Current · Apache-2.0

CuOS – Container Update OS

An operating system that updates like a container.

Why

Devices in the field need security updates for ten years and more. Every update can cause an outage. That is why updates are often put off (especially in OT). CuOS makes them systematic and repeatable.

Update
whole system at once, automatic rollback
Runs on
x86_64, LXC, 64-bit Raspberry Pi
In production
base of a commercial product, 20+ environments
Since
2025
How it works

The whole operating system is a container image. It is built from a Dockerfile and shipped through a registry. An update replaces the root filesystem at once. The new image goes into the second of two slots on Btrfs, and the device boots it. If it does not come up, the device rolls back to the old one on its own. So no device is left with a half-finished update.

CuOS is made for devices nobody stands in front of. These include edge devices, kiosks, embedded systems and VMs. CuOS started in 2025. Since early 2026 a commercial product has been built on it. CuOS runs in production in more than 20 environments on x86_64, LXC and 64-bit Raspberry Pi.

Part of CuOS · Apache-2.0

CuOS IaC

Devices that configure themselves from Git.

Why

Managing and updating many different devices takes a lot of effort. That is why edge devices and even servers are often only half set up and rarely well updated. CuOS IaC makes setup simple (it can even be automated with AI) and updates scalable.

Model
devices pull, nothing is pushed
Offline
keeps running the last state
In use
30+ systems in companies and households
Since
2025, the idea since 2018
How it works

The services, versions and configuration of a system live in a Git repository. Every device pulls it and applies it locally. It can verify the commit signatures. A small web interface on each device shows its state and logs. About six environments with more than 30 systems run on it in several companies and private households. It is the default init app of CuOS.

The idea goes back to sysgit. I wrote this Git-based provisioning toolkit for Debian in 2018.

Coming soon

BrainDesk

A shared second brain in plain Markdown.

Why

AI agents work best with files they can read and write directly. Teams need a good interface for them. BrainDesk brings both together in the same Markdown files.

Storage
Markdown files and Git, no database
For people
WYSIWYG editor, typed documents, boards
For agents
the same files, nothing hidden
Since
2026
How it works

BrainDesk is a collaborative web interface for a knowledge base made of Markdown files. It offers a WYSIWYG editor, typed documents, boards and Git sync, and it needs no database. The files are the only source of truth, which makes the knowledge base just as readable for an AI agent as for a person.

I plan and steer my own projects with it, including this website.

From research · MIT

osiota

IoT where data stays where it is needed.

Why

Energy management needs a lot of data and control. Attackers can exploit exactly that. So osiota makes data accessible on site and keeps it local where possible.

Apps
around fifteen, from Modbus to DMX
Runs as
Node.js, or as a container image
Origin
my research at TU Braunschweig
Status
still maintained
How it works

osiota is a JavaScript platform that runs distributed IoT applications for energy management, smart homes, and building and studio automation. Several osiota processes connect in layers from the devices through the building to the cloud. They share devices and applications. Each layer processes its own data and passes on only what the next one needs. That way data stays where it is needed. Apps for GPIO, 1-Wire, Modbus, DMX, Art-Net and more live in the osiota organisation.

Smaller tools

Others use these small libraries and tools, too.

More on GitHub →

Let's talk

Let's make security last, together.

Building machines or software for industry and wondering what the CRA means for your product line? Write to me or connect with me. I'm happy to exchange experiences.

Connect on LinkedIn →Email