Container Foundation Platform
The immutable edge operating system at the heart of the Container Foundation Platform. A single signed file that boots in seconds, runs from RAM, and runs every workload as a container, with nothing to patch in place and nothing to drift. Its Cloud Platform manages every device from the first boot.
nova8OS is the first operating system that doesn't start with a screen. Traditional operating systems assume a human at the keyboard. nova8OS begins life from a fleet manager: provisioned from a cloud platform, onboarded through mobile devices, and operated at scale from day one. Fleet management isn't an add-on. It's the architecture.
Typical results; actual times depend on hardware.How we compare
One File. Full OS.
nova8OS packages the kernel, root filesystem, boot parameters, splash, and signature into a single Unified Kernel Image built for disconnected edge deployments.
Typical results; actual times depend on hardware. How nova8OS compares with a traditional Linux host on the same measures.
Power-loss recovery and mission startup happen in seconds, not minutes.
Smaller images reduce flash pressure and speed up staged rollouts.
More memory is left for inference, control, and sensor-processing workloads.
Maintenance windows are measured in seconds, with automatic rollback if an update fails.
Why boot is faster
Boot: power-on to container runtime ready. Update: apply to back in service. Footprint: base image. Idle RAM: before workloads start. Fewer boot stages keep the host focused on one job.
Traditional Linux ships with shells, services, and package state that create attack surface before the device even starts work. nova8OS removes entire threat classes by design.
Production images remove interactive shell access, eliminating command injection and shell-escape attack paths at the host layer.
Applications deploy as OCI containers, so the host never needs apt, yum, or rpm-ostree. That eliminates live package installation paths and the supply-chain exposure that comes with them.
The host carries only the minimum binary set required to boot, verify, and run workloads instead of shipping hundreds of general-purpose utilities.
The running OS lives in memory, not on a mutable disk-backed root filesystem, making persistent tampering materially harder in the field.
Unattended deployments can exclude unnecessary input paths so physical-access attacks have fewer footholds to begin with.
Every nova8OS edition subscription covers the operating system, fleet operations, and support. There is no separate fleet manager or support contract to add.
The nova8-hosted Cloud Platform for onboarding, updates, telemetry, and remote operations is part of every edition. There is no separate fleet manager to license or integrate.
Every edition subscription includes support. No separate support contract is needed to keep a fleet manageable.
Updates replace one signed image atomically, with boot fallback. There is no package dependency graph to repair and no root filesystem drift to untangle.
Every edition starts from the same immutable, RAM-resident foundation with post-quantum signed updates and hardware-bound encrypted storage.
What a device needs to run nova8OS. Running an orchestrator or heavier workloads? Add their requirements on top.
64-bit x86_64, ARM64, or RISC-V, one core or more
1 GB minimum, 2 GB recommended
1 GB minimum
Covers the boot image, update and recovery slots, and the persistent data partition, leaving about 500 MB for container images and data. Size up for larger images.
UEFI with Secure Boot recommended; other firmware supported
Legacy BIOS boots but is deprecated, because it gives up Secure Boot and measured boot.
TPM 2.0 optional
Without a TPM, device identity binds to the hardware ID.
Ethernet, Wi-Fi, cellular (4G, 5G, LTE), or satellite
Any one uplink is enough, and devices keep running when it drops.
Running Kubernetes, Nomad, or Swarm on the device? Start from the recommended 2 GB of memory, then size for the orchestrator and your workloads.
At a glance
nova8OS is not another Linux distribution adapted for edge. It is a different operating model built around signed images, RAM-only runtime, and container delivery.
No disk-backed root filesystem. nova8OS lives entirely in memory from a single Unified Kernel Image, making it immutable by construction rather than by configuration.
Kernel, root filesystem, command line, boot splash, and signature travel together, so system integrity is tied to one cryptographic object instead of a pile of moving parts.
Applications run as OCI containers through Podman. You install packages inside container images using standard tools, then ship the containers to the device. Applications, virtual machines, and even firmware updates all deploy as OCI containers. One format, one pipeline, no host-level package manager.
nova8OS is container-native. You build applications the traditional way, package them as OCI containers, and ship them to devices. Applications, virtual machines, and firmware updates all use the same delivery pipeline.
Install your packages, dependencies, and runtimes inside a container image using Dockerfiles and standard tooling. Build the way you already know.
OCI containers are the universal packaging unit. Applications, microservices, virtual machines, and even firmware updates all ship as containers through the same pipeline.
Podman executes workloads with zero-trust isolation. The immutable host never changes. No SSH, no package manager, no mutable root.
Think of a firewall appliance. You never touch the OS directly. You push workloads and updates through the control plane, and the device just runs.
A container operating system doesn't mean giving up your orchestrator. nova8OS doesn't bundle one: you choose, and it runs as containers on the immutable host. Cluster state and workload data live on the persistent data partition, so they survive reboots and OS updates.
Kubernetes
Upstream Kubernetes with kubeadm, Cluster API (CAPI), and KubeSolo for single-node edge devices.
K3s in testingNomad
HashiCorp Nomad scheduling containers across your nova8OS hosts.
Docker Swarm
Swarm mode for teams that already deploy with Compose and stack files.
Plain containers
Podman is built in. Run containers directly when a device doesn't need an orchestrator.
The OS and your orchestrator upgrade on their own schedules: an atomic OS update or rollback never rewrites your cluster.
Prefer a management UI? Run a container management tool on top, Portainer for example.
Some workloads need a full guest operating system: a legacy Windows controller, a DOS program that runs a machine, an Android kiosk. nova8OS runs those virtual machines as ordinary OCI containers, next to native containers on the same host.
Native container
VM container
Each VM container carries everything the virtual machine needs to run. The standard container controls, start, stop, and restart, drive the virtual machine directly, so a VM behaves like any other workload on the host.
Choose per workload: a native container for the lowest overhead, or a VM container when you need a full guest operating system or stronger isolation.
Guest operating systems
Guest operating system licenses are provided by the customer.
P2V2C moves a workload off aging hardware without rewriting it. The machine becomes a virtual disk, the virtual disk becomes a container, and the container runs on nova8OS like any other.
01Physical
Capture the machine
Image the physical machine's disk into a virtual disk.
02Virtual
Keep it whole
The virtual disk carries the original operating system, applications, and configuration, unchanged.
03Container
Package it
The virtual disk is packaged into an OCI-compliant container with everything it needs to run.
04Run
Deploy it like anything else
Ship it to nova8OS hosts through the same pipeline as every other container, and run it next to native workloads.
One pane of glass for VMs and containers
Because a VM is just another container, it shows up in Portainer next to your native containers, with the same start, stop, restart, and logs controls. nova8OS makes that possible without a separate hypervisor manager.
Coming soonA fleet-wide view of VMs and containers in the nova8OS Cloud Platform.
The trusted stack is intentionally small: verify the image, stand up a RAM-only host, and hand the rest to workload isolation.
05OCI Application Containers
Applications, services, and VMs, all delivered as OCI containers.
04Podman Runtime + Zero-Trust Isolation
Every workload runs isolated from the host and from every other workload.
03RAM-Only Root and Hardened Kernel
The OS runs from memory with no shell or package manager, and resets to a known-good state on every boot.
02Unified Kernel Image + PQC Verification
Kernel, root filesystem, and boot settings in one signed file, verified with post-quantum signatures before it runs.
01Hardware + TPM2 / HWID Fallback
Hardware root of trust: identity anchored in TPM 2.0 where available, with hardware-ID binding as the fallback.
The platform is tuned for minimal host overhead, predictable recovery behavior, and a workload model that keeps the host from turning back into a general-purpose Linux image.
The trusted runtime lives entirely in memory from a single image, reducing mutable state and shrinking the disk tampering surface.
Kernel, root filesystem, command line, splash, and signature ship as one signed artifact that is copied, verified, and updated as one unit.
Applications, virtual machines, and firmware updates all ship as OCI containers through Podman. Build with standard tools inside container images, then push to devices through the Cloud Platform. One delivery format for everything.
ML-KEM and ML-DSA are built into the security posture today so the edge fleet is not anchored to legacy RSA and ECDSA assumptions.
The platform targets x86_64, ARM64, and RISC-V fleets without forcing separate operating models for each hardware class.
Updates land as signed image replacements with automatic fallback in seconds, without relying on package churn or classic A/B partition drift.
nova8OS versus the operating-system categories commonly deployed at the edge today.
| Capability | nova8OS | Traditional Linux | Container OS | IoT Platforms |
|---|---|---|---|---|
| Boot Time | 1-5s | 30-90s | 45-120s | 30-120s |
| Update Time | <40s | 10-50 min | 2-11 min | 5-15 min |
| Update Mechanism | Atomic Multi-UKI | Package-based | A/B partition | A/B partition |
| Autonomous Recovery | Auto fallback in seconds | Manual intervention | A/B swap, slow | Varies, slow |
| Config Recovery | Auto rollback | Manual fix | Manual fix | Manual fix |
| OS Footprint | 75-400MB | 2.5-4GB | 350MB-1.5GB | 700MB-2GB |
| RAM Usage (idle) | 150-300MB | 500-700MB | 450-950MB | 300-1500MB |
| Immutable Root | RAM-only | Mutable disk | Disk-backed | Disk-backed |
| Post-Quantum Crypto | Built in | No | No | No |
| Package Manager | OCI Containers | apt / yum / dnf | rpm-ostree | None |
| Cloud Required | Fully offline | No | No | Often required |
| VM Workloads | As OCI containers | Traditional | No | Some |
| TPM & Disk Encryption | TPM2 + HWID fallback | TPM2 only | TPM2 only | TPM2 only |
| Battery Optimization | Advanced adaptive | Static governors | Static governors | None |
| Architecture | x86_64, ARM64, RISC-V | x86_64, ARM64 | x86_64, ARM64 | x86_64, ARM |
| Hardware-Optimized Binaries | Auto-detected per device | Generic binaries | Generic binaries | Generic binaries |
nova8OS is the only edge operating system in this comparison set shipping post-quantum cryptography today.
Quantum-resistant key establishment aligned with the NIST transition path for long-lived edge deployments.
Post-quantum signatures protect image provenance and device trust flows before adversaries can target legacy certificate assumptions.
Built around the federal algorithm transition path rather than treating post-quantum readiness as a future product idea.
Positioned for National Security Agency cryptographic transition requirements that edge operators cannot afford to postpone.
Post-quantum algorithms ship in the platform now, not on a roadmap, while the edge operating systems in our comparison still rely on RSA and ECDSA.
nova8OS is not only smaller than conventional stacks. It is explicitly tuned for boot speed, runtime efficiency, and device-specific performance.
Boot speed, CPU scheduling, memory management, and interrupt handling tuned over years of systems engineering work.
Runtime efficiency and faster boot-to-ready behavior without carrying the default cost of a general-purpose init stack.
CPU-specific builds with glibc-hwcaps auto-dispatch so hardware gets binaries tuned for the exact device profile.
Indirect Branch Tracking and Shadow Stack support strengthen protection against ROP and JOP style exploitation paths.
nova8OS detects available hardware at boot and chooses the right setup path. One image can support display-first, headless, wired, and fully disconnected deployments.
Devices with a display can launch an on-screen Wi-Fi wizard so the operator can select a network and enter credentials directly on the device.
Headless devices can create a short-lived `nova8OS-XXXX` hotspot so a phone or laptop can push Wi-Fi credentials at `10.8.8.8`.
BLE GATT provisioning lets operators scan for nearby `nova8OS-` devices and deliver wireless credentials without adding a monitor or keyboard.
For industrial or embedded hardware, the claim code can print to `ttyS0` so setup can continue from a serial terminal.
Wired devices can skip interactive bootstrap entirely, acquire DHCP immediately, and move straight to registration.
Offline deployments can preload the OS image, license, and full configuration bundle onto removable media with no cloud dependency at any stage.
The device generates a short code shown on screen, in the BLE name, or in the Wi-Fi SSID, and the operator binds it to the correct tenant in the portal.
Installer media can be stamped with tenant context so devices appear automatically in the Cloud Platform waiting room for one-click approval.
Preloaded installer media can carry the OS, license key, and full device configuration for classified or air-gapped environments that never touch the cloud.
For deeply headless industrial systems, the claim code can still be delivered over `ttyS0` without a display, Wi-Fi, or Bluetooth.
Purpose-built for environments where traditional operating systems fail under power loss, contested networks, constrained hardware, or fleet-scale operational pressure.
For drones, unmanned systems, and field-deployed infrastructure that must recover instantly, operate in contested RF conditions, and meet CNSA 2.0 expectations.
For factory gateways, sensor aggregators, and automation controllers running in harsh environments on constrained hardware budgets.
For point-of-sale, signage, and self-service systems that need to boot instantly, resist tampering, and update at fleet scale.
For robotics, UAVs, and autonomous vehicles that need instant recovery after power loss and more of the device budget reserved for mission compute.
nova8OS is intended for mixed fleets ranging from low-power AI nodes to ruggedized field hardware.
NVIDIA Jetson, NXP i.MX, Raspberry Pi Compute Modules, and custom ARM64 or RISC-V boards for constrained inference and sensing workloads.
Intel NUCs, Dell Edge Gateways, Advantech IPCs, and standard x86_64 industrial systems that need a smaller and faster host baseline.
SWaP-sensitive military and mobile hardware that needs faster recovery, smaller images, and tighter supply-chain control in the field.
Core architecture is protected by multiple U.S. patent applications covering the operating model, update mechanism, and cryptographic provisioning system.
Elimination of intermediate boot stages in a container OS architecture so the trusted runtime can stay focused on booting directly into readiness.
Automated driver and firmware detection creates smaller, hardware-aware images instead of shipping one oversized generic root.
Atomic UKI replacement keeps release motion centered on one signed object with automatic rollback behavior.
Embedded certificates and automated trust establishment reduce operator friction for headless or remote deployments.
ML-DSA attestation and hybrid key establishment protect the provenance chain that signs and delivers the platform.
Automatic fallback is delivered without classic A/B partitions, reducing boot complexity while preserving safe recovery behavior.
Unnecessary drivers and attack surface are removed at build time rather than left in the image and merely disabled later.
Hardware binding and anti-cloning detection tie license activation to the device identity instead of assuming the image alone is enough.
Edge Transformation
A single-file immutable operating system starting at 75MB that boots in 1-5 seconds. Container-native, post-quantum secure, multi-architecture, and purpose-built for the operational and tactical edge.