This project is a linux 7.x kernel image builder for macOS.
It does provide a baseline configuration and patches that are specifically tailored for use in the context of Apple VZ, focused on performance and minimal footprint.
As such, the primary intended consumer of these kernels is Ossein, though it is not limited to this, as users can point to their own configuration, and elect to different patches to build any kernel as they see fit.
The baseline setup produces kernel images under 10MB, that are outperforming or tie-ing kernels from other macOS container runtimes.
- macOS 26+
- aqua installed
TBD
Stock kernel configuration fragments live under kernel/config.
Patches live under kernel/patches.
The kernel builder logic is in cmd/ossein-kernel/main.go, and the actual in-container build script is in cmd/ossein-kernel/build.sh
The kernel is the product; the builder and init are not published. A release is cut locally: the build boots a real VM on Virtualization.framework, which no stock CI runner can, so there is no release workflow.
just release-kernel vX.Y.Z.N
Run it from a clean tree. The tag is the rebuild tag of limen's book (book/forks.md):
X.Y.Z must be the upstream version pinned in pins.yaml (the recipe refuses anything
else); N is the rebuild of that upstream (config, patch or toolchain change), from 1, reset
to 1 on a source bump. No -suffix: a hyphen-suffixed tag parses as a SemVer pre-release,
sorts before X.Y.Z, and loses GitHub's "Latest"; a fourth segment sorts after. The kernel's
uname -r names the release as X.Y.Z-ossein.N. The recipe builds and boot-verifies the
kernel, signs the checksums keyless with cosign (a browser opens for the OIDC login), creates
a signed git tag, pushes it, and publishes kernel-arm64, perf-arm64, SHA256SUMS and
SHA256SUMS.cosign.bundle to a GitHub release.
Consumers verify a release with:
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^(142371135\+[^@]+@users\.noreply\.github\.com|apostasie@farcloser\.world)$' \
--certificate-oidc-issuer https://github.com/login/oauth SHA256SUMS
shasum -a 256 -c SHA256SUMS