Xenolith Fleet OS is a minimal Linux appliance and control plane for kiosk and HMI devices — native Vulkan UI straight to the display, OTA for app and system, no per-device engine royalties.
60fps UI + ~150 MB image + fleet/OTA — one product instead of Qt + Yocto + Mender.
OEMs stitch together a GUI framework, a Yocto image, an OTA vendor and an MDM — four invoices, months of NRE, and per-device royalties that kill mid-volume economics.
Commercial GUI stacks and platform SDKs are unavailable or sanctioned for many manufacturers. Locked-down devices cannot meet LGPL relink obligations — and critical infrastructure needs trusted stacks.
Chromium kiosks burn >512 MB idle and crawl on Pi-class hardware. Android needs gigabytes and 30–60 s boots. Compositor stacks lose 30–40% of frame time before your UI draws a pixel.
One integrated path from a desktop Xenolith app to a fleet of immutable appliances — without a separate embedded toolchain or container runtime on the device.
Build and debug the same app on Windows, Linux or macOS with the Xenolith SDK.
Produce a bootable image — rootfs + kernel + your binary — without a Yocto consulting project.
One native aarch64 binary presents straight to DRM/KMS via Vulkan. No compositor, no container.
Push app updates without reboot; push system images with A/B slots and automatic rollback.
Desktop equals device. The Linux aarch64 binary is the same application you already ran on the desktop — not a port.
Immutable Linux with integrity, direct display output, and a footprint that fits cheap flash and tight RAM budgets.
Vulkan presents through VK_KHR_display — no X11, Wayland or compositor layer between your scene graph and the panel.
squashfs root with dm-verity. Read-only system partition; app and fleet state live on a separate data volume.
Hardware Vulkan (V3DV on Pi) for 60 fps, or lavapipe for QEMU and boards without mature drivers — one ICD per image variant.
Payload is a Xenolith ELF straight into KMS — not a container, snap or browser. App swap is a file copy.
A device agent plus operator console for the full appliance lifecycle: provision, heartbeat, OTA, console, decommission.
Push a new ELF into the data slot and restart the kiosk process — no reboot, no full image rebuild.
Write a squashfs to the inactive A/B slot, reboot, verify, and roll back automatically on boot failure.
Devices check in with status and metrics so the console shows what is online, stale or failing.
Web dashboard with device list, deploy actions and a remote SSH terminal for diagnosis.
The aarch64 Linux binary is the same Xenolith app you debug on the desktop — no emulator gap, no device-only rewrite.
After the OS is flashed, replace the kiosk binary over SSH or FAT in seconds. Full OS rebuild only when the base image changes.
xl-builder / flashing SDK turns rootfs + kernel + app into a bootable SD/USB image — minutes, not a 3–6 month Yocto project.
AGENTS and SKILLS ship with the stack so coding agents know the build system, deploy path and fleet workflows out of the box.
Optional remote rendering over QUIC: the terminal draws pixels; application logic and sensitive data stay on the server — for payment kiosks, ATMs and medical terminals.
Experimental — scene serialization and transport exist; not the primary fleet path yet.
Same golden-image pattern as mature fleets — differentiation is the load model and the integrated GUI stack.
| Xenolith Fleet OS | Qt / Boot to Qt | Chromium kiosk | Android + MDM | balena / Torizon | |
|---|---|---|---|---|---|
| UI model | Native Vulkan → KMS | Qt + compositor | Browser | Android UI | Containerized app |
| Image size | ~120–150 MB | GB-class Yocto | GB-class | 2–4 GB+ | Container layers |
| Engine royalty | $0 | Per-device / seat | $0 | $0 | N/A |
| Fleet / OTA | Built-in | Add Mender etc. | DIY / MDM | MDM subscription | Strong |
| Desktop = device | Yes | No | No | No | Partial |
Kiosks, checkout terminals and municipal machines that need snappy UI on budget ARM boards.
Operator panels where GPU UI and a trusted software stack matter more than a desktop OS.
Reliable playback without a Chromium memory leak and a nightly cron restart.
Outdoor and semi-outdoor appliances with tight BOM, flash and boot-time budgets.
Payment and medical use cases that prefer thin-client remote rendering so data never rests on the device.
Manufacturers who need a sovereign toolchain path — own LLVM toolchains, GOST crypto in the stack, registry-ready roadmap.
We'd rather show measured results than oversell. Here is what runs today versus what is still being productized.
Bootable images with V3DV (60 fps) and lavapipe variants; immutable root and kiosk app slot verified on hardware.
Push a new binary without reflashing the OS — over the fleet path or direct SSH/FAT swap for developers.
Device registry, heartbeat, UpdateApp/UpdateSystem, web console and QEMU multi-device demo — hardening toward production PKI.
Mutual-TLS device portal, canary rollouts, and boot-to-interactive targets (including 1–2 s instant-on goals).
For OEM and integrator teams building kiosks, HMI panels and signage fleets who want one stack for UI, image and OTA — without per-device engine royalties. Open engine underneath; Fleet OS for the appliance lifecycle.