0TrustOS is the Linux agent for policy and provisioning on the 0Trust mesh. Run it beside your workload, enroll the node, and enforce access grants where the work actually runs.
Identity in the cloud is half the story. Policy has to land on the machine that serves traffic.
Long-lived process or barge on Linux. Sits next to the app — not a full kernel replacement, not a black-box appliance.
Session and tunnel grants gate open on the node. Entitlements follow identity from 0trust.cloud down to the host.
CLI and TUI on the same control plane. Show system state, manage caps, and debug without a separate agent product.
A microkernel-style control plane on Linux: named ports, capabilities, and soft OS faces over the host.
identity, policy, security, storage, orchestrator, mesh, net, ssh, provision — call by name over the control plane.
Sealed rights over targets: call, grant, admin, spawn. Operator and IPC gating share the same model.
Host-backed vfs, proc, cgroup, sched, and net — a clean surface without replacing the Linux kernel.
Policy kit and grants for operator commands and IPC. Enforce or log with veriexec-style modes.
Enroll nodes toward 0trust.services / 0trust.cloud. Optional enrollment token for headless barge start.
Works with the 0Trust identity plane, mesh access, and VPN path — passkeys and device-bound sessions for humans.
0TrustOS does not replace the host kernel. Long-lived process or barge — policy and provision on the node.
| Product | 0TrustOS — policy & provisioning agent |
|---|---|
| Engine | gonode — microkernel-style control plane |
| Identity | 0trust.cloud — passkeys / OIDC |
| Deploy shape | -mode sidecar · barge on k3s/k8s |
| Not | A full OS install · a public-only tunnel product |
Product: 0TrustOS (policy · provision)\n Engine: gonode\n Identity: 0trust.cloud\n Mesh: 0trust.services\n Public: TunnelTug (optional haul)\n Host: Linux process / barge
gonode -mode sidecar -daemon -zt \\\n -data /var/lib/gonode \\\n -config /etc/gonode/barge.gnconf
Image: hub.tunneltug.com/0trust/gonode: · Docs: 0TrustCloud/0TrustOS
Identity, mesh access, public tunnels, and the node agent — each product has a clear job.
Clone 0TrustOS, build gonode, run the Linux sidecar.
git clone https://github.com/0TrustCloud/0TrustOS.git\ncd 0TrustOS\ngo build -o bin/gonode ./cmd/gonode\n./bin/gonode -cmd \"show system\"
./bin/gonode -mode sidecar -daemon -zt \\\n -data /var/lib/gonode
MIT. 0TrustOS + gonode. Built for the 0Trust control plane.