Amutable OS proposes image-based Linux with no shell, no SSH, no interpreters by default

Lennart Poettering, Michael Vogt, and Joaquim Rocha have published a technical overview of Amutable Operating System (AOS), a new image-based Linux distribution built around extreme security minimization. The system eliminates entire categories of attack vectors by shipping without a UNIX shell, without SSH remote access, and without language interpreters such as Python or Perl on most nodes. All deployable images must carry dm-Verity data signed by keys in a dedicated Verity keyring, preventing activation of unsigned or tampered system images.

The design represents a significant departure from conventional Linux distribution architecture, trading administrative flexibility for cryptographic integrity and reduced exploitable surface. By treating the operating system as an immutable, signed image rather than a mutable package-managed system, AOS aims to serve environments where security properties must be mechanically enforceable rather than administratively promised.

AOS security architecture and image enforcement

• No Shell / No SSH / No Interpreters: AOS removes the UNIX shell, SSH daemon, and language interpreters (Python, Perl, etc.) from default installations, eliminating interactive attack vectors and script-based exploitation paths on nodes that do not require administrative access.
• Signed dm-Verity Images Only: The system activates only images carrying dm-Verity integrity data signed by keys present in the kernel's Verity keyring, cryptographically binding booted images to approved publisher identities.
• Image-Based Deployment Model: AOS abandons traditional package management in favor of atomic, immutable system images, enabling reproducible system states and preventing runtime modification of operating system components.
• Seven Essential Security Properties: The architecture defines seven mandatory security properties (of which the source details the first two explicitly), suggesting a comprehensive hardening framework beyond conventional Linux security mechanisms.

Why it matters

AOS enters a growing field of immutable Linux distributions alongside Fedora Silverblue, openSUSE MicroOS, and Vanilla OS, but pushes further toward security-minimalist server and edge deployments by removing shells and interpreters entirely. For Linux distribution architects and security engineers, the project offers a concrete reference for how far image-based integrity enforcement can extend beyond current container-optimized or transactional-update systems. If adopted, AOS could influence expectations for IoT, edge, and infrastructure node hardening where supply-chain integrity and reduced attack surface outweigh traditional administrative convenience.