A custom Linux distribution on Gentoo and FreeBSD fundamentals — built from rootfs, debloated since stage 1, secured and snapshotted by default. Designed and developed by Maciej Leszczyński and his team at Gearnetics.
A Linux distribution built from the rootfs up
Primary Rules
- Nothing ships unless it earns its place. Every package on the system is there because something needs it — not because a default profile pulled it in.
- The system is built, not installed. GearOS is assembled from a bare rootfs, so every layer above it is a decision someone made on purpose.
- Security is a default, never a hardening guide. SELinux and the audit subsystem are part of the base system, active from first boot — with the CIS Benchmark control set as the next step on the same path.
- Every state is recoverable. Limine and btrfs with hooks mean a bad update is a reboot away from being undone, not a reinstall.
Gentoo and FreeBSD fundamentals. Custom from the rootfs.
GearOS is built on Gentoo and FreeBSD fundamentals — Portage, USE flags, source-built packages and profile-driven configuration from the Gentoo side; a clearly delineated base system and ports-style build discipline from the BSD side. But it is not a Gentoo install. There is no stage3 tarball, no ISO handing you a preassembled userland: GearOS is constructed customized from the rootfs upward, so the distribution is the sum of explicit choices rather than inherited defaults.
Source-first, all the way down
Portage and USE flags stay at the core. Every package is compiled for the target profile, with the toolchain and flags under your control.
Assembled from a bare rootfs
The base filesystem is laid out by hand and bootstrapped upward — no vendor stage tarball, no unexplained package in the dependency graph.
Base-system discipline from FreeBSD
The BSD idea that a base system is a defined, coherent thing — not whatever the package manager happened to leave behind. Base and everything on top of it stay separable, versioned and reproducible.
Debloated since stage 1
Trimming does not happen after installation. The package set is cut down from stage 1 onward, so the bloat never enters the image in the first place.
systemd as the init system
A deliberate departure from the Gentoo default: GearOS standardises on systemd for services, units, logging, boot sequencing and sane integration with the rest of the modern stack.
What the base system is made of
Six decisions define GearOS below the desktop. Each one is part of the base image — not an optional add-on you configure afterwards.
systemd
The whole system is unit-driven: service management, socket activation, ordered boot, journald logging and a predictable dependency graph across the entire userland.
init · units · journaldKernel 7.2
GearOS tracks the Linux 7.2 series, configured for the distribution rather than for everything — current hardware support, current schedulers, current subsystems, no ballast.
linux 7.2Limine + btrfs with hooks
Limine boots the system and btrfs carries it. Pacman-style hooks wire snapshots into every transaction, so updates are checkpointed and bootable snapshots show up in the boot menu automatically.
limine · btrfs · snapshotsSELinux
Mandatory access control is part of the base: the policy is installed with the system and loaded from first boot, running permissive so every denial is logged. Enforcing mode arrives with the hardened build.
mac · permissive · loggedAudit
The kernel audit subsystem and auditd are enabled on every edition by default, so SELinux denials and audit events are recorded from the first boot. The CIS-mapped ruleset lands with the hardened build.
auditd · enabledDebloated since stage 1
The package set is cut down from the very first stage of the build. Nothing arrives to be removed later, so the dependency graph, the attack surface and the image all stay small by construction.
stage 1 · minimalBuilt to reach CIS, not retrofitted to it
Hardening belongs in the build, not in a script you run afterwards on a system that has already booted unhardened. Today every GearOS install comes up with SELinux and the audit daemon active from first boot, logging everything. The CIS Benchmark control set is the next step on that same path — and because the base is debloated from stage 1, a large part of what the benchmark asks you to remove was never installed in the first place.
CIS Level 1 in development
Filesystem, kernel parameter, service, logging and access controls, applied from the benchmark at image build time rather than bolted on later. Level 1 is the target for the first hardened release; Level 2 follows for regulated deployments.
SELinux and audit, on from day one
Every edition ships SELinux with its policy installed and auditd enabled, running permissive so denials are logged rather than silently blocking — the correct first phase of any SELinux rollout. Enforcing mode lands with the hardened build.
Hardening that survives updates
Controls belong to the package set and the image definition, not to a one-off script. Updates are snapshotted first, so a regression is a rollback rather than a re-hardening exercise.
Per-edition baselines
Each release target — ISO, cloud, IoT, cluster — gets the baseline that fits it, and custom builds can be ordered against your own profile. Tell us the level you need and we will scope it with you.
Wayland, two ways
GearOS is Wayland-native — no X11 fallback carried along for the ride. Pick the scrolling tiling session, or the full desktop.
Wayland + niri
A scrollable-tiling compositor session built for keyboard-driven work: infinite horizontal workspace, no window ever fighting another for space, and a bar and launcher that stay out of the way until you want them.
- niri — scrollable-tiling Wayland compositor, the session GearOS boots into by default.
- waybar — status bar wired to the system's own signals: units, snapshots, audit state, updates.
- walker — the launcher and runner: applications, commands, clipboard and search from one prompt.
- Wayland native — pipewire audio, portals and screen sharing configured as part of the base session.
KDE — bleeding stable edge
When you want a full desktop instead of a tiling session, GearOS ships KDE Plasma at the bleeding stable edge: the newest releases that have actually been marked stable, tracked closely, never at the cost of a system that boots.
- Plasma on Wayland — the full desktop session, on the same Wayland base, no X11 detour.
- Bleeding stable — upstream releases land fast, but only after they are stable; freshness without breakage.
- Frameworks & Gear — the KDE application stack built against the same toolchain as the rest of the system.
- Shared base — same kernel, same systemd, same SELinux policy and snapshots underneath either session.
One base, four release targets
The same rootfs, the same package set and the same hardening baseline are built out into four shapes — and anything outside those four can be ordered as a custom build.
Installable images
Bootable ISO for bare metal and virtual machines, carrying the installer, the TUI and a live environment to recover or provision from.
Cloud images
Prebuilt images for cloud and virtualisation platforms — minimal footprint, cloud-init ready, with the snapshot layout and the hardening baseline already in place.
IoT & edge
Stripped-down builds for constrained and unattended hardware, where debloating since stage 1 and btrfs rollback matter most.
Bigdata & database clusters
A node OS tuned for data platforms: predictable kernel and I/O behaviour, systemd-managed services and a base small enough to certify — built for bigdata and database cluster fleets.
Order a build shaped for your environment
Own package set, own kernel configuration, target CIS profile, own edition — custom GearOS builds are ordered directly through this website, and delivered as an ISO, a cloud image or a cluster node image.
Getting it onto hardware
GearOS brings its own installation toolchain — three ways in, and a package manager of its own on the way. The distribution is not publicly released yet: beta builds go out to invited testers.
Custom installer
Written for GearOS rather than adapted from another distribution: partitioning, btrfs subvolume layout, Limine entries, SELinux labelling and the first-boot state, all handled in one pass.
Webinstaller
Drive the same installer from a browser. Point it at the target machine, choose the profile and disk layout, and watch the build run — convenient for headless boxes and remote provisioning.
TUI
The terminal interface for the same engine: full-screen, keyboard-driven, works over a serial console or SSH on a rescue boot with nothing graphical available.
sire
A new package manager built for GearOS — snapshot-aware transactions, source and binary in one model, and a command surface that matches the way the system is built. Coming soon, at your service.
Request beta access or order a custom build
GearOS is not generally available yet. Beta builds — ISO, cloud, IoT and cluster images — go out to a small group of testers, and custom builds are ordered here too. Tell us about your hardware and what you intend to run, and we will get back to you.
Who the beta is for
We are looking for people who will actually put the system under load: workstations, build hosts, cloud fleets, edge devices, bigdata and database clusters. Familiarity with Gentoo, FreeBSD, systemd, btrfs or SELinux helps, but curiosity and a willingness to file good bug reports matter more. Custom builds — your package set, your kernel configuration, your CIS profile — are ordered through this same form.
Phone (IE)
+353 85 174 1199Phone (PL)
+48 517 924 424Phone (UK)
+44 7947 519130Response Time
Within 1 business dayRelease targets
ISO · Cloud · IoT · ClustersBeta access & custom build requests
No download links yet — this is the waiting list, and the order desk for custom builds. Fields marked * are required.
GearOS is designed and developed by Maciej Leszczyński and his team at Gearnetics — the same people behind our IT consulting, managed services and DBaaS practice.
GearOS is owned by Gearnetics. All rights reserved.
