Architecture

What does not exist cannot be exploited.

Arkane starts from nothing and only adds what can be proven. The kernel is an exokernel: capability check, memory mapping, IRQ routing, IPC — about 13,000 lines of Rust, 26 syscalls, no drivers, no network stack, no policy. Everything else — network, storage, the AI model, your app — runs in hardware-isolated cells with their own page tables. Isolation is wired into the MMU once, at spawn — not checked on every operation.

26syscalls,
the entire API
~13klines of Rust,
the whole kernel
0lines of C.
POSIX. shell.
01 · Anatomy

What it is made of.

Every box is a real binary in the repository — no marketing architecture. Click a component.

mTLS · HTTP/2 · gRPC →
gateway cells
↓ capability-mediated IPC ↓
workload cells — replicas: N per group
↓ 26 syscalls — every one a capability check ↓

// select a component

Everything shown here runs today — spawned, signed and isolated on the real kernel, preemptively scheduled across four cores.

02 · Contracts

Two keys, one law.

The developer signs the shape of a cell into its binary. The operator provides the values in the manifest. The kernel enforces both — structurally, default-deny, at every spawn. Access exists only as a capability: an unforgeable token, derivable and transitively revocable.

cells/inference · signed ed25519 ✓
#[arkane_contract(
    needs(memory = "16MB"),
    needs(share::read = "model"),
    forbid(net::inbound, net::outbound, spawn)
)]

What is forbidden here is not monitored — it is never wired up.

03 · Gateways

The AI that cannot phone home.

Network cards exist only in the gateway cells — every byte in or out crosses one of exactly three audited membranes. The inference cell holds no network capability, so the kernel never wires one up: there is nothing to block, monitor, or misconfigure. The path does not exist.

manifest.yaml · cell: inference
arkane: v1
kind: Cell
metadata:
  name: inference
spec:
  image: prod.images.inference@blake3:9c41…   # signed — contract forbids net
  ha: { replicas: 2 }                          # a replica group — rolling restarts
  shares:
    model: blake3:7c8a…                        # weights, mapped read-only
  capabilities: []
  # no mmio, no port, no endpoint —
  # a path to a network card is never created

Since the HA slice, replicas: N turns a cell into a replica group: the gateways route requests round-robin across its members, and arkctl cell rollout restarts them one at a time — the group never hits zero. Proven under sustained fire →

04 · Storage

No filesystem. On purpose.

The kernel multiplexes one block device — there is no VFS, no page cache, no filesystem tower. Everything durable is a hash-addressed blob owned by a cell: dedup, snapshots and integrity proof fall out of the design, and encryption at rest runs through a net-free keystore cell. One tiny audited driver instead of a storage stack to patch.

The full storage story →