x0ne OS / Handbook / Run x0ne OS

Run from a USB stick

Planned — next. The live ISO boots from an emulated USB stick with BIOS, UEFI and UEFI Secure Boot, three times out of three in each mode (measured 2026-10-12). The download is not published yet.

Write the live ISO to a USB stick and boot a PC from it. x0ne OS then runs from the stick and from RAM.

Prerequisites

A 64-bit PC (amd64). Macs with Apple silicon cannot run it.
A USB stick of 1 GB or more. Everything on it is erased.
x0ne-os-latest-amd64.iso (232 MiB), SHA256SUMS and SHA256SUMS.sig, from the same place.

Download and verify

Verify before you write the stick: a bad signature means delete the file. The key and its fingerprint are in Getting x0ne OS.

verify the ISO planned

$ gpg --verify SHA256SUMS.sig SHA256SUMS
$ sha256sum --check --ignore-missing SHA256SUMS
x0ne-os-latest-amd64.iso: OK

Write the stick on Linux

Find the stick: plug it in, then look for the disk with usb in the TRAN column. Write to the whole disk, /dev/sdX, never to a partition such as /dev/sdX1. Unmount it first.

write with dd

$ lsblk -d -o NAME,SIZE,MODEL,TRAN
$ sudo umount /dev/sdX?*
$ sudo dd if=x0ne-os-latest-amd64.iso of=/dev/sdX bs=16M status=progress oflag=sync

A wrong device name erases that disk, without a question. oflag=sync makes dd return only once the data is on the stick. Source: Debian CD FAQ, Debian installation guide, 4.3.

With GNOME Disks: select the stick, open the drive menu, choose Restore Disk Image, pick the ISO, then Start Restoring and Restore. Source: Tails, install from Linux.

Write the stick on macOS

Run diskutil list before and after plugging the stick in: the new disk is the stick. Use /dev/rdiskN, the raw device, to write.

write with dd

$ diskutil list
$ diskutil unmountDisk /dev/diskN
$ sudo dd if=x0ne-os-latest-amd64.iso of=/dev/rdiskN bs=4m

When macOS then says the disk is not readable, choose Eject. A graphical option: balenaEtcher. Source: Kali Linux documentation.

Write the stick on Windows

Rufus: select the ISO and the stick. Rufus detects an ISOHybrid image and asks how to write it: choose Write in DD Image mode. Source: Rufus FAQ.
USBImager or balenaEtcher: select the ISO, then the stick, then write. Source: Debian CD FAQ.

Use DD mode: it writes the image as is, which is what the tests boot. Rufus ISO mode copies files instead; it is not tested. After writing, Windows may offer to format the stick: decline.

Boot the stick

Plug the stick in, start the PC, and open its boot menu. The key depends on the vendor, often F12, F11, F8 or Esc. Pick the USB entry, in UEFI mode if the menu offers both.

The x0ne OS menu shows x0ne OS live, started after one second. Press s for x0ne OS live (serial console).

On first boot, x0ne OS asks for a user name and a password of 12 characters or more. See First boot and your account.

Firmware	Measured, 2026-10-12
BIOS (legacy)	Boots. First prompt in 8.4 s
UEFI, Secure Boot off	Boots. First prompt in 9.0 s
UEFI, Secure Boot on, Microsoft keys	Boots, Secure Boot on. First prompt in 8.9 s

QEMU with KVM, the ISO written to an 8 GiB USB disk on an xHCI controller; SeaBIOS, then OVMF. Median of three boots, from power-on to the first prompt. Not tested yet: real PCs, real sticks.

Secure Boot

The boot chain is Debian's: shim, signed by Microsoft, then GRUB and the kernel, signed by Debian. Measured on the image: shim carries two Microsoft signatures, one from the Microsoft Corporation UEFI CA 2011, one from the Microsoft UEFI CA 2023. GRUB is signed by Debian Secure Boot Signer 2022.

Some PCs do not trust Microsoft's third-party CA out of the box, Secured-core PCs among them. If the stick does not start with Secure Boot on, enable Allow Microsoft 3rd Party UEFI CA in the firmware settings, or turn Secure Boot off. Source: The Register, 2022.

No persistence

Everything you write goes to RAM and is lost at shutdown: files, settings, your account, cloud credentials. Measured: the root file system is an overlay on a tmpfs, and the kernel line has no persistence option.

Measured in QEMU: after a boot, the stick holds the same bytes as the ISO, and nothing is written past the image. Persistence is not in this version.

How to verify

Before writing: sha256sum --check prints OK.
After writing, on Linux: sudo cmp -n "$(stat -c %s x0ne-os-latest-amd64.iso)" x0ne-os-latest-amd64.iso /dev/sdX prints nothing.
Booted: findmnt /run/live/medium shows the stick.

How to undo

Shut down and unplug the stick. To reuse the stick for files, delete its partitions and create a new one, with GNOME Disks, Disk Utility or Windows Disk Management.