Technical Documentation

Overview

Alfred Linux is a complete operating system built from the ground up with AI as the primary user interface. Based on Debian Trixie (13), it ships the full Linux desktop experience plus sixteen integrated AI-native build hooks — including three dedicated security hooks delivering 32 hardening modules — that no other distribution includes.

Alfred Linux is not a Linux distribution with a chatbot bolted on. The AI is integrated at the operating system level — from voice-driven shell interaction to the development environment to the browser. Every component was chosen and configured to serve the mission: your voice is the command line.

What Ships in v4.0

• Alfred Desktop Environment — XFCE4 with custom theming, Arc dark theme, Papirus icons, JetBrains Mono font, and branded Plymouth boot splash
• Alfred Browser — Built on Tauri + WebKitGTK. 4.7 MB. Zero telemetry, zero tracking. Replaces Firefox-ESR entirely
• Alfred IDE — full VS Code-compatible IDE (powered by code-server 4.114.0) with the Alfred Commander extension pre-installed. Full VS Code in the browser at port 8443
• Alfred Voice — Kokoro TTS engine with PyTorch CPU backend, spaCy NLP, and a welcome greeting on first boot
• Alfred Search — Meilisearch local search engine for offline-first, instant search across all local content
• Calamares Installer — Full graphical disk installer with v4.0 branding, custom slideshow, and encrypted disk support
• Welcome App — 7-page first-boot wizard (Python/Tk) for voice setup, WiFi config, tool launcher, P2P seeding opt-in, and keyboard shortcuts
• Alfred Store — Flatpak-powered app center with 6 curated categories, search, one-click install, and threaded updates
• Voice 2.0 Wake Word — Always-on “Hey Alfred” detection via openWakeWord. Systemd service with configurable threshold
• alfred-update & alfred-info — CLI tools for one-command system updates (APT + Flatpak + Alfred version check) and branded system info panel

Kernel Deep-Dive

Alfred Linux 4.0 RC8 ships Linux kernel 7.0.0-rc7, custom-compiled from Linus Torvalds' mainline source tree. This makes Alfred Linux the first operating system distribution in the world to ship kernel 7. Released by Torvalds on April 5, 2026, kernel 7.0 is the first major version bump since 6.0 (October 2022).

What Kernel 7.0 Brings

• 3 New Hardware Mitigations (Kernel 7 Exclusive) — ITS (Indirect Target Selection), TSA (Transient Scheduler Attacks), and VMSCAPE (VM Escape) — not available in ANY 6.x kernel.
• 24 Total CPU Vulnerability Mitigations — Spectre v1/v2/BHI, Meltdown (PTI), MDS, TAA, L1TF, SRBDS, SRSO, RFDS, GDS, Retbleed, MMIO, SSB, SLS, Call Depth Tracking, Retpoline, IBPB/IBRS, plus the 3 new ones.
• Expanded Rust-in-Kernel — More kernel subsystems in Rust for memory safety.
• EEVDF Scheduler Refinements — Better latency and throughput on multi-core machines.
• Latest Hardware Support — Intel Xe2, AMD RDNA4, NVIDIA 570+, WiFi 7, USB4, Thunderbolt 5, PCIe Gen 6.

Alfred Linux Security Hardening (12 Gaps Patched)

The default kernel 7.0 config ships with 12 security gaps that Alfred Linux patches at boot. No other consumer distro patches all 12:

Additional Hardening Layers

• 16 Boot Parameters — lockdown=integrity nohibernate debugfs=off io_uring_disabled=2 tsx=off slab_nomerge page_alloc.shuffle=1 iommu.strict=1 vsyscall=none and more
• 40+ Sysctl Rules — ASLR, kptr_restrict=2, dmesg_restrict, perf paranoid=3, BPF JIT hardening, kexec disabled, SysRq disabled, userfaultfd restricted, tty ldisc locked
• 30+ Module Blacklist — DCCP, SCTP, RDS, TIPC, Firewire, Thunderbolt, cramfs, hfs, freevxfs, jffs2, appletalk, IPX, and more
• nftables Firewall — Drop-by-default, rate-limited SSH (10/min), rate-limited ICMP (5/sec), full audit logging
• AppArmor + Fail2ban + auditd — Mandatory access control, SSH brute-force 3-strike 24h ban, comprehensive audit trail
• Secure Mounts — /tmp and /dev/shm: noexec, nosuid, nodev
• Core Dumps Disabled — Hard limit 0, kernel.core_pattern=/bin/false
• Auto-generated IDE Passwords — Each session gets a unique random password, no default credentials

Previous Kernel: 6.12.74 (RC4–RC6)

Alfred Linux v4.0 RC4 through RC6 shipped on Linux kernel 6.12.74 from the Debian Trixie security repositories — a Longterm release with 74 rounds of Debian kernel team security patches. RC7 leapfrogged to kernel 7.0 compiled from source, making Alfred the first distro on kernel 7.

The Linux Kernel Landscape (April 2026)

To understand where Alfred Linux sits in the kernel world, here is the full landscape of active Linux kernel branches as of April 2026:

Kernel Upgrade Roadmap

Alfred Linux is now on kernel 7.0.0-rc7 — the first distro on earth to ship kernel 7. Here's the full trajectory:

What a Newer Kernel Gets Us

• Better Hardware Support — Every kernel release adds hundreds of new device drivers. Latest NVIDIA, AMD, Intel, Qualcomm, and Broadcom hardware. WiFi 7, USB4, Thunderbolt 5, PCIe Gen 5 NVMe.
• Performance Gains — The kernel scheduler (EEVDF in 6.6+), memory management (MGLRU), and I/O subsystem improve substantially with each release. 6.12+ benchmarks show 5-15% improvements over 6.1 in many workloads.
• Security Features — Newer kernels include improved address-space randomization, better speculative execution mitigations, shadow stacks (Intel CET), and Rust-based kernel modules for memory safety.
• Rust in the Kernel — Starting with 6.1, the kernel supports Rust as a second language alongside C. This is revolutionary for memory safety. Each newer version expands Rust support significantly.
• eBPF Improvements — Extended BPF for tracing, security, and networking gets more powerful with each release, enabling better Alfred-level system monitoring and AI-driven kernel optimization.

Build History

Alfred Linux v2.0 was developed through a rigorous incremental build pipeline. Each build added one major component and was tested before the next layer was added. Here is the complete build record:

v1.0 — Foundation (14 builds)

The original Alfred Linux v1.0 went through 14 iterative builds to establish the base operating system, desktop environment, and basic voice integration. The final v1.0 ISO was 1.5 GB and proved the concept: a bootable Linux desktop with AI voice integration.

v2.0 — Full Stack (9+ builds)

v4.0 — “The People’s OS” (Trixie Rebase + 4 New Features)

The Boot Fix Story

RC1 and RC2 were successfully built but contained a critical boot defect that was discovered during ISO inspection: the bootloader referenced /live/vmlinuz and /live/initrd.img, but the ISO only contained the versioned files (vmlinuz-6.1.0-44-amd64). This meant the ISOs would fail to boot on any hardware.

The fix was a build hook that runs as the absolute last step (hook #9999) in the chroot phase, creating copies of the kernel and initramfs with the generic names that the bootloader expects. RC3 is the first build with this fix and the latest Debian security patches (kernel 6.1.0-44, including WebKit, OpenSSL, ImageMagick, and GStreamer security updates).

Bundled Components

Every component is pre-installed and configured. No package manager needed for the core experience.

New in v4.0

Security Stack

Build System

Alfred Linux ISOs are built using Debian live-build, the same system used to produce official Debian Live images. The build process is fully automated and reproducible.

Build Pipeline

Build Infrastructure

System Specifications

ISO Details

Minimum Requirements

Pre-installed Package Highlights

Security Posture

Alfred Linux ships 32 security modules across 3 dedicated build hooks. Every default is chosen for defense, not convenience. RC8 delivers enterprise-grade hardening out of the box.

Hook 0160 — Alfred Security (21 Modules)

• Kernel sysctl hardening — 45+ CIS Level 2 rules: ASLR=2, symlink/hardlink protection, SYN cookies, ICMP redirect blocking, source routing disabled, core dumps off
• Kernel lockdown — integrity mode enforced at boot
• AppArmor — Mandatory access control enforced with custom profiles for Alfred IDE and Meilisearch
• Unattended-upgrades — Automatic security patches enabled by default
• Fail2ban — SSH brute-force protection (3 attempts → 24-hour ban)
• Auditd — 30+ immutable audit rules for system calls, file access, auth events
• DNS-over-TLS — Quad9 (9.9.9.9) + Cloudflare (1.1.1.1) encrypted DNS via systemd-resolved
• USB security — USBGuard-style logging + alfred-usb-storage toggle tool
• Module blacklisting — firewire, dccp, sctp, cramfs, freevxfs, hfs, jffs2, udf, thunderbolt DMA
• PAM hardening — 10-character minimum, 3 character classes, account lockout after failed attempts
• AIDE — File integrity monitoring with daily cron check + alfred-aide-init baseline tool
• ClamAV — Antivirus engine with weekly scheduled scan via alfred-scan
• Rootkit detection — rkhunter + chkrootkit with weekly cron scans
• hidepid=2 — Users cannot see other users' processes
• Secure mounts — /tmp with noexec,nosuid,nodev; /var/tmp and /dev/shm hardened
• Login banners — Legal warning banners on console and SSH
• Core dumps disabled — via sysctl + limits.conf + systemd
• Cron/at lockdown — Root-only access to scheduled tasks
• Compiler restriction — gcc/g++ restricted to 'dev' group only
• NTS time sync — Chrony with Network Time Security (authenticated NTP)
• alfred-security-status — CLI dashboard showing status of all 21 modules

Hook 0165 — Alfred Network Hardening (7 Modules)

• MAC randomization — WiFi and Ethernet interfaces use random MAC addresses per-connection
• nftables firewall — Default-deny ingress, allow established + ICMP + loopback only
• TCP wrappers — hosts.deny ALL:ALL, hosts.allow sshd from localhost
• Port scan defense — nftables rate-limiting rules against SYN flood and port scanning
• Wireless hardening — WPS disabled, strong WPA supplicant defaults
• SSH strong ciphers — chacha20-poly1305, aes256-gcm only; ed25519 + sntrup761x25519 key exchange
• alfred-network-status — CLI dashboard showing firewall, MAC, SSH cipher status

Hook 0170 — Full Disk Encryption (4 Modules)

• LUKS2 support — cryptsetup + cryptsetup-initramfs installed and configured
• Strong defaults — aes-xts-plain64, sha512, 4096-bit key, argon2id KDF
• Calamares FDE — enableLuksAutomatedPartitioning checkbox enabled in installer
• alfred-encrypt-status — CLI tool to check encryption status of all block devices

Foundational Security

• Zero Telemetry — No phone-home, no crash reporting, no usage analytics. The OS does not contact any server unless you tell it to.
• 24 CPU mitigations — Spectre v1/v2/BHI, Meltdown, MDS, TAA, MMIO, RFDS, SRBDS, L1TF, SSB, ITS, TSA, VMSCAPE compiled in
• 16 boot parameters — init_on_alloc, init_on_free, slab_nomerge, pti=on, lockdown=integrity, debugfs=off, io_uring_disabled, tsx=off, vsyscall=none
• WireGuard Ready — VPN kernel module pre-loaded for encrypted mesh networking
• Auditable Build — Every ISO is built from a documented script. SHA-256 + BLAKE3 checksums are published for every release

Download & Verify

Alfred Linux Mobile (Android)

Alfred Linux runs on Android phones and tablets — Samsung Galaxy S26 Ultra, Pixel, OnePlus, any device running Android 12+. No root required. Uses Termux + proot-distro to run a full Debian Bookworm environment with all Alfred components.

Quick Install

Requirements

• Android 12+ (Samsung One UI 4+, Pixel 6+, etc.)
• 4 GB free storage for the full Alfred environment
• Termux from F-Droid (the Google Play version is deprecated)
• Optional: Termux:Widget for home screen shortcuts
• Optional: Samsung DeX for desktop-mode IDE experience

Samsung DeX Integration

When connected to an external display via USB-C or Miracast, Samsung DeX provides a desktop-like environment. Launch alfred-ide, open your browser, and you have a full VS Code IDE on a large screen — powered entirely by your phone. Alfred IDE runs on code-server, the same engine powering VS Code for the Web at major companies. The Samsung S26 Ultra with 12GB RAM and Snapdragon 8 Elite runs it smoothly.

Architecture Notes

Mobile Alfred Linux runs on ARM64 (aarch64) inside a proot container. The Debian userspace is real — you can install any Debian package with apt. The kernel is Android's, but everything above it is standard Debian Bookworm. This means:

• Full apt package manager — install anything from Debian repos
• Python, Node.js, Ruby, Go, Rust — all work natively on ARM64
• No root needed — proot translates system calls without kernel modifications
• Persistent storage — your files survive Termux restarts
• Network access — uses Android's network stack transparently

Contributing

Alfred Linux is open source under the AGPL-3.0 license. Contributions are welcome and rewarded with GSM tokens.

How to Contribute

• Report Bugs — Test the ISO and report any issues. Boot failures, hardware incompatibilities, broken features. 10-50 GSM per confirmed bug.
• Submit Patches — Fix bugs or add features via pull requests. 100-1,000 GSM per merged feature.
• Write Documentation — Help expand this documentation, write tutorials, create videos. 50-500 GSM per contribution.
• Test Hardware — Boot Alfred Linux on your hardware and report compatibility. We need coverage across laptops, desktops, and servers.
• Translate — Help bring Alfred Linux to your language. Localization is a priority for v3.0.

Build It Yourself

What's Next

Alfred Linux v4.0 is the fully-loaded foundation. The next milestones are:

• ARM64 build — Raspberry Pi 4/5 and Apple Silicon support
• Wayland desktop — XFCE on Wayland (wlroots) for the Alfred Desktop Environment
• Whisper STT integration — Voice input via OpenAI Whisper running locally on GPU
• Custom wake word model — Train a dedicated “Hey Alfred” model instead of using the built-in closest match
• GSM wallet & mining — Built-in token wallet and compute contribution system
• Secure Boot signing — Microsoft-signed shim for Secure Boot compatibility
• Auto-update channel — alfred-update with delta/OTA patches instead of full ISO rebuilds