A read-only, verified base
The root filesystem is read-only and protected by Linux dm-verity. Every block is checked against a signed hash tree. If anything has changed, the system will not boot it.
Subgraph OS · Montréal
Citadel
An operating system that keeps your work, and your agents, apart.
The new Subgraph OS is built on Citadel, a read-only base system that is checked at every boot. Your applications and data live in realms, separate partitions for work, personal use, development or AI agents.
Subgraph OS · Montréal
Citadel
An operating system that keeps your work, and your agents, apart.
The new Subgraph OS is built on Citadel, a read-only base system that is checked at every boot. Your applications and data live in realms, separate partitions for work, personal use, development or AI agents.
Subgraph OS · Montréal
Citadel
An operating system that keeps your work, and your agents, apart.
The new Subgraph OS is built on Citadel, a read-only base system that is checked at every boot. Your applications and data live in realms, separate partitions for work, personal use, development or AI agents.
Subgraph OS · Montréal
Citadel
An operating system that keeps your work, and your agents, apart.
The new Subgraph OS is built on Citadel, a read-only base system that is checked at every boot. Your applications and data live in realms, separate partitions for work, personal use, development or AI agents.
Subgraph OS · Montréal
Citadel
An operating system that keeps your work, and your agents, apart.
The new Subgraph OS is built on Citadel, a read-only base system that is checked at every boot. Your applications and data live in realms, separate partitions for work, personal use, development or AI agents.
Subgraph OS · Montréal
Citadel
An operating system that keeps your work, and your agents, apart.
The new Subgraph OS is built on Citadel, a read-only base system that is checked at every boot. Your applications and data live in realms, separate partitions for work, personal use, development or AI agents.
Subgraph OS · Montréal
Citadel
An operating system that keeps your work, and your agents, apart.
The new Subgraph OS is built on Citadel, a read-only base system that is checked at every boot. Your applications and data live in realms, separate partitions for work, personal use, development or AI agents.
01The problem
Le problème
Le problème
Most computers are one big room.
Every program runs as you and can read every file. A client project, your personal email and a tool you tried once all share the same account. Any of them can open your SSH keys or your browser's saved passwords.
Software gets installed for a project and never removed. Patches get missed. A backdoored package can stay trusted long after anyone remembers where it came from. Most organizations deal with this by buying a second computer, or by writing a policy.
In Subgraph OS, the base system, Citadel, is small, verified at boot and only changes when you install a signed update. Your applications and data are split into realms, and a problem in one realm stays there.
02Realms
Les realms
Les realms
One realm for each kind of work.
A realm is a partition of the system with its own applications and data. You decide how many you need and what goes in each. Here is a typical setup.
Work
Email, documents and client files. Your SSH keys and password manager can live here and nowhere else.
Personal
Your own browsing, banking and accounts, kept away from work data.
Development
Compilers, package managers and dependencies from the internet. If a package turns out to be malicious, it is stuck in this realm.
Agents
AI agents get their own realm with only the files you copy in. They cannot read the SSH keys in Work, because those files are not there.
Scratch
Install anything you want to try. Your main system stays clean, and you can delete the realm when you are done.
03AI agents
Agents IA
Agents IA
AI agents run with your permissions.
An AI agent acts on your behalf. It can read your files, use your passwords and keys, and talk to outside services, often without anyone watching each step.
An agent can be steered by text it reads. The model behind it cannot be inspected, and it often runs on someone else's servers. Desktop operating systems assume one trusted person at the keyboard, so they have no way to give an agent access to some of your files and not others.
- 1Run agents in a realm of their own, with only the files and accounts their work needs.
- 2Give higher-risk agents a full virtual machine instead of a container.
- 3Discard a realm and start again from a known image when something looks wrong.
- 4Keep your SSH keys, password manager and client files in other realms, out of the agent's reach.
04How it works
Fonctionnement
Fonctionnement
What Subgraph OS does.
Applications run in realms
Applications never run in the base OS. They run in realms: separate partitions, each with its own applications, files and network. If one is compromised, the attacker does not get into the others.
Containers or virtual machines
Use lightweight container realms for everyday work, and full KVM virtual machines for untrusted software, malware analysis or AI agents that need a harder boundary.
All realms on one desktop
Windows from different realms share a single GNOME desktop. Each one is labelled with the name of its realm.
Signed updates with rollback
The base system ships as one signed image. An update is either applied completely or not at all, and you can roll back to the previous version.
Reproducible builds
Citadel builds reproducibly from source. Anyone can rebuild an image and check that it matches ours byte for byte.
05Architecture
Three layers.
The base system does not change. The isolation layer keeps realms apart. Your applications and files sit in the realms on top.
- Layer 1Base
Citadel base system
Kernel, init, graphics and the desktop shell. It holds no user applications and no user data. Mounted read-only and verified with dm-verity at every boot.
- Layer 2Isolation
Containers and the pH hypervisor
Container realms use Linux namespaces and run at close to native speed. A realm that needs more isolation can run as a virtual machine under pH, our KVM hypervisor written in Rust.
- Layer 3Work
Your realms
For example work, personal, development, agents and a scratch realm. Each realm sees only its own data. Its root filesystem is a signed image, and only your home directory is kept between sessions.
06On screen
À l'écran
À l'écran
Screenshots.
Subgraph OS uses the GNOME desktop. The coloured label on each window shows which realm it belongs to.
07Who it is for
Pour qui
Pour qui
Who uses it.
Subgraph OS is for people who need to keep some of their work separate from the rest.
Defence and national security
Work at different classification levels on one computer, each in its own realm.
Government
A verifiable workstation that can be restored to a known state, without depending on foreign cloud services.
Teams using AI agents
Put agents in their own realm and limit what they can read, change or send.
Security researchers
Open malware and untrusted samples inside a virtual machine that the rest of the system never sees.
Developers and administrators
Separate client projects, build tools and production credentials, so one bad dependency cannot reach everything.
Journalists and civil society
Keep source material and contacts in a realm that your browser and email cannot reach.
08Specifications
Fiche technique
Fiche technique
Technical details.
Subgraph OS is in active internal use and approaching release. Details may change before general availability.
Base system
- Build
- Custom Linux built with OpenEmbedded (not a derivative distribution)
- Desktop
- GNOME Shell on Wayland
- Init
- systemd
- Integrity
- Read-only root, verified with dm-verity
- Updates
- Signed whole-system images, atomic with rollback
- Storage
- Full-disk encryption with LUKS
Realm isolation
- Container realms
- systemd-nspawn with Linux namespaces
- VM realms
- pH, a KVM hypervisor written in Rust
- Realm images
- RealmFS: signed, verifiable root filesystems
- Networking
- Per-realm network zones
- Desktop integration
- Labelled windows on one shared desktop
Supply chain and hardening
- Builds
- Reproducible from source, independently verifiable
- Kernel
- Lockdown LSM, Yama, LoadPin, signed modules, KASLR
- Memory
- Hardened usercopy, zero-on-allocate, strong stack protector
- Infrastructure
- Runs locally. No cloud account required
Recommended hardware
Processor
- 64-bit Intel or AMD
- VT-x or AMD-V for VM realms
Memory (GB)
- 8 GB minimum
- 16 GB or more for several realms
Storage (GB)
- 32 GB minimum
- NVMe SSD recommended
Conçu à Montréal · Made in Montreal
Made in Montreal, Canada.
Subgraph has spent more than a decade on vulnerability research and penetration testing. We audit software for the Open Technology Fund's Security Lab and created Vega, an open-source web security scanner used by tens of thousands of people. Subgraph OS is designed and built here, and it runs without any cloud service.
Pre-release
Trials are open.
The new Subgraph OS is not available for public download yet. We are running trials with defence, public-sector and civilian organizations.
Trial partners get early builds and work directly with our engineers. Their feedback decides what we fix first. Public releases will come with reproducible-build checksums and a signed manifest.
09Journal
From the blog.
Development notes, audit methods and design decisions.
November 5, 2025
How We Audit Tools for Human Rights Defenders
The steps Subgraph follows when auditing software for the Open Technology Fund Security Lab.
Read more March 22, 2025Reproducible Builds and Citadel
A reproducible build lets anyone rebuild a release from source and compare hashes with the published binaries. This post explains how that works and what Citadel will publish to support it.
Read more January 15, 2025Introducing Citadel
Citadel is the base system of Subgraph OS. Its root filesystem is read-only and verified with dm-verity. Applications run in separate realms.
Read moreContact.
Email us about a Subgraph OS trial or a security audit.
info@subgraph.com