Published release of the project Asterinas 0.19, developing a kernel written in the Rust language and intended for use in general-purpose operating systems. The kernel provides an ABI (Application Binary Interface) that is compatible with the Linux kernel and can be used instead. In parallel, the Asterinas NixOS distribution is being developed, combining the Asterinas kernel with the NixOS system environment. The project code has been developed since 2022 and distributed under the MPL (Mozilla Public License).
Currently, more than 240 Linux system calls are implemented in the kernel. In the Asterinas NixOS distribution, more than 100 packages from NixOS have been verified to work on top of the Asterinas kernel. Supported packages include: Xfce, Firefox, bash, systemd, Podman, QEMU, rsync, Apache httpd, nginx, SQLite, Redis, Clang, GCC, Go, Lua, Node.js, OpenJDK, Perl, PHP, Python, Ruby, Rust, Git, FFmpeg, PyTorch, TensorFlow, Ollama and Codex.
In the kernel Full support for the x86-64 architecture is provided, partial support for ARM64, RISC-V 64 and x86-64 with isolation based on Intel TDX, as well as initial support for the LoongArch 64 architecture. Priority areas of application include systems based on the Linux ABI, but requiring a higher level of security. For example, Asterinas is proposed to be used to form a system environment of protected virtual machines, for the isolation of which technologies such as ARM CCA, AMD SEV and Intel TDX are used, as well as on the side of the host system that runs containers.
To reduce the likelihood of errors when working with memory, which are the main source of the most dangerous vulnerabilities, when writing Asterinas, the Rust language and the tactics of limited use of unsafe blocks are used. The kernel is built using the framekernel architecture, which attempts to combine the isolation capabilities of microkernels with the efficiency of monolithic kernels.
The kernel components in Asterinas are placed in a common address space, and security is achieved at the level of logical separation of safe code and code in which problems may arise security. The core is split into two parts written in Rust: OS Framework and OS Services. The use of unsafe blocks is prohibited in OS Services, and all low-level operations that require code execution in unsafe blocks are placed in the OS Framework and are available only through the high-level API. All system calls, file systems and drivers are implemented at the OS Services level and cannot include unsafe blocks.
To develop system services and kernel modules, the OSDK