awnix & the aw family
A Linux you can hand to an agent — and the tools that replace something you would otherwise have to trust with something you can check.
A Linux you can hand to an agent.
Not a distro with an assistant bolted on. A bootable, immutable base for machines where software writes software — and where you still need to know what happened, undo it, and prove it.
podman build -t awnix:latest -f Containerfile .That is the install. The OS is the container image.
Give an agent real access and you inherit four problems
Not eventually. On day one.
On someone else's platform, all four are handled by trusting the platform. awnix is the other bet: you can verify everything, so you have to trust nothing.
The aw family
awnix is the ground floor. The rest stand alone — each installs on its own, works offline, and needs no account. Every one replaces something you would otherwise have to trust with something you can check.
instead of trusting that the box is what you left it as
an immutable image you built, with atomic rollback
instead of trusting a vendor cloud with every prompt
a local gateway routing to backends you chose
instead of trusting that no one else is editing this file
a lease, refused at commit time if you do not hold it
instead of trusting that grep found everything
an AST + tree-sitter call graph an agent can traverse
instead of trusting that the artifact came from who you think
an Ed25519 seal — the key that verifies is not the key that forges
instead of trusting that the download is intact
content-addressed bundles, verified on fetch
instead of trusting a SaaS in the middle of your agents
findings, alerts and coordination over your own transport
instead of trusting that memory stayed in its lane
tenant:user:project scopes, so a write cannot cross a boundary
instead of trusting that the restore worked
a restore that fully lands or does not land at all
Four opinions, each learned the expensive way
awnix ships unit templates, not units — a base image that hands you a fleet has already decided what you are running. The template carries these.
state under /varAn immutable /usr loses anything else on the next update.a real healthcheckWithout one, a wedged container looks exactly like a healthy one to every supervisor on the box.Restart=unless-stoppedNothing revives an exited container — and this still honours a manual stop.After=network-online.targetThe difference between a network that is configured and one that merely exists.Make it bootable
One image, every format — AMI, ISO, qcow2, vmdk, raw.
podman run --rm -it --privileged \
-v /var/lib/containers/storage:/var/lib/containers/storage \
-v "$PWD/output":/output \
quay.io/centos-bootc/bootc-image-builder:latest \
--type ami --local awnix:latestThen bootc upgrade to stage, reboot to switch, bootc rollback if it went badly.