The story of Zainium OS

Every Linux distribution starts because something bothered someone. For Zainium OS it was two simple things. On most systems you can not look at a file and say who it belongs to. And one bad moment as root can leave you with a computer that does not start.

Zainium OS is what happened when we stopped working around these problems and started again from an empty folder.

It started with small tools

Ali Zain started the project on 11 January 2026. At first it was not a distribution at all. It was a few small experiments in Rust, like an init system and a safety net for immutable systems. But each one hit the same wall. You can improve small parts of Linux, but the system keeps the same shape, with /usr in the middle and everything mixed inside it.

Over the summer these pieces became one project. The package manager, zex, came in July. In August came sys_resolver, which helps normal software run without /usr, then elevate-pam and the first base packages. By then the goal was clear: a complete system, built from source, not based on any other distribution.

Saying "from scratch" is easy. Doing it is slow. Every base package has its own recipe and is built with our own compiler toolchain. Today the base has 173 packages, including the full COSMIC 1.11.0 desktop.

Removing /usr

The biggest decision was also the strangest. Zainium OS has no /usr, /etc, /bin or /lib at the root. They are not even symlinks. The whole system lives inside one folder, /overlayer, and it is split into layers: the base, the software you install, and the boot files. Each layer has one owner. If you delete all your installed software, the base still boots.

Most software expects the old paths, so this idea should have failed. sys_resolver is the reason it did not. If a path exists, it does nothing. If a program asks for a path that is not there, it looks in the right place instead. So /usr/bin/env still works on a system with no /usr. It can not help static and setuid programs, but it is enough for most software.

On 28 October 2026 we published this layout as an open specification, the Dualayer Hierarchy Standard, or DHS. The name means two things: a system made of layers, and two C libraries, musl and glibc, living side by side. The base uses musl. glibc can be added next to it, in its own folder, so software built for either one can run and they never fight.

Our own boot program

In October we also wrote what runs before the system starts. quantra-ramfs is one small Rust program, with no shell and no busybox. It finds the disk, applies any waiting upgrade, and undoes that upgrade if something goes wrong. Then it seals the system files and starts everything else.

The kernel patch

We wanted two things that do not normally go together: a base that even root can not change, and apps that install without a reboot. Normal OverlayFS can not do this. So we patched the kernel and added a new mount option called sealed. A sealed overlay can never be made writable, not even by root, but the package manager can still add software on top of it while the system runs.

That sounds simple, but it was not. The kernel remembers what it has looked up, and it does not expect files to change underneath it. The last week before release showed us how hard this really was.

The last week

We thought the ISO was ready. Then we tried it on a real laptop. After installing one package, ls and bash stopped working and the screen showed Stale file handle. The folder that holds every program had changed while programs from it were running, and the kernel would not accept that. It needed a kernel fix.

Then we found that an upgrade could keep showing the old file. That needed another fix. A test with a small harmless script showed that a file in the top layer could hide a program in the base. So now the base always wins in the folders that hold programs and libraries.

There was more. A change to musl broke users and DNS. A package recipe damaged the bash program. An upgrade quietly removed a permission from the password helper, and the lock screen started to refuse every correct password. Even the boot splash turned into plain text for a while, because of how the boot image was packed.

We found each of these bugs by using the system every day, and the system is better because of them. Boot got faster along the way too. A base upgrade that took about a minute is now much shorter, and the check at every boot went from 2.4 seconds to 0.65 seconds on our test laptop.

Where it stands today

The first public ISO is out. It is 2 GB, with Linux 7.3.1 and COSMIC 1.11.0, and it includes zex, elevate, quantra-ramfs and 175 of our own command line tools. It is a rolling release, so you install it once and it stays current.

It is also young, and we want to be honest about that. It has not been tested on much hardware yet. It needs a CPU with AVX2. And root can still change the settings in etc, because those have to stay writable. You can read exactly what we promise, and what we do not, in how the system protects itself.

What comes next

Next we need more people and more hardware. After that, we want a way to run software from other distributions in its own space, with its own dependencies, without touching the base.

If this sounds interesting, download Zainium OS, try to break it, and tell us what happened. Everything is open: the source is on GitHub.