A private system that runs from memory.
Postern OS is a hardened live Linux system for the desktop, for phone-sized screens and for the console. It starts from a USB stick, keeps its session in RAM, and tells you plainly what it protects and what it does not.
Every screen on this page is a real capture of the 0.4.0-dev images running offline in a virtual machine.
Private by default. Hardened underneath. Honest about both.
Three things are true of every Postern image, and a built-in report lets you check them on the machine in front of you.
Private
Nothing listens for you, and little is said about you.
- No SSH, discovery, remote desktop or location service
- Inbound firewall on; a random hardware address per connection
- Host name withheld from DHCP; no telemetry in Firefox
- Session, journal and temporary files live in memory
Hardened
A bug in one program should be harder to turn into control of the machine.
- Memory wiped when allocated and when freed
- Hardened allocator and kernel stack; CPU mitigations kept on
- kexec, SysRq and unused network protocols disabled
- AppArmor enabled; core dumps discarded
Capable
A full working system, not a locked-down kiosk.
- Firefox, Tor Browser, KeePassXC, Metadata Cleaner
- Encrypted vault files that travel on a USB stick
- Parallel file-integrity manifests for large data sets
- Compressed memory swap and tuned networking
Calm, fast, and already set up.
GNOME on Wayland with a dock that stays put, a blurred top bar, one icon family and window controls where your hand expects them.
The tools you need for private work are in the dock.
Firefox opens on a quiet page with telemetry, studies and saved logins switched off by locked policy. Tor Browser is included and starts only when you open it. Metadata Cleaner strips author, location and device data from files before you share them.
Keep files across restarts without leaving them readable.
A vault is one encrypted file (LUKS2, AES-256-XTS, Argon2id). Put it on a USB stick, open it when you need it, close it when you are done.
Do not take our word for it. Ask the system.
One window, or one command, reports what can be observed right now: firewall, listeners, remote-login services, AppArmor, CPU mitigations, kernel hardening, network identity, swap, logs and account passwords. A check that cannot read its source says “not determined”. It never says “ok” by default.
The same system, shaped for a phone screen.
The Phosh phone shell on the same privacy and hardening baseline: favourites, an app grid with search, apps as cards, and the same Postern Status report in a phone layout.
Today this is the phone interface running on x86-64, for a virtual machine or an x86 tablet. It is not yet a handset image: no phone hardware port, modem or telephony is configured or tested.
Recorded from the real images.
Each video is one scripted session of the ISO booted with no network in a virtual machine, driven by keyboard events. Playback is faster than real time and idle waits are shortened; the opening card of each video says so.
Desktop walkthrough
4 min 30 s · 19 of 19 checks recorded inside the running system passed
Mobile walkthrough
2 min 55 s · 12 of 12 recorded checks passed
Console (compute) walkthrough
4 min · 6 of 6 recorded checks passed
Checked on a booted system, not on paper.
The build runs a real boot test: it sends traffic at a listening service to prove the firewall filters it, crashes a program to prove no core file is kept, and opens, closes and reopens an encrypted vault.
One baseline, three shapes.
| Image | Interface | Made for | Status |
|---|---|---|---|
| Desktop | GNOME on Wayland | Private everyday work: browsing, documents, passwords, encrypted files | Builds, boots and records in a virtual machine |
| Mobile | Phosh phone shell | Portrait screens: a virtual machine or an x86 tablet | Builds and boots in a virtual machine; not a handset image |
| Compute | Local console | Offline data processing, integrity manifests, diagnostics | Builds, boots and records in a virtual machine |
x86-64 only. There are no public downloads yet: images are development builds from the private source repository.
What Postern OS does not do.
A privacy tool that overstates itself is a risk to the people who rely on it. So, plainly:
It is not anonymity
- It does not route the whole system through Tor. Only Tor Browser's own traffic uses Tor.
- Ordinary DHCP, DNS, time and application traffic still happen on the network you join.
- An access point still sees that a device connected, and when.
It is a development preview
- Validated in virtual machines under software emulation; not on physical hardware.
- No installer and no full-disk encryption; the live session has no password, so physical access is control.
- Hardening raises the cost of an attack. It is not a sandbox and it has not been audited.