The computer, made personal again.
mochiOS is an operating system built from the ground up with isolation, least privilege, and recoverability at its core.
Applications, services, and drivers are separated from one another and given only the capabilities they need.
A failure should stay where it happened.
The kernel, system services, application framework, interface, and development tools are designed together.
Not as separate pieces, but as one computer experience.
Simple where it should be simple. Powerful where it needs to be.
mochiOS is developed in the open.
Its kernel, system components, frameworks, applications, and development tools are available across the mochiOS GitHub organization.
Learn more at developer.mochios.org.
mochiOS uses repo to manage its source tree.
The supported build host is Ubuntu 24.04. Install the host tools used by the build and QEMU runner:
sudo apt-get update
sudo apt-get install --yes \
autoconf automake binutils bison build-essential curl dosfstools \
e2fsprogs fakeroot flex gawk libgmp-dev libmpc-dev libmpfr-dev \
libtool mtools openssl ovmf perl qemu-system-x86 repo texinfo \
xz-utilsThe kernel and boot components require the pinned Rust nightly toolchain and its Rust source component:
rustup toolchain install nightly-2026-05-14 \
--profile minimal \
--component rust-srcThe userland C runtime requires an x86_64-elf cross compiler. On Linuxbrew,
install it with:
brew install x86_64-elf-gccVerify that x86_64-elf-gcc, x86_64-elf-ar, x86_64-elf-ranlib,
x86_64-elf-ld, x86_64-elf-nm, and x86_64-elf-readelf are on PATH.
git clone https://github.com/mochiOS/mochiOS.git
cd mochiOS
make repo-init
mmake imageThe bootable raw disk image is written to out/artifacts/disk.img.
On Linux, run the desktop and standard applications together in one resizable host window:
mmake uiThis builds Binder, Files, Settings, Edit, Terminal, AppStore, System Monitor, and Viewer for Linux. The applications run as separate processes; their real ViewKit display lists and input events are transported into Binder's existing window layer. Moving, resizing, minimizing, restoring, switching applications, text input, scrolling, context menus, and application dialogs use the existing shell and application implementations. The normal Linux ViewKit renderer draws the complete desktop. No OS image or VM is required.
While the desktop is focused, the pointer is confined to its host window. Press Ctrl+Alt+G to release it; click inside the desktop to capture it again. Switching focus away also releases the pointer. The host window title displays this shortcut.
The logo opens the OS menu. The battery/network area opens Control Center; click outside or press Esc to close either. Control Center uses application controls declared in manifests and published through AppCore. ViewKit Test provides example cards for checking this path in the preview. Right-click the controls to edit their visibility/order. Brightness control is currently unavailable; volume uses the session's preview state.
The VK Symbols notification bell to the right of A/あ opens Notification Center;
the date/time area is reserved for the calendar. Notifications are grouped by
application in delivery order, with expandable groups, individual dismissal,
Clear All, and a slide from the right edge. The panel uses ViewKit's shared
omochi surfaces and controls. AppCore's UserNotification::deliver also works
inside this Linux preview; ViewKit Test's Send Notification button exercises
that path. Notification history lasts for the preview session.
ViewKit Test includes an omochi control gallery for hover, press, input, menu,
and keyboard focus behavior. The shared component rules are documented in
libraries/viewkit/docs/omochi.md.
The preview runs mochiOS's own IME with the same input.service conversion engine
and ja.mime dictionary. Ctrl+Space or clicking A/あ in the status area switches Japanese input, Space converts,
and Enter confirms. Candidate selection uses the existing ViewKit UI. Input
mode is shared across applications and the status area. The first mmake ui
fetches the dictionary through the existing SHA-256-verified build target;
subsequent launches reuse it. The IME process stops with the desktop.
The session has a disposable home, application catalogue, settings and text
clipboard under out/preview/session.*. Closing the desktop stops its child
applications and removes this state. Volume, network, battery and power actions
use preview data and never change the Linux host's system configuration. Power
actions produce preview notifications. A sample notification is available for
notification-center checks.
This is a UI development environment, not a replacement for mochiOS services: Capability enforcement, the native compositor/display path, user management, package installation, file association/open/save service integrations, and Terminal's mochiOS shell session still require the OS. An app's existing unsupported host operations remain unavailable.
To compile this environment without opening any windows:
mmake ui-checkHost previews share an isolated Cargo workspace and lockfile under
out/preview; source lockfiles are left intact. Debug information and
incremental compilation are disabled by default to keep build output small.
Set CARGO_PROFILE_DEV_DEBUG or CARGO_INCREMENTAL to override this.
On a Linux desktop, open the standard apps with the host ViewKit backend:
mmake preview-files
mmake preview-settings
mmake preview-binderThese targets compile only the selected host app; they do not build or boot the
OS. mmake preview-check compiles all three without opening windows, and
mmake ui-test runs their host tests plus ViewKit's library tests. Files opens
an isolated sample directory under out/preview/home and cannot navigate
outside it. Settings user-management actions are unavailable on the host.
mochiOS can be started directly for development, or through mBoot to test the complete system architecture.
mmake run builds the current tree and starts mochiOS directly with
qemu-system-x86_64.
The default configuration uses KVM and opens a QEMU display window:
export DEBUG_QEMU_KVM=y
mmake runThe user running QEMU must have read/write access to /dev/kvm.
To run on a host without KVM, use QEMU's TCG accelerator:
QEMU_ACCELERATOR=tcg mmake runFor a headless boot smoke test using TCG:
make smoke-test-tcgThe runner expects the OVMF firmware at
/usr/share/OVMF/OVMF_CODE_4M.fd and
/usr/share/OVMF/OVMF_VARS_4M.fd.
Distributions that install these files elsewhere can override both paths:
OVMF_CODE=/path/to/OVMF_CODE_4M.fd \
OVMF_VARS_TEMPLATE=/path/to/OVMF_VARS_4M.fd \
QEMU_ACCELERATOR=tcg mmake runTo run the complete system with mBoot, build an mBoot disk image using the QEMU system configuration:
make mboot-image \
MBOOT_CONFIG="$PWD/mboot/config/qemu-system.toml"The resulting disk image is written to:
out/mochiOS.img
Create a writable copy of the OVMF variable store:
cp mboot/firmware/OVMF_VARS_4M.fd out/OVMF_VARS_4M.run.fdThen start mBoot with QEMU and KVM:
qemu-system-x86_64 \
-accel kvm \
-cpu host \
-machine q35,kernel-irqchip=split \
-smp 2 \
-m 1024 \
-drive if=pflash,format=raw,readonly=on,file=mboot/firmware/OVMF_CODE_4M.fd \
-drive if=pflash,format=raw,file=out/OVMF_VARS_4M.run.fd \
-drive if=none,id=disk,format=raw,file=out/mochiOS.img \
-device virtio-blk-pci,drive=disk,bootindex=1 \
-device intel-iommu,intremap=on \
-vga none \
-device virtio-vga \
-net none \
-serial stdio \
-monitor none \
-no-reboot \
-no-shutdownIn this configuration, mBoot starts the mochiOS System Domain together with the mDriver Hardware Domain and manages CPU, memory, interrupts, IOMMU, and device assignment between them.
Optional networking and TLS smoke tests additionally use netcat-openbsd
(nc) and Python 3.
mochiOS is under active development.
It is not yet intended for everyday use, and unexpected failures or data loss may occur.
Use a virtual machine or dedicated test machine when experimenting with it.
mochiOS is open source and contributions are welcome.
See contributing.md before submitting changes.
Copyright © 2026 mochiOS team.