bhairav-os / rudracore

Bhairav OS

An operating system written from scratch in C++23. It has its own bootloader, its own microkernel, its own network stack and its own desktop. It isn't Linux, and it doesn't run Linux programs.

The kernel is called RudraCore. The desktop is KamalShell. It boots on real x86_64 PCs and in QEMU.

The KamalShell desktop: a dark plum gradient with a lotus watermark, a top bar with the time, and a dock of app icons
KamalShell, 12 Nov 2026, booted on UEFI

What works today

  • Boots through its own UEFI loader (ShoolLoader), or Limine on old BIOS machines
  • Preemptive multitasking, with every program in its own address space
  • Drivers outside the kernel: SATA disks, PS/2 keyboard and mouse, Intel e1000 and Realtek RTL8139 network cards
  • Saves files to a FAT32 disk
  • Its own TCP/IP stack (DHCP, DNS, TCP, UDP, ICMP) and TLS 1.3, enough to load real HTTPS pages
  • A desktop with a browser, files, terminal, notes, a system monitor and an app store
  • Third-party apps as .bpk packages, installed with apt from a repository
  • HTTPS that checks who it's talking to: the certificate chain, the site's name and the dates
  • Signed apps. Each app gets its own folder, and the App Store shows what else it may reach (a folder of yours, the network, listed sites only)
  • A hardened kernel: SMEP, SMAP, stack guard pages, handles with rights and revocation, and an IOMMU so devices only reach their own buffers
  • USB, sound, Wi-Fi, more than one CPU core
The App Store's Permissions panel for the Clock app: network off, your files off, which folder /Documents, hardware never
The App Store's Permissions panel, 13 Nov 2026

A boot, as the serial port sees it

[init] Bhairav OS userspace is up. I am init, task 1
[protect-test] syscall with a kernel pointer returned -2 (rejected, good)
[sched] protect-test crashed: page fault on read of 0xffffffff80001000
[init] ipc check: 1000 message round trips in 70 ms
[fs-test] fs check: create, read, append, long names, directories and remove ok
[tls-test] SHA-256, HKDF, X25519, ChaCha20-Poly1305 and AES-128-GCM match the test vectors
[net-test] DHCP in 958 ms, gateway ping 0 ms, example.com is 172.66.147.243
[tls-test] https://example.com -> HTTP 200 (TLS 1.3, handshake 41 ms)
[kamalshell] KamalShell is running
QEMU q35, 256 MiB. Lines trimmed a little.

Inside roughly how it fits together

  browser  files  terminal  notes  monitor  store    apps
       \      |       |       |       |      /
        +-------------- KamalShell -----------+      desktop
              |                      |
           fs (FAT32)          net (TCP/IP, TLS)      servers
              |                      |
            ahci     ps2      e1000 / rtl8139         drivers
  ------------------------------------------------- ring 3
                 RudraCore  (28 system calls)         kernel
  ------------------------------------------------- ring 0

The kernel only runs tasks, maps memory and passes messages. Everything above the line is an ordinary program. Programs talk over channels and can hand each other a handle to a channel, a block of memory or a device. A program can't touch anything it wasn't handed, a handle can carry fewer rights than its owner has (read-only, send-only), and it can be taken back.

The details, including a security review with what's still missing, are in README.md and docs/SECURITY.md.

Logbook from the commit history

  1. First commit.
  2. The kernel boots. GDT, IDT and interrupts, then a scheduler and system calls, IPC channels, the PS/2 keyboard driver, memory protection, and ShoolLoader on UEFI. KamalShell, Notes, Monitor and About show up the same day.
  3. Files are saved to disk. A network stack and a terminal, then the e1000 and RTL8139 drivers, the App Store and apt.
  4. A security review. It found that one app could crash the kernel by using up all memory, so the kernel now keeps a reserve, with a test to keep it fixed. Then SMEP, SMAP, guard pages, stricter program loading, and handles with rights, generations and revocation.
  5. Apps get a sandbox: their own folder, permissions you can review, network limited to what they're allowed. Packages are signed, HTTPS checks certificates, and with VT-d hardware a device can only touch the memory its driver gave it.

Build it yourself

On Windows you need Docker and, if you want a window, QEMU. Everything else is inside the toolchain image.

.\bhairav.ps1 toolchain
.\bhairav.ps1 build
.\bhairav.ps1 run

On Linux, install the packages from the Dockerfile and run make run. The first build also makes keys/package-signing.pem, the key your app packages are signed with. Keep it.