RegicideOS: An Immutable Linux Distribution

Executive summary

RegicideOS is an open-source Linux distribution built for organizations that value control, auditability, and self-ownership over convenience. It boots into a COSMIC desktop on an immutable Btrfs root, keeps GUI apps in Flatpak, and runs development work inside Distrobox containers. Core tooling is written in Rust, and the base OS is built on Gentoo with Catalyst and compiled from source on your own hardware. The result is a stack you can rebuild, inspect, and reason about from source, which matters most in industries where trusting a vendor image is not enough.

The build pipeline is documented so it can be changed manually or with automation, using AGENTS.md, Skills.md, and the Dagger build engine. A full source build of Gentoo takes a long time; incremental builds are faster, but they still require time and local compute. The main benefit is knowing exactly what is in the image and being able to rebuild it. LUKS disk encryption is supported and recommended.

Values

RegicideOS is built on four values: open source, sovereignty, user freedom, and privacy. The code is open for anyone to inspect, modify, and run on their own hardware. Users keep control of their system, their data, and the software they depend on. Privacy and local control are defaults, not optional add-ons.

The problem with mutable infrastructure

Most production Linux systems drift. Each package update, config tweak, and hot fix leaves the running system a little different from the documented state. When something breaks, the team has to trust that a snowflake install will behave predictably, or rebuild from scratch and hope nothing important was missed.

An immutable operating system reduces that drift by design. The root filesystem is read-only, and updates are delivered as complete images. If an installed change breaks something, you roll back by booting the previous image instead of debugging a partially mutated system. Your files in Downloads, Documents, and other normal folders stay safe because they live on writable subvolumes separate from the immutable root, which is backed by a read-only SquashFS image. That read-only boundary also blocks casual or accidental changes by automated tools or scripts: the base OS cannot be modified through normal package operations, so unintended behavior is more likely to be contained by the filesystem boundary than to spread across the system. It does not eliminate all risk; a privileged attacker or a malicious container runtime can still bypass these boundaries.

Benefits

1. Immutable desktop with isolation for automated tooling

RegicideOS boots into a COSMIC desktop on a read-only Btrfs root. Automation and scripts run inside isolated containers that match the Linux distribution a project needs. Browsers and other user-facing applications run as Flatpaks, sandboxed and updated independently of the OS. This containment lowers the chance that a misbehaving script or automated workflow will alter the host, while still giving users a familiar desktop experience.

2. Applications stay out of the root filesystem

GUI applications install through Flatpak, so user-facing software is sandboxed and updated independently of the OS. The root image stays small, focused, and predictable; application churn does not turn into system drift.

3. Per-project workspaces with Distrobox

Development work happens inside Distrobox containers. Each workspace can run the Linux distribution its project needs, with its own toolchain, dependencies, and isolated automation. This avoids fighting system Python, system Node, or cross-project dependency conflicts. You can use Ubuntu, Fedora, Arch, or another supported distribution inside the container while the host stays minimal.

4. Root changes are rare and reproducible

The base OS changes less often than a normal Gentoo install, but when it does change the result is built from the documented pipeline. Builds run locally from source, every OS setting can be modified to match your intent, and the pipeline is documented so it can be changed either manually or with automation.

5. Encryption

RegicideOS supports LUKS disk encryption and recommends it. An immutable root plus encrypted disks removes one common path for accidental or opportunistic data exposure, but it is not a complete security architecture on its own.

Technical details

RegicideOS is built from a Gentoo stage4 with the COSMIC desktop as the default environment. The root filesystem is a read-only Btrfs volume, with stateful data kept on separate subvolumes. Updates are prepared offline and swapped atomically. The live image is a SquashFS produced by the Catalyst pipeline, so the bootable artifact is byte-for-byte what was validated.

RegicideOS is not a polished daily-driver operating system. COSMIC is still maturing, and anyone who has used Linux before understands the difference between a vendor-curated desktop and a system you build and own yourself. RegicideOS is designed for the latter: teams that need to know exactly what is running, rebuild it when policy changes, and roll back when something goes wrong. It is not a hardened distribution out of the box. It does not include Secure Boot, measured boot, mandatory access control beyond what Gentoo provides, or automated SBOM/CVE scanning. Those can be added on top, but they are not part of the default image.

How it compares

RegicideOS is inspired by immutable distributions like Fedora Silverblue and Fedora Atomic, but it is built around Gentoo's emerge and Portage, uses Btrfs for updates and versioning, and prefers Distrobox for containers over Toolbox. Because the imaging process stays inside the filesystem itself via Btrfs subvolumes, there is no separate CLI orchestrator to manage images. That keeps source-based flexibility with a smaller moving-parts surface than an external image manager, at least for teams already comfortable with Gentoo's tooling.

Roadmap

An Arch-based variant of RegicideOS is planned, bringing the same immutable-root workflow, Distrobox-first development model, and rollback-ready desktop to users who prefer the Arch package ecosystem. No release date is set yet.

Use cases

• Defense and cybersecurity: Read-only roots, containerized workflows, and source-built images lower the attack surface and make incident response faster. RegicideOS is not a full security platform out of the box, but it removes common persistence paths and gives teams a stack they can audit from source.
• Healthcare and life sciences: Pinned, reproducible system images help with validation, compliance, and sharing exact runtimes alongside code and data.
• Manufacturing and industrial control: Immutable nodes reduce variance across a fleet of workstations, controllers, and edge devices, making updates and driver behavior predictable.
• Financial services and regulated infrastructure: Local source builds, transparent dependency graphs, and minimal mutable state support audit trails and internal review processes.
• Research and reproducible science: A pinned system image lets teams share an exact runtime environment alongside their code and data.
• High-sovereignty organizations: Teams that want to own their stack end-to-end, from Portage overlay to final ISO, instead of trusting a vendor-curated image.

Architecture at a glance

Layer 0 is a Gentoo base with systemd and COSMIC desktop as the default install. Layer 1 is the Rust tooling workspace: installer, Btrfs helpers, and build scripts. Layer 2 is the documented local Catalyst build pipeline. The result is an operating system that can be rebuilt, reinstalled, and reasoned about from a small set of declarative inputs.

Business support

RegicideOS is open source and free to use. Vibe Coding Agency offers sliding-scale, pay-as-you-go support for organizations deploying it in demanding environments: defense, cybersecurity, healthcare, manufacturing, finance, and other regulated or high-sovereignty settings. We help with deployment, build pipeline customization, update policies, and hardening advice. There is no retainer or lock-in.

Source code, issue tracker, and releases are on GitHub: awdemos/RegicideOS.