System Plane (Alpine)

The native userland environment utilizing Alpine Linux for guest runtimes.

Alpine Guest Environment

The Alpine System Plane acts as a robust, highly verified root filesystem for OS.1 instances that require Linux compatibility. We utilize musl libc, openrc, and Landlock sandboxing to maintain an ultra-small attack surface suitable for embedded operations and Unikernels.

ALPINE & MUSL

The OS.1 custom rootfs built on the standard C library for static compilation and deterministic linkage.

# OS.1 Alpine Profile
kernel_opts="quiet rootfstype=squashfs ro"
apk_pkgs="musl busybox openrc eudev"

TOYBOX & CHIMERAUTILS

Replacing traditional GNU coreutils with Alpine Toybox and Chimera BSD userland tools to radically shrink the base footprint.

OPENRC & OPENDOAS

Deterministic system initialization paired with `doas` for strict privilege escalation instead of the heavier `sudo`.

# doas.conf
permit nopass keepenv root as root
permit nopass sys as root cmd /sbin/reboot

Security & Boot

  • LAND — Landlock MAC sandboxing
  • AUDIT — audit userspace
  • UEFI — TianoCore EDK II
  • BPFTRACE — eBPF tracing

Networking & Misc

  • NET — nftables firewall
  • APK — Alpine Package Keeper
  • CHRONY — NTP client
  • SEAT — seatd device mediation

Specification & Architecture

0. Alpine Linux Architecture

The Alpine system userland relies on static Musl linkage, Busybox/Toybox utilities, OpenRC init, and Landlock sandboxing:

ALPINE SPEC

ALPINE CODE POLICY

1. VirtIO & Hypervisor Handoff

When running as a System Plane image in Synrc VE OS.1, Alpine Linux boots via Limine, TianoCore EDK II (UEFI), or Linux direct boot in seL4 Protection Domains (PDs). Rootfs mounts via VirtIO-Block / SquashFS, with networking handled by VirtIO-Net and console over VirtIO-Console under Landlock isolation.