Eydos

Architecture

System image

Status. The installer, first-run wizard, full-disk encryption, read-only boot of the installation media and the boot splash are done. The installed system updates with apt on a single root. A/B updates are designed, not built.

Base

Eydos is Debian 13 with the Eydos packages on top, built for x86-64 and arm64. Apart from the kernel and firmware a given board needs, the same packages serve every supported device; the graphical stack picks its layout per screen at runtime rather than per image.

Installation

The installation media boots read-only, with changes kept in memory, and runs the installer, which copies the system to internal storage: eMMC, NVMe, SSD or SATA. The installer enables full-disk encryption. On first boot a wizard completes the configuration. The installation page lists the supported hardware.

Updates

Updates follow the two channels described under application distribution: the system by apt, applications by Flatpak and Android packages independently of it.

For the system, the goal is that an update is atomic and reversible. The design is two system slots, A and B. An update is applied with apt to the inactive slot, in a chroot, while the running system is untouched; if the transaction completes, the boot loader is pointed at the updated slot and the device reboots into it. If the new slot fails to boot, the boot loader falls back to the previous one. User data, application data and mutable configuration live outside the slots, on their own partition, so switching slots never touches them.

Two consequences shape the design:

  • Slot switching is the boot loader’s job, and Eydos has several: GRUB on x86-64 and one U-Boot per board or phone. Automatic fallback needs a boot counter in the loader and a service that marks a boot as good.
  • Applying apt on the device and verifying the root with dm-verity do not mix, because package installation changes the volume the hash tree was computed over. Slots built as images off the device would allow a verified root; per-file signatures applied at package install would keep apt on the device. Both remain open, and the slot layout is designed not to close either.

Memory and storage pressure

Placeholder. Low-memory handling is under evaluation: compressed swap in memory and an early out-of-memory daemon, with the memory thresholds used by first-party apps adjusted to account for swap.