Immutable, Image-Based Linux for Kubernetes

▶ Watch (0:02)

Kairos is a sandbox project, currently at version 43. It takes standard Linux distributions, Ubuntu and openSUSE among them, and converts them into immutable, image-based systems. Configuration is declarative and container-based, so teams reuse existing Kubernetes tooling. The project targets edge and cloud Kubernetes workloads. By default it ships with K3s and K0s, and community providers extend that to other Kubernetes distributions. The primary goal is simpler day-2 operations: upgrades, rollbacks, and node resets wherever the machine runs.

Trusted Boot in the Field: Two Production Deployments

▶ Watch (1:16)

Deep Network sells access devices and uses Kairos’s trusted boot feature. TPM measures the kernel and initramfs at boot, ensuring the system only runs images signed with Deep Network’s own keys. Arya Imaging uses Kairos on Nvidia boards mounted on tractors to analyze trees and calculate where to spray them. The boards run consistent images that can roll back cleanly. Both cases share the same requirement: an OS the operator cannot tamper with and can update remotely without touching the device.

The Kairos Toolchain: Init, Factory, and Operator

▶ Watch (2:32)

Three tools shipped recently. Kairos init is a one-liner that converts a Dockerfile into a Kairos-ready image. Kairos Factory takes those images and produces bootable artifacts: ISOs, raw disk images, and cloud images. The Kairos Operator connects the two halves by exposing OS-level operations through the Kubernetes API. From a running cluster, operators can upgrade node operating systems directly. No SSH into the machine required. All three tools follow the same pattern: container inputs, declarative config, Kubernetes as the control plane.

A New Linux Distribution and the Project’s First External Maintainer

▶ Watch (3:22)

After working across many Linux distributions, the Kairos team built their own. It is designed as a minimal, upstream-focused system for running Kubernetes in an image-based, immutable way. Morales did not detail the full rationale in the five-minute slot but invited attendees to the project booth at 18A. The project also added its first external maintainer, William Rizzo, field CTO at Mirantis (GitHub: WR code). Rizzo is working on the Kairos copy feature.

Notable Quotes

make uh day2 operations very easy Mauro Morales · ▶ 1:02

Linux distribution because why not, Mauro Morales · ▶ 3:35

Key Takeaways

  • Kairos converts any Linux distribution into an immutable, image-based system for Kubernetes workloads.
  • Trusted boot with TPM lets operators sign node images and block tampering at boot time.
  • Kairos Operator exposes OS upgrade operations through Kubernetes, removing the need for direct node access.

About the Speaker(s)

Mauro Morales is a Guatemalan software developer and Staff Engineer at Spectro Cloud, where he builds Kairos, an open-source Linux distribution for Kubernetes at the edge. He speaks regularly at conferences including KubeCon.