TamaGo is a bare-metal Go framework that enables running Go programs directly on hardware without an operating system or C runtime. It provides a modified Go runtime (GOOS=tamago) and a comprehensive set of drivers for ARM, ARM64, AMD64, RISC-V, and LoongArch architectures, covering SoCs from NXP, Raspberry Pi, SiFive, Microchip, Nuvoton, and others. The framework includes low-level initialization, exception handling, MMU, cache control, timers, interrupt controllers (GIC, LAPIC), and peripheral drivers for UART, I2C, SPI, USB device, Ethernet (ENET, gVNIC), SD/MMC, DMA, and cryptographic accelerators (CAAM, DCP). It also supports confidential computing features like AMD SEV-SNP and ARM TrustZone, as well as KVM paravirtualization with VirtIO and pvclock. The architecture is library-based: the `cmd/tamago` tool manages a custom Go distribution, while the runtime hooks (ramStart, printk, nanotime) are linked into Go via `go:linkname` from board and SoC packages. Each board package provides initialization functions that configure pin muxing, clocks, and peripherals. The code is production-grade, used in real projects like GoKey (smartcard), GoTEE (TEE), and ArmoredWitness. The repo is actively maintained, with a large number of supported platforms and a focus on security and minimal attack surface.
Hermit-rs is a Rust-based unikernel (library OS) that enables applications to run directly on hardware or hypervisors without a traditional operating system. The repository provides the build infrastructure (the `hermit` crate), the system call ABI (`hermit-abi`), and a collection of example applications demonstrating networking, file systems, TLS, WASM execution, and more. The actual kernel is maintained in a separate submodule. The project is actively developed with CI testing across x86_64, aarch64, and riscv64 architectures, and supports running under QEMU, Uhyve, and KVM. It is a hybrid of a system library and an application framework, but its dominant character is an application platform for building unikernel images.
Solo5 is a sandboxed execution environment for unikernels, providing a minimal, legacy-free interface between unikernel applications and host systems. It supports multiple backends: hvt (hardware virtualization via KVM, FreeBSD/OpenBSD/DragonFly vmm), spt (Linux seccomp sandbox), virtio (QEMU/bhyve), Xen, and Muen. The architecture consists of guest-side bindings (implementing the solo5_* API) and host-side tenders (loaders/runtime components). Key entry points include the guest's _start() in each binding's start.c and the tender's main (e.g., hvt_main.c, spt_main.c). Data flows are synchronous: unikernels communicate via hypercalls (hvt), seccomp-allowed syscalls (spt), or Xen hypercalls, with shared-memory ring buffers for I/O. External dependencies include libseccomp (spt), KVM/BSD hypervisor APIs, and vendored Xen public headers. The project originated from IBM Research and is used by MirageOS and other unikernel frameworks.
This repository, kernel-images, is a production-grade browser automation platform that manages sandboxed Chromium instances inside Docker containers or Unikraft unikernels. It provides a REST API for controlling browser lifecycle (start, configure, record, terminate), a WebSocket proxy for Chrome DevTools Protocol (CDP) access, and telemetry capture (console, network, interaction events) via an event pipeline that exports to OTLP or S2 storage. The system supports headful and headless modes, with a Vue.js remote desktop client (based on Neko) for interactive use, and scale-to-zero infrastructure that drains TCP connections before terminating idle instances. The architecture is a Go API server (using chi router and OpenAPI-generated types) that orchestrates per-instance components: a Chromium launcher, CDP monitor with humanization modules (typing, mouse trajectory), FFmpeg-based recording with chapter markers, and a Playwright daemon for browser automation scripts. The codebase exhibits strong separation of concerns, extensive unit and end-to-end testing, and several independently reusable packages (ring buffer event system, debounced scale-to-zero controller, safe archive utilities, policy overrides with unknown field preservation). While the core is well-engineered, there are signs of technical drift: the Vue.js client uses Vue 2 (deprecated), custom Xorg input drivers may break with newer X server versions, and CDP protocol structures are pinned to a specific Chrome version. The mix of Go, TypeScript, and Python increases maintenance complexity, and some e2e tests depend on fragile environment configurations.