NineLives blogShort notes as things get decided.https://ninelives.getfelix.dev/blog/2026-10-28T00:00:00ZLinux or our own kernel?https://ninelives.getfelix.dev/blog/linux-or-our-own-kernel/2026-10-28T00:00:00Z2026-10-28T00:00:00ZGabriel LoewenThe first open question, with the case for each side. Nothing is chosen yet.<p>The first question anyone asks is whether NineLives will have its own kernel. There are good Rust crates now, and booting, paging and a basic scheduler are weeks of work, not years. It isn't decided. I opened <a rel="external" href="https://github.com/GetFelix/ninelives/discussions/22">a discussion</a> to work it out, and this is the short version of both sides.</p>
<h2 id="the-case-for-stock-linux">The case for stock Linux</h2>
<p>What is new in NineLives sits above the kernel: workloads that survive losing a machine, atomic upgrades, system programs that keep their state in the log. None of that obviously needs a new kernel, and all of it is plenty of work. The first thing I want to see is three VMs, one killed, and nothing lost.</p>
<figure class="nl-figure">
<svg xmlns="http://www.w3.org/2000/svg" class="nl-ill" role="img" aria-label="Three machines, each running Linux, sit over one log of records. The middle machine is faded and dashed because it died. The cat steps along a curved arrow from it onto the third machine. Every record in the log is still there, and the newest is amber." viewBox="0 0 720 480" width="720" height="480"><style>.nl-ill{--f-ink:#0e2a3a;--f-soft:rgba(95,211,239,.22);--f-cat:#0e2a3a;--f-eye:#5fd3ef;--f-label:#46536a;--f-amber-text:#8f4c00}
@media (prefers-color-scheme:dark){.nl-ill{--f-ink:#5fd3ef;--f-soft:rgba(18,163,196,.16);--f-cat:#5fd3ef;--f-eye:#0e2a3a;--f-label:#a9b6c8;--f-amber-text:#f7b13a}}
.nl-k{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
.nl-m{fill:var(--ill-soft,var(--f-soft));stroke:var(--ill-line,#12a3c4);stroke-width:2;stroke-linejoin:round}
.nl-o{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linejoin:round}
.nl-ka{fill:none;stroke:var(--ill-accent,#f5a623);stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
.nl-dead{opacity:.35}
.nl-dash{stroke-dasharray:5 6}
.nl-r{fill:var(--ill-line,#12a3c4)}
.nl-new{fill:var(--ill-accent,#f5a623)}
.nl-lost{opacity:.28}
.nl-cat{fill:var(--ill-cat,var(--f-cat));stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linejoin:round}
.nl-tail-e{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:10;stroke-linecap:round}
.nl-tail{fill:none;stroke:var(--ill-cat,var(--f-cat));stroke-width:6;stroke-linecap:round}
.nl-eye{fill:var(--ill-eye,var(--f-eye))}
.nl-eye-a{fill:var(--ill-accent,#f5a623)}
.nl-lid{fill:none;stroke:var(--ill-eye,var(--f-eye));stroke-width:2.4;stroke-linecap:round}
.nl-t{font-family:var(--mono,"IBM Plex Mono",ui-monospace,monospace);font-size:13px;fill:var(--ill-label,var(--f-label))}
.nl-ta{fill:var(--ill-accent-text,var(--f-amber-text))}</style><rect class="nl-m" x="60" y="190" width="170" height="110" rx="12"/><path class="nl-k" d="M76 208h26M76 218h16"/><text class="nl-t" x="76" y="284" text-anchor="start">vm 1 · linux</text><path class="nl-k" d="M145 302C145 340 300 346 290 380"/><g class="nl-dead"><rect class="nl-o nl-dash" x="275" y="190" width="170" height="110" rx="12"/><path class="nl-k nl-dash" d="M291 208h26M291 218h16"/><text class="nl-t" x="291" y="284" text-anchor="start">vm 2 · linux</text></g><g class="nl-dead"><path class="nl-k nl-dash" d="M360 302C360 340 360 346 360 380"/></g><rect class="nl-m" x="490" y="190" width="170" height="110" rx="12"/><path class="nl-k" d="M506 208h26M506 218h16"/><text class="nl-t" x="506" y="284" text-anchor="start">vm 3 · linux</text><path class="nl-k" d="M575 302C575 340 420 346 430 380"/><path class="nl-k" d="M330 160C380 70 500 70 542 138M532.2 133.0L542 138L541.9 127.0"/><rect class="nl-r" x="237" y="390" width="22" height="14" rx="5"/><rect class="nl-r" x="265" y="390" width="22" height="14" rx="5"/><rect class="nl-r" x="293" y="390" width="22" height="14" rx="5"/><rect class="nl-r" x="321" y="390" width="22" height="14" rx="5"/><rect class="nl-r" x="349" y="390" width="22" height="14" rx="5"/><rect class="nl-r" x="377" y="390" width="22" height="14" rx="5"/><rect class="nl-r" x="405" y="390" width="22" height="14" rx="5"/><rect class="nl-r" x="433" y="390" width="22" height="14" rx="5"/><rect class="nl-new" x="461" y="390" width="22" height="14" rx="5"/><text class="nl-t" x="222" y="402" text-anchor="end">log</text><path class="nl-tail-e" d="M592 174C598 192 592 206 578 211"/><path class="nl-tail" d="M592 174C598 192 592 206 578 211"/><path class="nl-cat" d="M557 170C557 159 560 153 563 150L561 136L572 147Q575 146 578 147L589 136L587 150C590 153 593 159 593 170C593 182 585 188 575 188C565 188 557 182 557 170Z"/><ellipse class="nl-eye" cx="568" cy="169" rx="4.2" ry="2.8"/><ellipse class="nl-eye" cx="582" cy="169" rx="4.2" ry="2.8"/></svg>
<figcaption>The first goal on stock Linux: kill one of three VMs and the workload moves to another with every record intact.</figcaption>
</figure>
<p>The hard part of a kernel is what comes after boot.</p>
<ul>
<li><strong>Drivers.</strong> NVMe, real network cards, whatever each cloud exposes. Most of Linux is drivers.</li>
<li><strong>Storage.</strong> Felix's durability depends on <code>fsync</code>, <code>pread</code> and preallocation behaving exactly as documented. A new kernel would have to earn that trust first.</li>
<li><strong>Networking.</strong> Felix runs on tokio and QUIC over UDP. A scratch kernel needs a network stack and a port of that runtime.</li>
<li><strong>Security and many cores.</strong> Every fix would be ours to write.</li>
</ul>
<h2 id="the-case-for-a-kernel-of-our-own">The case for a kernel of our own</h2>
<p>A kernel built for NineLives could give a smaller trusted base, deterministic scheduling that makes replay stronger, and syscalls designed around the log. With today's crates, booting, paging and a basic scheduler are weeks of work. And nobody else is building an OS with a replicated log at the center, so there's a real research story. The cost is everything after boot, listed above.</p>
<figure class="nl-figure">
<svg xmlns="http://www.w3.org/2000/svg" class="nl-ill" role="img" aria-label="Two stacks side by side, each with the cat on top of a felix and felixd layer, over a kernel, over hardware. In the stock Linux stack the kernel has six filled parts: boot, paging, scheduler, drivers, storage and network. In the own kernel stack boot, paging and scheduler are filled, while drivers, storage and network are empty amber outlines." viewBox="0 0 720 480" width="720" height="480"><style>.nl-ill{--f-ink:#0e2a3a;--f-soft:rgba(95,211,239,.22);--f-cat:#0e2a3a;--f-eye:#5fd3ef;--f-label:#46536a;--f-amber-text:#8f4c00}
@media (prefers-color-scheme:dark){.nl-ill{--f-ink:#5fd3ef;--f-soft:rgba(18,163,196,.16);--f-cat:#5fd3ef;--f-eye:#0e2a3a;--f-label:#a9b6c8;--f-amber-text:#f7b13a}}
.nl-k{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
.nl-m{fill:var(--ill-soft,var(--f-soft));stroke:var(--ill-line,#12a3c4);stroke-width:2;stroke-linejoin:round}
.nl-o{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linejoin:round}
.nl-ka{fill:none;stroke:var(--ill-accent,#f5a623);stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
.nl-dead{opacity:.35}
.nl-dash{stroke-dasharray:5 6}
.nl-r{fill:var(--ill-line,#12a3c4)}
.nl-new{fill:var(--ill-accent,#f5a623)}
.nl-lost{opacity:.28}
.nl-cat{fill:var(--ill-cat,var(--f-cat));stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linejoin:round}
.nl-tail-e{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:10;stroke-linecap:round}
.nl-tail{fill:none;stroke:var(--ill-cat,var(--f-cat));stroke-width:6;stroke-linecap:round}
.nl-eye{fill:var(--ill-eye,var(--f-eye))}
.nl-eye-a{fill:var(--ill-accent,#f5a623)}
.nl-lid{fill:none;stroke:var(--ill-eye,var(--f-eye));stroke-width:2.4;stroke-linecap:round}
.nl-t{font-family:var(--mono,"IBM Plex Mono",ui-monospace,monospace);font-size:13px;fill:var(--ill-label,var(--f-label))}
.nl-ta{fill:var(--ill-accent-text,var(--f-amber-text))}</style><text class="nl-t" x="190" y="92" text-anchor="middle">stock linux</text><path class="nl-tail-e" d="M207 158C213 176 207 190 193 195"/><path class="nl-tail" d="M207 158C213 176 207 190 193 195"/><path class="nl-cat" d="M172 154C172 143 175 137 178 134L176 120L187 131Q190 130 193 131L204 120L202 134C205 137 208 143 208 154C208 166 200 172 190 172C180 172 172 166 172 154Z"/><ellipse class="nl-eye" cx="183" cy="153" rx="4.2" ry="2.8"/><ellipse class="nl-eye" cx="197" cy="153" rx="4.2" ry="2.8"/><rect class="nl-m" x="60" y="180" width="260" height="56" rx="12"/><text class="nl-t" x="76" y="214" text-anchor="start">felix + felixd</text><rect class="nl-m" x="60" y="250" width="260" height="140" rx="12"/><text class="nl-t" x="76" y="274" text-anchor="start">kernel</text><rect class="nl-m" x="68" y="288" width="76" height="38" rx="8"/><text class="nl-t" x="106" y="312" text-anchor="middle">boot</text><rect class="nl-m" x="152" y="288" width="76" height="38" rx="8"/><text class="nl-t" x="190" y="312" text-anchor="middle">paging</text><rect class="nl-m" x="236" y="288" width="76" height="38" rx="8"/><text class="nl-t" x="274" y="312" text-anchor="middle">sched</text><rect class="nl-m" x="68" y="336" width="76" height="38" rx="8"/><text class="nl-t" x="106" y="360" text-anchor="middle">drivers</text><rect class="nl-m" x="152" y="336" width="76" height="38" rx="8"/><text class="nl-t" x="190" y="360" text-anchor="middle">storage</text><rect class="nl-m" x="236" y="336" width="76" height="38" rx="8"/><text class="nl-t" x="274" y="360" text-anchor="middle">network</text><rect class="nl-m" x="60" y="404" width="260" height="40" rx="12"/><text class="nl-t" x="76" y="429" text-anchor="start">hardware</text><text class="nl-t" x="530" y="92" text-anchor="middle">own kernel</text><path class="nl-tail-e" d="M547 158C553 176 547 190 533 195"/><path class="nl-tail" d="M547 158C553 176 547 190 533 195"/><path class="nl-cat" d="M512 154C512 143 515 137 518 134L516 120L527 131Q530 130 533 131L544 120L542 134C545 137 548 143 548 154C548 166 540 172 530 172C520 172 512 166 512 154Z"/><ellipse class="nl-eye" cx="523" cy="153" rx="4.2" ry="2.8"/><ellipse class="nl-eye" cx="537" cy="153" rx="4.2" ry="2.8"/><rect class="nl-m" x="400" y="180" width="260" height="56" rx="12"/><text class="nl-t" x="416" y="214" text-anchor="start">felix + felixd</text><rect class="nl-m" x="400" y="250" width="260" height="140" rx="12"/><text class="nl-t" x="416" y="274" text-anchor="start">kernel</text><rect class="nl-m" x="408" y="288" width="76" height="38" rx="8"/><text class="nl-t" x="446" y="312" text-anchor="middle">boot</text><rect class="nl-m" x="492" y="288" width="76" height="38" rx="8"/><text class="nl-t" x="530" y="312" text-anchor="middle">paging</text><rect class="nl-m" x="576" y="288" width="76" height="38" rx="8"/><text class="nl-t" x="614" y="312" text-anchor="middle">sched</text><rect class="nl-ka" x="408" y="336" width="76" height="38" rx="8"/><text class="nl-t nl-ta" x="446" y="360" text-anchor="middle">drivers</text><rect class="nl-ka" x="492" y="336" width="76" height="38" rx="8"/><text class="nl-t nl-ta" x="530" y="360" text-anchor="middle">storage</text><rect class="nl-ka" x="576" y="336" width="76" height="38" rx="8"/><text class="nl-t nl-ta" x="614" y="360" text-anchor="middle">network</text><rect class="nl-m" x="400" y="404" width="260" height="40" rx="12"/><text class="nl-t" x="416" y="429" text-anchor="start">hardware</text></svg>
<figcaption>Both stacks run the same felix and felixd. Our own kernel gets boot, paging and a scheduler in weeks; drivers, storage and networking are what it would still have to earn.</figcaption>
</figure>
<p>There are middle paths. <a rel="external" href="https://github.com/asterinas/asterinas">Asterinas</a> aims to be compatible with Linux at the syscall level, so felixd could run on it unchanged, which makes it an experiment rather than a rewrite. <a rel="external" href="https://github.com/hermit-os/kernel">Hermit</a> is a unikernel, and a node that only runs Felix and felixd could be a single image. <a rel="external" href="https://gitlab.redox-os.org/redox-os/redox">Redox</a> and <a rel="external" href="https://github.com/theseus-os/Theseus">Theseus</a> are worth studying for their ideas on recovery. <a rel="external" href="https://rust-for-linux.com/">Rust for Linux</a> is the route if something ever has to live inside Linux.</p>
<figure class="nl-figure">
<svg xmlns="http://www.w3.org/2000/svg" class="nl-ill" role="img" aria-label="A line of five stops from stock Linux on the left to our own kernel on the right. They are stock Linux, Rust for Linux, Asterinas with Linux syscalls, Hermit as a unikernel, and our own kernel. The cat sits on stock Linux with amber eyes, and a curved arrow with a question mark arcs from it to the far end. Below, an arrow runs from reuse more to write more." viewBox="0 0 720 480" width="720" height="480"><style>.nl-ill{--f-ink:#0e2a3a;--f-soft:rgba(95,211,239,.22);--f-cat:#0e2a3a;--f-eye:#5fd3ef;--f-label:#46536a;--f-amber-text:#8f4c00}
@media (prefers-color-scheme:dark){.nl-ill{--f-ink:#5fd3ef;--f-soft:rgba(18,163,196,.16);--f-cat:#5fd3ef;--f-eye:#0e2a3a;--f-label:#a9b6c8;--f-amber-text:#f7b13a}}
.nl-k{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
.nl-m{fill:var(--ill-soft,var(--f-soft));stroke:var(--ill-line,#12a3c4);stroke-width:2;stroke-linejoin:round}
.nl-o{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linejoin:round}
.nl-ka{fill:none;stroke:var(--ill-accent,#f5a623);stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
.nl-dead{opacity:.35}
.nl-dash{stroke-dasharray:5 6}
.nl-r{fill:var(--ill-line,#12a3c4)}
.nl-new{fill:var(--ill-accent,#f5a623)}
.nl-lost{opacity:.28}
.nl-cat{fill:var(--ill-cat,var(--f-cat));stroke:var(--ill-ink,var(--f-ink));stroke-width:2;stroke-linejoin:round}
.nl-tail-e{fill:none;stroke:var(--ill-ink,var(--f-ink));stroke-width:10;stroke-linecap:round}
.nl-tail{fill:none;stroke:var(--ill-cat,var(--f-cat));stroke-width:6;stroke-linecap:round}
.nl-eye{fill:var(--ill-eye,var(--f-eye))}
.nl-eye-a{fill:var(--ill-accent,#f5a623)}
.nl-lid{fill:none;stroke:var(--ill-eye,var(--f-eye));stroke-width:2.4;stroke-linecap:round}
.nl-t{font-family:var(--mono,"IBM Plex Mono",ui-monospace,monospace);font-size:13px;fill:var(--ill-label,var(--f-label))}
.nl-ta{fill:var(--ill-accent-text,var(--f-amber-text))}</style><path class="nl-k" d="M90 300H630"/><rect class="nl-r" x="79" y="293" width="22" height="14" rx="5"/><text class="nl-t" x="90" y="336" text-anchor="middle">stock linux</text><rect class="nl-r" x="214" y="293" width="22" height="14" rx="5"/><text class="nl-t" x="225" y="336" text-anchor="middle">rust for</text><text class="nl-t" x="225" y="354" text-anchor="middle">linux</text><rect class="nl-r" x="349" y="293" width="22" height="14" rx="5"/><text class="nl-t" x="360" y="336" text-anchor="middle">asterinas</text><text class="nl-t" x="360" y="354" text-anchor="middle">linux syscalls</text><rect class="nl-r" x="484" y="293" width="22" height="14" rx="5"/><text class="nl-t" x="495" y="336" text-anchor="middle">hermit</text><text class="nl-t" x="495" y="354" text-anchor="middle">unikernel</text><rect class="nl-r" x="619" y="293" width="22" height="14" rx="5"/><text class="nl-t" x="630" y="336" text-anchor="middle">own kernel</text><path class="nl-k" d="M122 222C220 90 520 90 622 280M612.5 274.4L622 280L622.5 269.0"/><text class="nl-t" x="372" y="118" text-anchor="middle">?</text><text class="nl-t" x="90" y="420" text-anchor="start">reuse more</text><text class="nl-t" x="630" y="420" text-anchor="end">write more</text><path class="nl-k" d="M190 416H530M520 410L530 416L520 422M200 410L190 416L200 422"/><path class="nl-tail-e" d="M107 254C113 272 107 286 93 291"/><path class="nl-tail" d="M107 254C113 272 107 286 93 291"/><path class="nl-cat" d="M72 250C72 239 75 233 78 230L76 216L87 227Q90 226 93 227L104 216L102 230C105 233 108 239 108 250C108 262 100 268 90 268C80 268 72 262 72 250Z"/><ellipse class="nl-eye-a" cx="83" cy="249" rx="4.2" ry="2.8"/><ellipse class="nl-eye-a" cx="97" cy="249" rx="4.2" ry="2.8"/></svg>
<figcaption>The middle paths reuse more of what exists. The open question is whether starting on Linux makes moving along this line harder later.</figcaption>
</figure>
<h2 id="what-i-don-t-know-yet">What I don't know yet</h2>
<ul>
<li>Is the first goal a cluster that survives losing a machine, or a kernel designed around the log? The answer probably decides this.</li>
<li>Would starting on Linux make it harder to move later, or can felixd lean on so little of the kernel that it doesn't matter?</li>
<li>Is Asterinas close enough to Linux that trying it is an experiment rather than a rewrite?</li>
<li>Are single-purpose nodes enough, or does every machine need a general-purpose OS?</li>
<li>What would we give up in debugging, tooling and hardware support?</li>
</ul>
<p>If you have a view on any of these, or know a project I missed, <a rel="external" href="https://github.com/GetFelix/ninelives/discussions/22">reply in the discussion</a>.</p>