Introduction to Snigdha OS Decentralized
Core principles, system overview, and design philosophy.
2 min readUpdated: 2026-11-12
Introduction to Snigdha OS Decentralized
Snigdha OS Decentralized is an independent, security-oriented, amnesic live operating system built on Arch Linux. Designed to run completely from a removable USB flash drive, it leaves zero digital footprints on host hardware while protecting all network communications through the Tor anonymity network.
Note
Snigdha OS Decentralized has officially published its bootable ISO image (`v2026.11.13-rc1`), available at the project's [GitLab Releases](https://gitlab.com/SnigdhaOS/decentralize/iso/-/releases) repository. All core subsystems—Amnesia, NetGuard transparent torification, Encrypted Persistence, Application Isolation, Privacy Suite, Security Center, and Penetration Center—are fully implemented, verified, and shipped in the live ISO.
Core Security Invariants
Snigdha OS Decentralized operates on five non-negotiable architectural guarantees:
- Amnesia by Default: The entire operating system runs in volatile RAM using an OverlayFS with a compressed read-only lower image and a volatile tmpfs upper directory. Internal hard drives and NVMe SSDs are never mounted or touched.
- Fail-Closed NetGuard Torification: All non-Tor outbound network traffic is blocked by an atomic nftables firewall. External TCP traffic is transparently routed through Tor TransPort (9040), and DNS is intercepted by Tor DNSPort (5353).
- User-Controlled Encrypted Persistence: Selective data retention is supported exclusively via a LUKS2 encrypted volume on the USB drive using Argon2id key derivation.
- Defense-in-Depth Isolation: Applications run under strict AppArmor mandatory access control, Bubblewrap user-namespace sandboxing, and compiled Seccomp-BPF system call filters.
- Fail-Closed Root Integrity: The lower root filesystem is cryptographically verified by dm-verity Merkle trees anchored in signed UEFI Secure Boot Unified Kernel Images (UKIs).