Our source code is now hosted at forgejo.lain.rocks/lainOS

lainOS layer 02 is available at https://forgejo.lain.rocks/lainOS/lainOS-layer-02/releases

lainOS layer 01 with systemd is available at https://forgejo.lain.rocks/lainOS/lainOS/releases

A systemd-free Arch Linux derivative built with OpenRC as PID 1, offering full ABI compatibility for systemd-linked software via the Protocol 7 compatibility architecture.

LainOS is a community-driven Linux project led by Grayson Giles (@amnesia1337) and built by developers from the global Serial Experiments Lain community. Originally derived from the 2002 LainOS.org coding experiments, the project has evolved into a genuine init-system replacement instead merely a themed respin.

Layer 02 is our current focus: a daily-driver distribution that balances usability, privacy, and security. Security hardening is a first-class concern, not an afterthought ~ but this is not a specialized security distribution like Qubes or Whonix. It is built to be usable, with hardening that does not get in the way.

If you like what we are doing, consider donating: lainos.net/#donate

Layer 02 ships with defense in depth at every layer:

• Protocol 7 Core fuzz tested ~ dfuzzer 2.6 full interface PASS, AddressSanitizer PASS, libFuzzer 9M+ combined executions, zero crashes
• Filesystem isolation ~ hand-rolled mount namespaces (read-only root, private /tmp, hidden /home//root, minimal /dev)
• Capability bounding set cleared ~ all five capability fields zeroed after privilege drop
• Seccomp whitelisting ~ socket() restricted to AF_UNIX only; personality()/unshare()/setns() blocked
• AppArmor MAC ~ per-daemon profiles for all external-input components, loaded at boot before daemons start
• hardened_malloc ~ GrapheneOS light variant, preloaded for sensitive applications
• RAM wipe ~ Kicksecure/Whonix-ported dracut shutdown hook + continuous init_on_alloc/init_on_free
• Kernel hardening ~ Full ASLR, ptrace restriction (yama.ptrace_scope=1), kexec disabled, unprivileged user namespaces disabled, core dumps disabled, kernel pointer restriction (kptr_restrict=2)

Verify it yourself:

doas lainos-security-status # read-only status dashboard
doas protocol7-core-security-status # 36-test adversarial suite

BIOS/UEFI → GRUB/Syslinux → kernel + initramfs
→ Dracut: dmsquash-live mounts squashfs, execs /sbin/openrc-init
→ OpenRC sysinit: dbus, lainos-notifyd, lainos-machine-id
→ OpenRC boot: rfkill-unblock, cgroup-delegate, lainos-ghost-units, syslog-ng
→ OpenRC default: seatd, lainos-dbus-bridge, greetd, chrony, nftables, acpid, polkit
→ greetd → tuigreet → Sway session
→ lainos-session-sway → lainos-init → Sway

Protocol 7 is the architectural foundation enabling systemd-free operation while maintaining compatibility with software expecting systemd interfaces.

Protocol 7 is not in a position to own your whole system. systemd, by contrast, is.

Real systemd-libs provide ABI compatibility — the client libraries function fine without systemd running as PID 1. eudev is a genuine, functional udev implementation. Custom C daemons handle responsibilities that systemd would otherwise own:

• Sway tiling compositor with autotiling
• i3status-rs themed status bar
• wofi application launcher
• alacritty terminal emulator (tmux by default)
• mako notification daemon
• swaylock screen locker with wallpaper background
• wlogout session/power menu
• Powerlevel10k zsh prompt
• CoplandOS-GTK dark theme with StarLabs cursor
• PipeWire audio (orchestrated by lainos-audio-init)

Keybindings:

• WiFi off by default ~ iwd does not start automatically; toggle with wifi on / wifi-autostart
• MAC randomization ~ new MAC every time iwd starts; ethernet via eth0 toggle
• DNS mediation ~ centralized via dnsmasq at 127.0.0.1:53
  • Plaintext (default) — DHCP with 1.1.1.1/9.9.9.9 fallbacks
  • Encrypted ~ dnsmasq → unbound → dnscrypt-proxy (no single component sees both IP and query)
  • Private ~ Tor DNSPort via private-mode
• Tor stream isolation ~ dedicated circuits tor1-tor4 for per-application isolation
• Optional Tor time sync ~ sdwdate (opt-in, fingerprint-resistant)
• Pluggable transports ~ snowflake/obfs4 toggles for censorship resistance
• nftables ~ default-deny firewall
• IPv6 disabled by default (prevents VPN leaks)
• Boot clock randomization ~ ±180 seconds jitter before networking

doas dd if=~/lainos-out/lainOS-layer-02-*.iso of=/dev/sdX bs=4M status=progress oflag=sync

Boot from USB, login as liveuser (no password) at tuigreet. Calamares launches automatically.

Tested on: QEMU/KVM with Virtio GPU, ThinkPad T480 (Libreboot) — baremetal confirmed, UEFI and BIOS, including LUKS FDE.

wifi on # Enable WiFi (off by default)
wscan # Scan and connect with numbered menu
lainos-dns encrypted # Switch to encrypted DNS
private-mode on # One-command sensitive-work mode

• Privilege escalation: doas (not sudo)
• Power menu: wlogout
• Lid close: auto-locks with swaylock and suspends
• Quick-start guide opens automatically on first terminal launch: lainos-quickstart-help
• Full guide: lainos-help

Build host: LainOS Layer 02 or Arch Linux with Protocol 7 repository configured

doas pacman -S archiso base-devel git
git clone https://forgejo.lain.rocks/lainOS/lainos-iso-layer-02.git
cd lainos-iso-layer-02
doas rm -rf ~/lainos-work ~/lainos-out
mkdir -p ~/lainos-work ~/lainos-out
yes ""| doas mkarchiso -v -w ~/lainos-work -o ~/lainos-out protocol7-profile 2>&1| tee ~/lainos-build.log
lainos-hash-iso

ISO output: ~/lainos-out/lainOS-layer-02-YYYY.MM.DD-x86_64.iso

One-command utilities for daily operation:

LainOS is developed by Grayson Giles and the LainOS community.

• Forgejo:https://forgejo.lain.rocks/lainOS/
• Codeberg:https://codeberg.org/lainOS
• GitLab:https://gitlab.com/lainos
• GitHub:https://github.com/The-LainOS-Project
• Website:https://lainos.net
• Security verification:lainos-security-suite repository (see org links above)

Please include:

• ISO version/date
• Hardware/VM configuration
• rc-status output
• Relevant logs from /var/log/rc.log or dmesg

LainOS Layer 02 and the Protocol 7 compatibility layer are released under the GNU General Public License v3.0.

Individual components (Sway, OpenRC, Calamares, etc.) retain their respective licenses.

• Arch Linux ~ The foundation everything is built on
• OpenRC ~ Reliable, predictable init system
• GrapheneOS ~ hardened_malloc
• Sway/wlroots ~ Modern Wayland compositor ecosystem
• Calamares ~ User-friendly system installer
• Kicksecure/Whonix ~ sdwdate, bootclockrandomization, ram-wipe, and security-hardening model

Current package: protocol7-core-5.5.3-27
*Status: Stable
Last updated: 2026-07-29

Grayson Giles aka amnesia1337
PGP fingerprint: 456F268D14C9ECCE1A77355803E8F5B63BAC3998
Keyserver: https://keys.openpgp.org