Docs · Source · podman build -t awnix:latest -f Containerfile . · The Aither World
The Aither World is an operating system for agents — a Linux you can hand to one, the runtimes it works in, and the tools it works with. awnix is one of its 65 bricks — each installs on its own, runs offline, and needs no account.
Start here: Boot one throwaway box and try to make a change you cannot reproduce.
A Linux you can hand to an agent.
Not a distro with an AI assistant bolted on. A bootable, immutable base built for machines where software writes software — and where you still need to know what happened, undo it, and prove it.
podman build -t awnix:latest -f Containerfile .That builds it from source. The OS is a container image: you build it, you sign it, you roll it back.
Every build is a bootable ISO. Pick one, download it in one piece, check it, boot it.
| Variant | What you get | Download |
|---|---|---|
| awnix-ai-full (recommended) | the whole aw* stack + a local model sized to your hardware on first boot (Bonsai 1.7B up to Bonsai 2 27B) | awnix-ai-full-x86_64.iso |
| awnix-full | the whole aw* stack, no local model | awnix-full-x86_64.iso |
| awnix-ai | runner + local model | awnix-ai-x86_64.iso |
| awnix | the immutable base + the aw* tools | awnix-x86_64.iso |
| awnix-desktop-open | a keyboard-first tiling desktop: Super+A opens the agent on the local model |
awnix-desktop-open-x86_64.iso |
Each file is the same bytes as the matching GitHub release,
which also carries the split parts, an assemble script and SHA256SUMS.
curl -LO https://artifact.aitherium.com/awnix-ai-full-x86_64.iso
sha256sum awnix-ai-full-x86_64.iso
# compare with SHA256SUMS on the matching release page (awnix-iso-ai-full-<date>)Write it to a USB stick (balenaEtcher, Rufus, or dd) and boot it, or boot it in a VM with
4 GB of RAM and 20 GB of disk. On first boot awnix-setup asks three things, all skippable:
a hostname, which extra aw* components to add, and whether to link the box to your account.
Updates are whole images. sudo bootc upgrade && sudo systemctl reboot moves to the new
image and keeps the old one. If the new image fails its health checks three boots in a row,
the machine goes back to the previous one by itself; sudo bootc rollback does it by hand.
Building on it: the Aither World Guide walks from
first agent to your own pack. pip install awdk, then adk pack new yourname.tool scaffolds a
pack; adk pack validate, adk pack dev and adk pack build check it, load it and produce a
bundle with its sha256.
Give an agent real access to a machine and you inherit four problems on day one:
It will change things you can't see. Not maliciously — thoroughly. An
immutable /usr and atomic updates mean every change is a new image you can
diff, and a bad one is bootc rollback, not an evening.
It will run alongside other agents. Two processes editing the same file is not a merge conflict, it's lost work. That's why the tooling below has leases.
It will be wrong sometimes. The question isn't whether, it's whether you find out cheaply. Snapshots and verified artifacts make "what did it actually do" a command instead of an investigation.
It will need credentials, and shouldn't get yours. awnix ships no password at all — the account is locked, access is by SSH key, and there is nothing to leak because nothing was ever set.
If you're running agents on someone else's platform, all four are handled by trusting the platform. awnix is the other bet: you can verify everything, so you have to trust nothing.
-
podman, buildah, skopeo, crun — rootless containers, no daemon
-
cloud-init — so a key-only image is genuinely reachable
-
Cockpit on 9090 — a web console for a machine with no desktop
-
firewalld with an
awnixzone and zero ports opened -
an unprivileged
awnixaccount, locked, with NOPASSWD sudo -
bootc — atomic updates, real rollback
-
the eleven
awtools, preinstalled and importable (the table below)
No services. No agent. No account. What runs on top is yours.
The aw tools are not an exception to that line — they are tools, not services.
Nothing runs, nothing listens, nothing has an account. awgit does not start a
daemon; it refuses a commit when someone else holds the lease. The distinction
that matters is does it run on its own, and none of these do.
They ship preinstalled because the alternative was worse: this README advertised
all of them while the image contained none, so awgit answered
command-not-found on a machine whose whole pitch is that tooling.
awnix deliberately ships no agent, and that is the honest answer to "how do I run one": you layer it on. A base image that arrives with an agent already running has decided what you are doing with your machine.
The layer is small, because the capabilities are already here:
FROM awnix:latest
RUN pip3 install --no-cache-dir awdk # the agent runtime
# ...your skills, packs and credentialsawdk finds the aw tools by import — they are already on the image — so the
agent gets leases, the call graph, messaging, scoped memory, snapshots and
verified artifacts without any wiring. That is the point of putting them in the
base rather than in the agent: swap the agent, keep the guarantees.
What that buys you concretely, from the four problems at the top of this file:
| you inherit | what stops it | already installed |
|---|---|---|
| it changes things you cannot see | atomic updates, bootc rollback |
bootc |
| two agents editing one file | a lease refused at commit time | awgit |
| it will be wrong sometimes | a restore that fully lands or not at all | awrecover |
| you cannot prove what it produced | Ed25519 seals, verified fetch | awseal, awshare |
| it cannot see past its own training | a real browser and a search it can query | awbrowse, awfind |
| anyone who gets the link gets in | an invitation addressed to one person, revocable alone | awnboard |
| you cannot tell a person from a script | a verdict with evidence, where "cannot tell" is not "yes" | awnest |
That last row is why the base is worth having at all. An agent with root on a box
and no way to read a page is a very expensive offline function. awbrowse and
awfind are clients, so the browsing engine and the search providers stay on
a service you run: the agent gets to look things up without any of your queries
leaving for a vendor you did not choose.
Run the agent as a service with the unit template in units/, or interactively
while you are still deciding what it should do.
The awnix account has no password. Access is by SSH key: cloud-init injects
your launch keypair on a cloud image; on bare metal you place one.
Two details that look optional and are not:
cloud-init is what makes key-only work. Remove it and you have an image with no password and no key path — unreachable rather than insecure, which is worse than the shared credential it replaced. If you fork this and drop cloud-init, give yourself another way in first.
NOPASSWD sudo is the companion, not a convenience. A locked account cannot
sudo at all if sudo demands a password. Key-only login without it gives you a
machine you can reach and cannot administer. ec2-user and ubuntu work the
same way, for the same reason.
Password authentication is off in sshd. With no password anywhere it's dead weight, and image scanners flag it — correctly.
awnix ships unit templates, not units. A base image that hands you a fleet has already decided what you're running.
sed -e 's/{{ name }}/myapp/g' \
-e 's|{{ image }}|ghcr.io/you/myapp:latest|g' \
-e 's/{{ port }}/8080/g' \
units/service.container.j2 > /etc/containers/systemd/myapp.container
systemctl daemon-reload && systemctl start myapp
firewall-cmd --zone=awnix --add-port=8080/tcp --permanentThe template carries four opinions, each one something that's expensive to learn the hard way:
state under /var |
an immutable /usr loses anything else on update |
| a real healthcheck | without one, a wedged container looks exactly like a healthy one to every supervisor on the box |
Restart=unless-stopped |
nothing revives an exited container, and this still honours a manual stop |
After=network-online.target |
the difference between a network that's configured and one that merely exists |
The full admin guide ships in every image and is one command away: man awnix. The same
pages are in /usr/share/doc/awnix/html and in the web console's Guide tab.
Download an ISO from the table above and check it against SHA256SUMS. Write it with
write-awnix-usb (it verifies what it wrote and refuses the disk you booted from) or any
USB writer in DD mode. For an unattended install, make a second stick with
make-awnix-seed: it names the disk, the admin user and SSH keys, and answers first-boot
setup; a seed never wipes a partitioned disk unless it says "wipe": true. See
man awnix-seed.json.
Building your own bootable media from the image instead:
podman run --rm -it --privileged \
-v /var/lib/containers/storage:/var/lib/containers/storage \
-v "$PWD/output":/output \
quay.io/centos-bootc/bootc-image-builder:latest \
--type iso --local awnix:latest--type also takes ami, qcow2, vmdk, raw.
The box boots without waiting for anyone. Setup is offered on the local console and at
https://<box>:9443, the web console; the banner prints the address, a one-time code and
the certificate fingerprint to compare before you accept the self-signed certificate.
After setup, sudo awnix console code prints the console's sign-in code. See
man awnix-setup and man awnix-console.
Updates are whole signed images on a channel, stable (the default) or beta:
awnix update status
sudo awnix update check # verify the signature, stage it; never reboots on its own
sudo awnix update apply # reboot into it
sudo awnix update rollback # back to the previous imageA new image that fails its health checks three boots in a row rolls back by itself. A
rollback keeps /var, but /etc comes back as it was when the update was applied, so
copy any /etc change made since then (a license, setup answers, SSH settings) first. See
man awnix-update.
Optional software installs beside the immutable image, pinned per image and rollback-aware:
awnix component list
sudo awnix component install awbrowse
sudo awnix component rollback awbrowseSee man awnix-component.
Standalone tools that share one idea: replace something you would otherwise have to trust with something you can check.
Each installs on its own, works offline, and needs no account.
| instead of trusting | you check | |
|---|---|---|
| awdk | a framework's idea of how your agents should run | one loop you can read, pointed at a backend you already pay for |
| awskills | that an agent knows your procedure | the procedure written down, versioned, and loadable by any agent |
| awpack | that the pack you want shipped inside somebody's SDK, under whatever licence that SDK happens to carry | the pack as its own versioned artifact, with its own licence, that any agent runtime can install |
| awm | that memory stayed in its lane | tenant:user:project scopes, so a write cannot cross a boundary |
| awdesk | that the agent is somewhere behind a browser tab | a tray icon, a face on your desktop, and the decision card that pops when it needs you |
| awnode | a vendor's cloud with every prompt | a local gateway routing to backends you chose |
| awgraph | that grep found everything | an AST + tree-sitter call graph an agent can traverse |
| awgit | that no one else is editing this file | a lease, refused at commit time if you do not hold it |
| awdelphi | one agent's confident take on a decision | the round trace, the anonymity, and who dissents |
| awclassify | a filename, a folder, or whoever last touched it | doc_type, visibility, audience and topics, with the evidence lines that decided each |
| awtoll | that your tooling is saving you context | the measured token cost of each tool call, and what the alternative cost |
| awseal | that the artifact came from who you think | an Ed25519 seal — the key that verifies is not the key that forges |
| awshare | that the download is intact | content-addressed bundles, verified on fetch |
| awnest | that there is a person on the other end | a verdict with evidence, where "we could not tell" is not "yes" |
| awrena | a leaderboard someone can edit, and votes nobody counted | a scored duel with both answers kept, and a result bound to them |
| awnboard | a share link anyone who sees it can use | an invitation addressed to one person, for one gate, revocable |
| awnix (you are here) | that the box is what you left it as | an immutable image you built, with atomic rollback |
| awrecover | that the restore worked | a restore that fully lands or does not land at all |
| awstorage | a du you ran last month, and a peers file that says 3 TB free | an inventory snapshot per node with a diff since the last one, and each tree classified re-fetchable or not |
| awrelay | a SaaS in the middle of your agents | findings, alerts and coordination over your own transport |
| awask | that anyone read the paragraph where you asked | the ask itself, with a button that steers the session that raised it |
| awmail | a mailbox somebody else can read | mail your agents send and receive over your own server |
| awswarm | that a model either fits your GPU or it doesn't run at all | a placement plan and an acquisition-probability estimate before you spend on a run |
| awfind | one vendor's idea of the web | results from whichever providers you configured |
| awbrowse | that the page said what you were told | the render, the DOM and the requests it made |
| awvoice | that a cloud vendor may hold your audio | a transcript and a wav from a service you host |
| awvision | a filename and a caption somebody wrote | what a model actually reports about the pixels |
| awscreen | a selector that was true when the page was written | the elements actually rendered, by what they look like |
| awbeads | that a layout your users built survives the next deploy | the arrangement as data you can read back, diff, and hand to another surface |
| awbonsai | that inference always means a request left the machine | a WebGPU model answering on the tab's own GPU, with a consent record logged before it ever loaded |
| gawbbonet | the model to keep a 300-message campaign coherent by itself | campaign facts recalled from scoped memory you can list and edit |
| aitherkvcache | a vendor's quantisation defaults | sub-byte KV cache kernels you can benchmark yourself |
| awrtifact | a hand-rolled split script and a hand-edited worker manifest | byte-verified parts in a release, served with Range + CORS, sizes asserted by a live gate |
| AitherZero | a pile of scripts nobody has numbered | numbered, discoverable automation with declarative playbooks |
| AitherConnect | what a page tells your browser to do | a federated search and desktop bridge you host |
| awreason | a confident paragraph | the phases it went through, and every tool call it made to get there |
| awrecurse | that everything you pasted in was actually read | which slices it opened, and what it concluded from each |
| awprism | the first explanation that fits | the ranked alternatives, and the observation that separates them |
| awrepl | what the agent believes the value is | the value, printed from the live session |
| awreport | that the report you pasted carried no token in it | a redacted report, and the duplicate it merged into instead of filing twice |
| awresearch | a summary of pages nobody opened | every claim against the source it came from |
| awfocus | twelve terminal tabs and a bad memory | one command that names every session, finds any transcript, and opens or steers the one you want |
| awgym | that a world model learned anything from the games it saw | transitions captured from real play, fed back, and the retrodiction score falling on grids it never saw |
| awpredict | a model because it trained without erroring | its prediction against a self-updating lookup, on the rows that are actually novel |
| awevolve | that your optimisation loop is finding anything | every version it kept, the score that version earned, and the edit that produced it |
| awsh | that you already know the name of the command | what it decided your line meant, before it acts on it |
| awmine | that a session's lesson survived the session | a row per outcome, a candidate per lesson, and the transcript line each one came from |
| awrise | that a scheduled agent ran at all, and ran exactly once | a durable record of every wake -- fired, skipped, overlapped or timed out -- each with its reason |
| awkno | that the docs site is up, or that you remember the family | the whole ecosystem in your terminal, with no network at all |
| awwall | that a service only talks to the hosts you think it talks to | an explicit egress allowlist, where a denial names the rule that denied it |
| awembed | a general-purpose embedder that has never seen your code | a held-out split of whole directories, scored teacher vs student vs int8 |
| awtax | a closed tax app's sealed file you can never read again | a plain, provider-neutral schema of every figure, with the page it came from |
| awsettings | that you will remember to re-approve the same thing on every box you work from | one profile, unioned rather than overwritten, with the credentials left behind |
| awavatar | a cloud 3D vendor's opaque task id | a manifest with a sha256, a licence and a rig-audit verdict per file |
awnix is the ground floor — A Linux you can hand to an agent — immutable base, capabilities included.
Every repository here is public. Each publishes an aither-manifest.json beside its page, so any surface can read every sibling's — the network is browsable from any node in it.
| repo | what it is | pages |
|---|---|---|
| awdk | Build AI agent fleets — 3 lines, any backend, local or cloud | docs |
| awskills | Portable agent skills — self-contained procedures an agent loads on demand | docs |
| awpack | First-party agent packs — the ones we build, versioned and installable on their own | docs |
| awm | A portable, scoped agent memory | docs |
| awdesk | Aither World Desk -- the desktop body of AitherOS Online: tray, avatars, decision cards, the Living Desktop as an overlay | docs |
| awnode | A lightweight local gateway — bridges your apps to the AI backends you chose | docs |
| awrun | A priority-aware queue and dispatcher for agentic runs and ad-hoc CI builds. It also judges whether the runner pool is big enough for the queue it is draining, and can ask a host to grow it -- reserving capacity is zero-sum, so a saturated pool needs more of it, not a different share of it | docs |
| awgraph | A semantic code graph for agents — AST + tree-sitter, call graphs | docs |
| awgit | Semantic version control on top of git — edit-ops and leases | docs |
| awdelphi | Anonymous multi-round expert panels — a converged answer with a trace | docs |
| awclassify | Classify any document -- what it is, who may read it, who it is for, what it is about | — |
| awtoll | What every tool call costs you in context, measured from your own transcripts | docs |
| awseal | Sign an artifact so a stranger can verify it | docs |
| awshare | Publish an artifact and fetch it back verified | docs |
| awdit | An append-only audit trail whose gaps are DETECTABLE | docs |
| awbac | Role-based access control that fails closed and explains itself | docs |
| awiam | Who is this caller? A directory and session store that fails honestly | docs |
| awtunnel | Reach a service that has no public address | docs |
| awnest | Prove there is a human before you let them into the nest | docs |
| awrena | Put two agents head to head and get a verdict you can check | docs |
| awnboard | A front gate you can put in front of anything, and hand someone the key to | docs |
| awnix (you are here) | A Linux you can hand to an agent — immutable base, capabilities included | docs |
| awrecover | Labelled snapshots with an all-or-nothing restore | docs |
| awstorage | Every drive on every node, indexed, classified and diffed -- so you can see what you own before you delete it | docs |
| awrelay | Portable agent messaging — findings, alerts, coordination | docs |
| awask | Your agent asks you a question — and acts on your answer | docs |
| awmail | Give an agent an email address — send, and actually receive | docs |
| awnet | The agentic web — agents host a mesh, and agents join one | docs |
| awswarm | Run one model too big for any single GPU across a pool of small ones | — |
| awfind | A portable search client — query, results, ranking | docs |
| awbrowse | A portable browser client — navigate, console, network, DOM, screenshot | docs |
| awvoice | Hear and speak — transcribe audio, synthesize a voice | docs |
| awvision | See an image — describe it, ask it a question, compare two | docs |
| awscreen | See this machine — what is on screen, and where to click it | docs |
| awkit | Render an agent panel from a tool result — one component, any React app | — |
| awbeads | A spatial canvas for a page — arrange things, connect them, and keep the arrangement | — |
| awbonsai | Run a real model in the visitor's own browser — no server round trip, no upload | — |
| awknowledge | How to run a coding agent so the result survives — the laws, with evidence | docs |
| awbrain | Your history as a wiki of linked markdown — claims pinned to the evidence | — |
| gawbbonet | GobboNet campaigns with a real agent brain — scoped memory, graph recall | docs |
| aitherkvcache | Near-optimal KV cache quantization for LLM inference — sub-byte compression | docs |
| awrtifact | Deliberately chunk artifacts into GitHub release assets — the productized aitherkvcache mirror lane | docs |
| AitherZero | PowerShell 7+ automation framework — numbered, self-describing scripts | docs |
| AitherConnect | Browser extension — federated AI search, page context, and the Living OS overlay | docs |
| awreason | A portable reasoning client — sessions, phases, thoughts, and the chain that produced the answer | docs |
| awrecurse | Answer a question over a context far larger than the window — recursively, with the trace kept | docs |
| awprism | Turn a failure into ranked hypotheses — and say what would confirm each one | docs |
| awrepl | A REPL an agent can actually use — state that survives between turns | docs |
| awreport | File a bug report that has already scrubbed your secrets and collapsed the duplicate | — |
| awresearch | Ask a research question, get a cited report you can check | docs |
| awfocus | See, search and steer every Claude session from one command | docs |
| awgym | An ARC training gym — a game a world model can watch, and six roles that play through it | docs |
| awpredict | Predict what your environment does next, and how surprised you were | docs |
| awevolve | Point an agent at a file and a command that scores it, and let it improve | — |
| awsh | Your terminal answers you -- type a question where a command would go | docs |
| awmine | Mine what your agents did -- outcomes, lessons and procedures out of the transcripts they left behind | — |
| awrise | Wake an agent on a schedule, let it do one thing, and put it back to sleep | docs |
| awkno | The man page for the Aither World — every brick, stack and law, offline | docs |
| awwall | Say what a workload may reach, and watch everything else fail closed | docs |
| awrouter | OpenRouter for your own fleet: pick a model backend by cost/latency/ capability, fail over, fit the context window, stream. Standalone, OpenAI-compatible, no Aither-specifics required to be valuable | — |
| awembed | Train an embedding model that knows your corpus, and prove it beats the big one | docs |
| awtax | Turn any tax PDF -- returns, W-2, 1099, statements, even scans -- into structured data you can check | docs |
| awflow | A deterministic workflow runtime — chain agent calls with journal replay and budget control | docs |
| awsettings | Your agent's permissions and config, following you to the next machine | docs |
| awavatar | One character spec in, a rigged, animated, multi-style avatar pack out | docs |