x0ne OS / Handbook / Cloud and security

Security model

Works today (measured 2026-10-09): no default account, root locked, no SSH server, nothing listening, no private key in the images.

Planned — next: release keys, Secure Boot, signed images and SBOMs per release.

Agents build and test. Humans hold the keys and sign. Nothing is open until you open it.

The full list of hardening points, each with a command to verify it and its limit: Hardening.

Keys stay with humans

Offline master key. Signing subkey on a hardware token, held by a human.
The boot key is separate from the repository key.
No agent ever holds a key, a token or a passphrase.
Today only a throwaway test key exists. Nothing signed with it is published.

No default account

Images ship with root locked and no user. You create the first account. See First boot and your account.

No open port

No SSH server is installed. At boot, x0ne OS prints what listens: tcp=0 udp=0.

check on a running system

$ ss -tulpn

Expected: no listening socket, unless you installed a service.

Security updates

The VM images install Debian security updates daily, from trixie-security and the x0ne stable channel only, without a reboot (unattended-upgrades, tested 2026-10-12). The container image does not.

Verifiable builds

Builds run in rootless containers, from Debian images pinned by digest.
Packages are reproducible: same input, byte-identical .deb.
The build writes an SPDX SBOM for each image. Released images will ship it.
Tests scan the repository for secrets, internal names and unsigned changes.

Repository

apt refuses a rogue key, a tampered index, a tampered package and an expired Release file. The Release file is valid for seven days. These were tested on 2026-10-09.

Report a vulnerability

Write to contact@x0ne.co. Say what you found and how to reproduce it. Please do not publish it before a fix ships.

How to undo

Each setting here is a default. Changing it is your choice, made with sudo.