Projects sharing features with SeL4

Spin is a WebAssembly serverless framework and development toolchain for building and running portable microservices. It functions as an event-driven orchestrator and runtime that executes WebAssembly components, allowing developers to map HTTP requests, Redis messages, and cron schedules to specific modules. The project distinguishes itself by implementing a Wasm-based AI inference gateway, enabling components to perform model inference and generate text embeddings. It utilizes the WebAssembly Component Model and WASI for language-agnostic composition and portable host interfacing, while emp

Tock is a secure embedded operating system and microcontroller kernel designed to isolate untrusted applications and drivers. It functions as a memory-safe process isolator that uses a combination of hardware memory protection and language-level type safety to execute mutually distrustful applications on bare metal. The system distinguishes itself through a hardware abstraction layer that decouples high-level components from specific microcontroller implementations using standardized traits. It further employs a virtualization layer to allow multiple independent software components to share a

Capnweb is a distributed object communication library and Cap'n Proto RPC framework. It enables type-safe remote procedure calls between clients and servers using shared schemas and generated stubs to invoke methods on remote objects as if they were local. The project utilizes an object-capability security model to govern access to remote resources through unforgeable tokens. It provides a bidirectional network layer that multiplexes asynchronous calls and data streams over persistent WebSocket connections and includes a remote resource lifecycle manager that uses reference counting to automa

U-Boot is an embedded bootloader that initializes hardware components and loads operating system kernels into memory. It functions as a hardware abstraction layer providing standardized access to networking, storage, and peripheral buses, while also serving as a secure boot loader and a firmware update interface. The project distinguishes itself through the implementation of secure boot sequences that verify cryptographic signatures and interface with TPM modules to establish hardware-rooted trust. It further provides specialized capabilities for updating device firmware via standardized prot

Sui is a blockchain platform featuring an object-centric state model and resource-oriented smart contracts. It utilizes parallel transaction execution to increase network throughput and supports programmable transaction blocks that bundle multiple operations into single atomic units. The platform distinguishes itself with a capability-based access control system and zero-knowledge login mechanisms, enabling users to authenticate via identity providers without seed phrases. It also implements deterministic object addressing to allow predictable state lookups and supports the creation of soulbo

embedded-notes is a collection of technical study guides and development notes focused on embedded Linux, Linux kernel internals, and C programming. It serves as a reference for embedded systems development and a preparation resource for technical interviews in the field. The project provides detailed documentation on writing device drivers, managing virtual memory, and understanding kernel internals. It also includes guides on IoT network protocols, such as MQTT and TCP/IP, and outlines the architectural details of chip architectures and hardware peripherals. The material covers a broad sur

Asterinas is a memory-safe operating system kernel designed to prevent data races and memory corruption. It functions as a Linux-ABI compatible kernel, enabling the execution of existing Linux binaries and container workloads while providing a declarative operating system distribution model. The project distinguishes itself by acting as a virtual machine container host and a confidential computing guest OS, allowing it to run within hardware-isolated Trusted Execution Environments such as Intel TDX. It implements a minimal trusted computing base by isolating unsafe low-level operations and se

This project is a collection of minimal operating systems, bootloaders, and hardware drivers used to demonstrate low-level x86 system programming and hardware interfacing. It serves as a kernel development toolkit and a system programming lab designed for testing architecture concepts and hardware behavior within a system emulator. The repository provides reference implementations for creating bootable disk images and loading kernel stages. It includes guides for implementing protected mode transitions, memory paging, interrupt descriptor tables, and symmetric multiprocessing on x86 hardware.

This project is an implementation of the Arduino framework for ESP32 microcontrollers, providing a core that enables firmware development using a familiar API. It functions as a microcontroller hardware abstraction layer and a firmware toolchain integration, bridging external development environments to the hardware for compilation and flashing. The system includes an embedded real-time operating system wrapper to manage multi-core execution and task scheduling, alongside a wireless communication suite for TCP/IP networking and Bluetooth Low Energy. It distinguishes itself by providing an obj

xhyve is a macOS virtual machine manager and virtualization tool that leverages the native hypervisor framework to run guest operating systems in userspace. It provides a virtualization layer for executing guest systems with hardware acceleration. The project features a hardware pass-through hypervisor that maps physical host devices directly to guest virtual machines to increase performance. It includes a remote framebuffer server and VNC access to enable interaction with the guest display and input devices from external devices. The tool covers virtual hardware emulation for storage, netwo

x11docker is an OCI container GUI orchestrator and hardware bridge designed to execute graphical applications and full desktop environments inside containers. It functions as a Linux GUI sandbox, linking containerized processes to host X11 or Wayland display servers and audio systems. The project differentiates itself by providing deep system integration for hardware acceleration, including NVIDIA driver automation and GPU passthrough. It supports cross-architecture GUI emulation and provides remote access capabilities through VNC, SSH forwarding, and browser-based HTML5 rendering. The tool

rCore is a Rust-based operating system kernel and microkernel designed for Linux compatibility. It functions as a self-hosted development kit that implements a system call interface to support the execution of standard Linux userspace applications. The system is designed for modularity, featuring a mechanism for loading and integrating kernel modules into the active environment without requiring a system reboot. The kernel provides core operating system capabilities, including virtual memory mapping for process isolation, a disk-based file system for data persistence, and a layered network p

KernelSU-Next is a kernel-level framework designed to provide administrative privileges and granular access control on the Android operating system. By integrating directly into the kernel during the build process, the project enables superuser management and system-wide modifications through kernel-level patching and system call interception. The framework distinguishes itself by utilizing non-persistent file system overlays, which allow for system partition modifications and module injection without altering underlying read-only storage blocks. This approach facilitates dynamic functionalit

This project is an educational resource for developing bare-metal operating systems and kernels from scratch on Raspberry Pi hardware. It provides a structured guide to systems programming using the Rust language, focusing on the implementation of core kernel components that execute directly on ARM-based hardware without the support of an underlying operating system or standard library. The tutorials emphasize a modular architecture that separates hardware-independent kernel logic from processor-specific and board-specific configurations. By utilizing a hardware abstraction layer and distinct

This project is a web-based educational environment designed to simulate 8-bit processor architecture and assembly language execution. It functions as a virtual machine that translates symbolic assembly code into machine instructions, allowing users to observe the fetch-decode-execute cycle and its impact on system state in real time. The simulator distinguishes itself through a reactive interface that binds visual register and memory displays directly to the underlying processor state. It incorporates a two-pass assembler that manages symbolic label resolution and memory address mapping, pro

This project is a collection of technical documentation and guides designed as a computer architecture explainer. It provides educational resources on how processors and operating systems execute programs, focusing on the fetch-execute cycle and the fundamental relationship between hardware and the kernel. The documentation covers a wide range of low-level system operations, including detailed guides on the executable and linkable binary format, virtual memory management, and kernel-level operations. It specifically explores the mechanics of CPU scheduling, preemptive multitasking, and the us

This project is a tutorial for developing a custom bare metal operating system specifically for the Raspberry Pi 4. It provides the guidance and resources necessary to write software that interacts directly with hardware without the use of a pre-existing kernel. The project centers on an ARM64 cross-compilation toolchain and a build pipeline that transforms source code into raw binary images. It utilizes linker scripts to define physical memory addresses and section placements, ensuring the resulting binary loads at the correct hardware entry point. The codebase covers direct hardware interf

TileLang is a Python-embedded domain-specific language compiler that JIT-compiles and autotunes GPU kernels. It uses a tile-based DSL, automatic software pipelining, and parallel autotuning to generate optimized GPU kernels at runtime. It supports tensor core operations with Pythonic syntax, automatic memory management, and thread mapping. The compiler searches over tile sizes, thread counts, and scheduling policies, compiling and benchmarking candidates in parallel to find the fastest kernel. It also caches compiled binaries and tuning results to disk for reuse across sessions. TileLang inc

Cloud Hypervisor is a Rust-based hypervisor and KVM virtual machine monitor designed to execute 64-bit guest operating systems. It functions as a user-space virtual machine manager that employs a minimal emulation layer to reduce memory overhead and latency for cloud workloads. The project distinguishes itself through the use of a memory-safe language to implement a virtio device emulator and a user-space device model. It provides a standardized web API for managing virtual machine lifecycles and resource configurations. The platform covers broad virtualization capabilities, including the em

Simple Virtual DOM is a lightweight library designed for modeling user interface hierarchies as declarative, nested object structures. It functions as a rendering engine and reconciliation framework, allowing developers to define interface states as virtual trees that exist independently of the live browser document. The library provides core logic for synchronizing these virtual structures with the actual document object model. By comparing two tree states, it calculates the minimal set of additions, removals, or attribute modifications required to update the interface. This approach minimiz

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

melonDS is a Nintendo DS emulator and hardware architecture emulator. It is a software application designed to simulate the original system architecture of a handheld gaming console to run original games and applications on different computing platforms. The project functions as a firmware loader capable of initializing the emulated environment using authentic BIOS and system firmware dumps. This ensures software compatibility by replicating the original system's hardware state and boot sequence. The emulator provides capabilities for retro game preservation by executing original game ROMs.

Piscina is a Node.js worker thread pool that runs CPU-intensive JavaScript functions across multiple threads for parallel execution. It manages a dynamic pool of worker threads with configurable size, handling task submission, cancellation, and lifecycle management through a promise-based interface. The pool supports AbortController-based task cancellation, enabling clean termination of submitted or running tasks without disrupting other work. It enforces per-worker memory limits through V8 resource caps and applies backpressure with a configurable maximum queue size that emits a drain event

Exegol is an offensive security platform and containerized tooling orchestrator designed to deploy and manage isolated security operations environments. It functions as a workspace manager that provisions pre-configured security images and toolkits within Docker containers to protect host systems from malicious payloads. The platform distinguishes itself by integrating AI security workflow orchestration, allowing AI assistants to discover and trigger security tools through a standardized communication protocol. It further provides remote desktop gateway capabilities, enabling GUI access via X

OrbStack is a native macOS application that replaces Docker Desktop, providing an all-in-one environment for running Docker containers, full Linux virtual machines, and local Kubernetes clusters. It runs Linux VMs directly on the macOS hypervisor framework for near-native performance, uses VirtioFS for fast bidirectional file sharing between macOS and Linux, and leverages Rosetta for near-native x86 emulation on Apple Silicon. The system assigns predictable local domain names to containers and VMs with automatic HTTPS certificate generation, forwards ports via event-driven updates, and stores

Varnish Cache is an HTTP reverse proxy and content accelerator designed to sit in front of web servers. It functions as a caching engine that stores frequently accessed web content in memory to reduce the processing load on backend origin servers and accelerate delivery times for end users. The software distinguishes itself through a domain-specific configuration language that compiles request-handling logic into machine-level bytecode for execution at wire speed. It utilizes a multi-threaded event loop to manage concurrent connections and employs shared-memory object storage alongside virtua

Mbed TLS is an open-source TLS and DTLS library with a small footprint, designed for embedded systems and IoT devices. It provides a portable cryptographic library that includes symmetric ciphers, hashing, and public-key cryptography, along with a reference implementation of the PSA Cryptography API for standardized cryptographic operations across platforms. The library also offers X.509 certificate management for parsing, validating, and managing certificate chains in secure communications. The library is built around a platform abstraction layer that decouples it from OS-specific services t