OP-TEE (Open Portable Trusted Execution Environment) is a secure operating system that provides a Trusted Execution Environment (TEE) for ARM and RISC-V platforms. It runs in the secure world of a system-on-chip, isolated from the normal world (e.g., Linux). The OS includes a microkernel, cryptographic libraries (LibTomCrypt, Mbed TLS), hardware abstraction layers for crypto accelerators (CAAM, SE050, Hisilicon, etc.), device drivers (UART, GPIO, I2C, clocks, reset controllers, firewalls), and a framework for trusted applications (TAs) and pseudo TAs. It communicates with the normal world via SMC (Secure Monitor Call) or FF-A (Firmware Framework for Arm A-profile). The architecture is a monolithic kernel with modular driver registration using device tree and initcall macros. Key entry points include boot code (platform-specific main.c), SMC handlers (sm.c, thread_optee_smc.c), and system call handlers (arch_scall.c). Data flows involve secure storage (encrypted file system), cryptographic operations (symmetric/asymmetric ciphers, hashing, key derivation), and remote procedure calls (RPC) for I2C, RPMB, and other services. External dependencies include libfdt (device tree), qcbor (CBOR encoding), and softfloat (IEEE 754 floating-point emulation). The project supports a wide range of hardware platforms (NXP i.MX, STMicroelectronics STM32MP, Qualcomm, Xilinx Versal, Microchip SAMA5, etc.) and is actively maintained with frequent releases.
Bottlerocket is a free, open-source Linux-based operating system purpose-built for hosting containers. It is designed with a strong focus on security, immutability, and reliable updates. The system is configured entirely through an API-driven settings model, with all configuration stored as key-value pairs in a filesystem datastore. It supports multiple orchestrator variants (Amazon EKS, Amazon ECS, VMware, and bare metal) and cloud platforms (AWS, VMware, bare metal), with specialized variants for NVIDIA GPUs and FIPS compliance. The architecture is a minimal, Rust-heavy OS image built via a custom build system (Twoliter). The core components include a settings datastore with serialization/deserialization, a versioned migration framework for safe upgrades/downgrades, per-variant settings plugins loaded as dynamic libraries, and a TUF-based update mechanism with A/B partition flipping. The build system produces bootable images (AMIs, OVAs, raw images) and publishes them to TUF repositories. The codebase is organized as a Cargo workspace with hundreds of small crates, each handling a specific concern (migrations, defaults, plugins, models). Key entry points include the build system (cargo make), the settings datastore library (sources/api/datastore), the migration helpers (sources/api/migration/migration-helpers), and the per-variant settings defaults (sources/settings-defaults). The repository also contains tools for local VM testing, kernel config diffing, and secure boot key generation. While the codebase is well-structured and actively maintained, it suffers from significant duplication across many similar variants (e.g., Kubernetes 1.31 through 1.37) and a large number of archived migrations, which increases maintenance burden.