A boot sector, a 2,673-line Rust microkernel and drivers that run as ordinary programs. Crash a driver in the browser demo and watch the system restart it. A research toy: it runs only in an emulator.
In mainstream operating systems a driver bug can take the whole system down, kernels are written mostly in memory-unsafe languages, and a program runs with all the rights of its user.
Inti (Indonesian for "core") does the opposite on those three points and measures what happens.
The screen, keyboard and file drivers are ordinary programs. When one crashes or hangs, a supervisor replaces it and the shell keeps answering.
A program can only use what it was handed a capability for. In QEMU a hostile test program makes 47 attempts on the kernel, the hardware and other programs, and all 47 are denied.
No number in the README is typed by hand unless a source link stands next to it. A script computes each one from the raw logs and rejects a document it cannot trace.
The page boots the same disk image that QEMU boots, in an x86 emulator written in JavaScript.
The screen and keyboard driver dies of a page fault.
The file server stops answering.
A hostile program tries to read kernel memory, touch hardware, forge or revoke capabilities and exceed its quotas.
The console driver (screen, keyboard, serial port) and the file server run outside the kernel, each started with a handful of capabilities.
A driver that crashes or stops answering is replaced, and programs that were waiting get their answer from the new one. In QEMU a crashed console driver answers again after 5.8 ms and a hung one after 657 ms (median of 5 runs).
Every system call starts from a capability the program was handed. A capability can be narrowed but never widened. There are 7 kinds: endpoints, I/O ports, interrupt lines, memory, tasks, the kernel log and kernel information.
2,673 lines, and every table has a fixed size. Each of its 37 unsafe blocks carries a written justification.
A checker inside the kernel recounts everything the kernel owns against 21 rules. Across 1,001,123 random system calls it ran 3,839 times and found 0 violations.
Memory, tasks and endpoints are lent by a parent to its children and returned when they end, so a program can exhaust its own share and nothing else.
No GRUB and no multiboot. The boot sector is written in Rust too, so the build needs no assembler, no C compiler and no make.
Type crash init and the supervisor itself dies. The kernel then starts every program again.
From the README’s “Build and boot it” section. Full options, requirements and troubleshooting are there too.
Open the README
$ rustup target add i586-unknown-linux-gnu
$ python build.py # compile everything and write build/inti.img
$ python build.py run # boot the image in a QEMU window
$ python build.py test # run every test in QEMU
$ python build.py gates # every check, from a clean buildStraight from the README, so you know what you're getting before you try it.
86 files in the repo · last updated 10 Nov 2026.
Browse the codeRound 1: rogue tries delegation and revocation; dossier shows the new kernel paths
Selftest: checks for revocation, delegation and quotas (82 checks)
Browser, QEMU. You can try it in the browser with nothing to install.
The commands in the “Build and boot it” box above come straight from the README. Paste them into a terminal; the README covers options and troubleshooting.
No: those run real hardware and real programs, while Inti only shows three narrow things in an emulator (drivers that restart, a small Rust kernel that checks itself, and programs that hold no rights by default).
In QEMU 11.1.0 without hardware virtualisation, on the guest's own clock, with restart times taken as the median of 5 runs and every README number computed from the raw logs by a script.
It runs only in an emulator: no hardware is supported beyond an emulated PC. It has no network, no persistent storage, no applications and one processor.
Not yet: it's marked “research toy” and still changing. The README always has the current state.
The source is public on GitHub under the MIT licence.
Juwen Lie, an R&D mechanical engineer in Batam, Indonesia, as an independent personal project.
An OS you can break on purpose
