs) (Protocol session), [`tools/desktop/kryptik-launch.c`](https://github.com/devomb/kryptikos/blob/main/tools/desktop/kryptik-launch.c) (Desktop launcher), [`compartments/kryptikd/src/broker.rs`](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/broker.rs) (Transfer broker)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_zone_runtime["Zone runtime"]
  node_daemon["Zone daemon<br/>[main.rs]"]
  node_policy["Zone policy<br/>[policy.rs]"]
  node_registry["Zone registry<br/>[registry.rs]"]
  node_rootfs["Zone filesystem<br/>[rootfs.rs]"]
  node_files["Zone files<br/>[files.rs]"]
  node_cgroup["Resource limits<br/>[cgroup.rs]"]
  node_caps["Capabilities<br/>[caps.rs]"]
  node_landlock["Filesystem rules<br/>[landlock.rs]"]
  node_seccomp["Syscall filter<br/>[seccomp.rs]"]
  node_isolate["Namespace setup<br/>[isolate.rs]"]
  node_spawn["Zone process<br/>[spawn.rs]"]
  node_volume[("Encrypted volumes<br/>[volume.rs]")]
end

subgraph group_desktop["Desktop isolation"]
  node_launch["Desktop launcher<br/>[kryptik-launch.c]"]
  node_wlproxy["Wayland proxy<br/>[main.rs]"]
  node_session["Protocol session<br/>[session.rs]"]
  node_protocol["Protocol tables<br/>[protocol.rs]"]
  node_wire["Wire framing<br/>[wire.rs]"]
  node_identity["Zone color identity<br/>[identity.rs]"]
  node_palette["Color palette<br/>[palette.rs]"]
end

subgraph group_services["Zone services"]
  node_broker["Transfer broker<br/>[broker.rs]"]
  node_consent["Transfer consent<br/>[consent.rs]"]
  node_update["Update mediation<br/>[update.rs]"]
  node_fetch["Update fetcher<br/>[update-fetch.py]"]
  node_network["Network zones<br/>[netzone.rs]"]
  node_wifi["Wi-Fi control<br/>[wifi.rs]"]
end

subgraph group_boot["Boot management"]
  node_efiboot["EFI boot entries<br/>[kryptik-efiboot.c]"]
end

node_user(("User"))
node_wayland_client(("Zone application"))
node_compositor(("Wayland compositor"))
node_channel(("Update channel"))

node_user -->|"launches"| node_launch
node_launch -->|"sends request"| node_daemon
node_daemon -->|"loads policy"| node_policy
node_daemon -->|"checks zone"| node_registry
node_daemon -->|"prepares root"| node_rootfs
node_daemon -->|"sets up files"| node_files
node_daemon -->|"limits resources"| node_cgroup
node_daemon -->|"sets capabilities"| node_caps
node_daemon -->|"sets filesystem rules"| node_landlock
node_daemon -->|"installs filter"| node_seccomp
node_daemon -->|"creates namespaces"| node_isolate
node_daemon -->|"manages storage"| node_volume
node_daemon -->|"starts process"| node_spawn
node_launch -->|"starts proxy"| node_wlproxy
node_wayland_client -->|"connects"| node_wlproxy
node_wlproxy -->|"creates session"| node_session
node_session -->|"checks messages"| node_protocol
node_session -->|"frames messages"| node_wire
node_session -->|"forwards allowed traffic"| node_compositor
node_compositor -->|"returns events"| node_session
node_session -->|"forwards events"| node_wayland_client
node_daemon -->|"serves broker"| node_broker
node_broker -->|"requests approval"| node_consent
node_launch -->|"requests clipboard move"| node_broker
node_fetch -->|"fetches release data"| node_channel
node_fetch -->|"submits update data"| node_broker
node_broker -->|"dispatches update requests"| node_update
node_launch -->|"requests Wi-Fi action"| node_wifi
node_wifi -->|"controls radio zone"| node_network
node_identity -->|"uses colors"| node_palette
node_efiboot -.-> node_channel

click node_launch "https://github.com/devomb/kryptikos/blob/main/tools/desktop/kryptik-launch.c"
click node_daemon "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/main.rs"
click node_policy "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/policy.rs"
click node_registry "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/registry.rs"
click node_rootfs "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/rootfs.rs"
click node_files "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/files.rs"
click node_cgroup "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/cgroup.rs"
click node_caps "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/caps.rs"
click node_landlock "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/landlock.rs"
click node_seccomp "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/seccomp.rs"
click node_isolate "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/isolate.rs"
click node_spawn "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/spawn.rs"
click node_volume "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/volume.rs"
click node_broker "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/broker.rs"
click node_consent "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/consent.rs"
click node_update "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/update.rs"
click node_fetch "https://github.com/devomb/kryptikos/blob/main/tools/net/update-fetch.py"
click node_network "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/netzone.rs"
click node_wifi "https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/wifi.rs"
click node_wlproxy "https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/main.rs"
click node_session "https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/session.rs"
click node_protocol "https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/protocol.rs"
click node_wire "https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/wire.rs"
click node_identity "https://github.com/devomb/kryptikos/blob/main/compositor/zoneid/src/identity.rs"
click node_palette "https://github.com/devomb/kryptikos/blob/main/compositor/zoneid/src/palette.rs"
click node_efiboot "https://github.com/devomb/kryptikos/blob/main/tools/efi/kryptik-efiboot.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_daemon,node_policy,node_registry,node_rootfs,node_files,node_cgroup,node_caps,node_landlock,node_seccomp,node_isolate,node_spawn,node_volume,node_user toneBlue
class node_launch,node_wlproxy,node_session,node_protocol,node_wire,node_identity,node_palette toneAmber
class node_broker,node_consent,node_update,node_fetch,node_network,node_wifi toneMint
class node_efiboot toneRose
class node_wayland_client,node_compositor,node_channel toneIndigo
```

## Components

### Zone runtime

- [Zone daemon](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/main.rs): `compartments/kryptikd/src/main.rs`
- [Zone policy](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/policy.rs): `compartments/kryptikd/src/policy.rs`
- [Zone registry](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/registry.rs): `compartments/kryptikd/src/registry.rs`
- [Zone filesystem](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/rootfs.rs): `compartments/kryptikd/src/rootfs.rs`
- [Zone files](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/files.rs): `compartments/kryptikd/src/files.rs`
- [Resource limits](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/cgroup.rs): `compartments/kryptikd/src/cgroup.rs`
- [Capabilities](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/caps.rs): `compartments/kryptikd/src/caps.rs`
- [Filesystem rules](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/landlock.rs): `compartments/kryptikd/src/landlock.rs`
- [Syscall filter](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/seccomp.rs): `compartments/kryptikd/src/seccomp.rs`
- [Namespace setup](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/isolate.rs): `compartments/kryptikd/src/isolate.rs`
- [Zone process](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/spawn.rs): `compartments/kryptikd/src/spawn.rs`
- [Encrypted volumes](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/volume.rs): `compartments/kryptikd/src/volume.rs`

### Desktop isolation

- [Desktop launcher](https://github.com/devomb/kryptikos/blob/main/tools/desktop/kryptik-launch.c): `tools/desktop/kryptik-launch.c`
- [Wayland proxy](https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/main.rs): `compositor/wlproxy/src/main.rs`
- [Protocol session](https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/session.rs): `compositor/wlproxy/src/session.rs`
- [Protocol tables](https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/protocol.rs): `compositor/wlproxy/src/protocol.rs`
- [Wire framing](https://github.com/devomb/kryptikos/blob/main/compositor/wlproxy/src/wire.rs): `compositor/wlproxy/src/wire.rs`
- [Zone color identity](https://github.com/devomb/kryptikos/blob/main/compositor/zoneid/src/identity.rs): `compositor/zoneid/src/identity.rs`
- [Color palette](https://github.com/devomb/kryptikos/blob/main/compositor/zoneid/src/palette.rs): `compositor/zoneid/src/palette.rs`

### Zone services

- [Transfer broker](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/broker.rs): `compartments/kryptikd/src/broker.rs`
- [Transfer consent](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/consent.rs): `compartments/kryptikd/src/consent.rs`
- [Update mediation](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/update.rs): `compartments/kryptikd/src/update.rs`
- [Update fetcher](https://github.com/devomb/kryptikos/blob/main/tools/net/update-fetch.py): `tools/net/update-fetch.py`
- [Network zones](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/netzone.rs): `compartments/kryptikd/src/netzone.rs`
- [Wi-Fi control](https://github.com/devomb/kryptikos/blob/main/compartments/kryptikd/src/wifi.rs): `compartments/kryptikd/src/wifi.rs`

### Boot management

- [EFI boot entries](https://github.com/devomb/kryptikos/blob/main/tools/efi/kryptik-efiboot.c): `tools/efi/kryptik-efiboot.c`

### Other components

- **User**
- **Zone application**
- **Wayland compositor**
- **Update channel**

## Connections

- User → Desktop launcher: launches
- Desktop launcher → Zone daemon: sends request
- Zone daemon → Zone policy: loads policy
- Zone daemon → Zone registry: checks zone
- Zone daemon → Zone filesystem: prepares root
- Zone daemon → Zone files: sets up files
- Zone daemon → Resource limits: limits resources
- Zone daemon → Capabilities: sets capabilities
- Zone daemon → Filesystem rules: sets filesystem rules
- Zone daemon → Syscall filter: installs filter
- Zone daemon → Namespace setup: creates namespaces
- Zone daemon → Encrypted volumes: manages storage
- Zone daemon → Zone process: starts process
- Desktop launcher → Wayland proxy: starts proxy
- Zone application → Wayland proxy: connects
- Wayland proxy → Protocol session: creates session
- Protocol session → Protocol tables: checks messages
- Protocol session → Wire framing: frames messages
- Protocol session → Wayland compositor: forwards allowed traffic
- Wayland compositor → Protocol session: returns events
- Protocol session → Zone application: forwards events
- Zone daemon → Transfer broker: serves broker
- Transfer broker → Transfer consent: requests approval
- Desktop launcher → Transfer broker: requests clipboard move
- Update fetcher → Update channel: fetches release data
- Update fetcher → Transfer broker: submits update data
- Transfer broker → Update mediation: dispatches update requests
- Desktop launcher → Wi-Fi control: requests Wi-Fi action
- Wi-Fi control → Network zones: controls radio zone
- Zone color identity → Color palette: uses colors
- EFI boot entries → Update channel