The NAIS.OS project develops an independent Linux distribution, built 'from scratch' from source code and supporting its own package base, which does not borrow package build scripts from other distributions. The project develops its own toolset, its own set of patches, and its own build policy. An ISO image (603 MB) is available for download, designed for installation on virtual machines (KVM, Proxmox, VMware, VirtualBox, etc.).
The distribution is available for free for private and commercial use without limitations on the number of devices. However, the license agreement prohibits 'modifying, adapting, translating, decompiling, disassembling, or otherwise attempting to obtain the source code, except as expressly permitted by applicable law or the terms of open component licenses.' It also prohibits 'transferring, selling, renting, providing for use, publishing, or otherwise distributing the software product without the written consent of the rights holder.'
NAIS.OS is positioned as a server system with a long-term support (LTS) focus, optimized for of virtual machines, cloud systems and edge nodes. The kernel, compilers, basic libraries, and crypto stack are all built under unified reproducibility and security requirements. The project is included in the registry of Russian software (registration means it can meet the requirements for 'domestic software' in the public sector and with some corporate clients).
Two approaches are supported: an atomically updatable (immutable based on OSTree) and a classic RPM (dnf/dnf5). In the atomic variant, the /usr partition is mounted in read-only mode, updates are applied entirely for the whole system, and Btrfs snapshots are used to roll back failed updates, with base system versions considered as artifacts that can be managed and deployed across nodes via the OSTree repository. The classic RPM variant uses package management through dnf and dnf5, supports both manual and automatic updates, and provides a console installer 'niceos-installer.'
The distribution offers a minimal and predictable base for containers, with no graphical environment; only basic services (systemd, networking utilities, SSH, firewall using nftables/firewalld, basic monitoring utilities) are running, and all application software is meant to be installed in containers (Docker/Podman/Kubernetes) or as separate services on top of the base.
Official container images are available on Docker Hub. These images are built on the same minimal NiceOS Base, operate under a non-privileged user, contain embedded SBOMs (CycloneDX/SPDX) and vulnerability reports (Trivy, Grype), and are equipped with built-in reports for offline auditing right inside the container.
There is support for domestic cryptography (a compiled and tested stack for those who need GOST requirements and audits):
- GnuPG with GOST (GOST R 34.10-2012 and GOST R 34.11-2012), including signing, encryption, and verification;
- OpenSSL with GOST — TLS and CLI utilities using GOST cryptography;
- libksba/nettle — GOST support in CMS and X.509;
- OpenVPN with GOST — a ready-to-use server with GOST ciphers; there is a script that deploys VPN (PKI, firewall, monitoring, integration with Prometheus) in just a few minutes;
- Utilities for integrity control based on GOST hashes (gost12sum, profiles in openssl dgst, etc.).
Options for enhancing security:
- SELinux is enabled by default;
- Standard security flags are used during build (PIE, RELRO, SSP, FORTIFY_SOURCE, etc.);
- Integrity control scenarios are implemented (Secure Boot, IMA, AIDE with GOST algorithms);
- Each RPM package is signed, and there is a Zero-Trust PKI model: by default, trust is not granted to anything that has not passed verification;
- SBOMs and vulnerability reports are generated for packages and images.
Options for virtual and cloud systems:
- Support for confidential virtual machines is claimed (AMD SEV-SNP, Intel TDX). There are utilities for attesting virtual machines in such scenarios.
- The official image of NICE.OS 5.2 is available in the Yandex Cloud Marketplace as a virtual machine, which already includes Docker, glibc, and Python 3.12; the distribution is marked as being in the registry of Russian software;
- In the Cloud.ru Marketplace, the distribution is described as "a Russian minimalist OS for containers. An image for VM, Docker, and Kubernetes";
- The separate edition of NiceOS V is optimized for hypervisors (Proxmox, VMware ESXi, KVM/QEMU, AWS/Yandex Cloud/Google Cloud, etc.), with a minimal set of services and a focus on automated installations via Kickstart/JSON.
Among the used versions:
- Linux 6.13.x,
- GCC 14.3, Glibc 2.41,
- OpenSSL 3.5.1 (with GOST extensions),
- systemd 257, coreutils 9.6.
Source: opennet.ru
