ARXOS documentation.
ARXOS is a security operating system. It uses a clean Arch Linux base. This page explains what ARXOS is, how the team builds it, and how to use it.
Version 0.0.1. ARXOS is in development. This page marks what is done and what is still in progress.01 What ARXOS is
ARXOS is for security work. It supports red team work, blue team work, reverse engineering, and bug hunting. It also works as a daily computer.
ARXOS uses a clean Arch Linux base. It adds a desktop, a package manager, a set of security tools, and a tuned kernel. ARXOS has its own identity. It does not show the names of the projects it uses.
Fast
Native speed and low idle use are requirements. Heavy code is compiled, not scripted.
Small by default
The base install is small. It has a set of top tools. You add the full tool set when you need it.
Private
ARXOS checks each command before it runs. The kernel adds anonymity. The default settings are safe.
One system
Each part of ARXOS helps the other parts. They are built together.
02 Design rules
Each decision follows a fixed order of priorities. When two options conflict, ARXOS chooses the higher priority, even when it is harder.
- Performance. Native speed and no delay you can feel.
- Low resource use. Little RAM, CPU, disk, and power, above all when the computer is idle.
- Features. Many features, but never at the cost of the two rules above.
- Your security. Safe defaults that are hard to misuse.
- Comfort and looks. Last, and still good.
ARXOS ships no AI
ARXOS has no AI assistant and no cloud AI in the product. Nothing on your system talks to a model, and no data leaves your machine for one. The system stays fully yours.
ARXOS is not a large tool dump
The default install has the tools you use often. You install the rest when you need them. A new system stays small, fast, and easy to check.
03 How it is built
ARXOS follows one clear order: speed first, then a light footprint, then features, then safe defaults. When two designs conflict, the team picks the stronger one, even when it is harder to build. Every part runs on real hardware and in a virtual machine before it ships.
What that has produced so far:
- A clean, standard Arch base with no hidden layer.
- A light XFCE desktop: one top panel, a dock, a terminal, and a matching login screen.
- A secure, themed startup: a themed boot menu, a boot screen that shows real progress, and full-disk encryption that asks for your passphrase before the system starts.
- Two tuned kernels, linux-arxos (default) and linux-arxos-rt (real-time), sharing the same tools and privacy features. See section 03b.
- The arx package manager: official repositories and the AUR in one tool, with no extra helper.
04 The desktop
ARXOS uses XFCE. XFCE is fast and uses little memory. There is one top panel with the menu, the tray, and the clock. There is a dock for your common programs.
- One panel and one dock. No extra bars.
- The same dark theme on the desktop, the login screen, and the lock screen.
- The system uses little CPU when it is idle.
05 The terminal and shell
ARXOS uses Konsole as the default terminal. The shell is zsh. Each new terminal opens with a system report and a rotating anime logo. The shell suggests commands as you type, completes with the Tab key, and colours the command line.
- Konsole with a dark theme, a Nerd Font, and a large scroll history.
- zsh with live suggestions, Tab completion, and command colour.
- fastfetch shows the system report and the logo when a terminal opens. It stays fast.
- Every user gets the same terminal, including users you make after install.
Command shortcuts
ARXOS adds short commands, called aliases, for common work. Type aliases to list every one on your system. The tables below group the main shortcuts.
Files and folders
| ll, la, lt, lz | List files: long, all, newest first, largest first. |
| lsd, lsf | List only folders, or only files. |
| .. ... .... | Go up one, two, or three folders. |
| mkcd <dir> | Make a folder and enter it. |
| extract <file> | Unpack any archive: zip, tar, gz, 7z, rar, and more. |
| backup <file> | Make a dated copy of a file. |
| bigfiles, duh, countfiles | Find large files, show folder sizes, count files. |
| fhere <name>, ftext <text> | Find a file by name, or find text in files. |
System
| sysinfo, temps | Show full system information, and sensor temperatures. |
| meminfo, procs | Show memory use, and the busiest programs. |
| df, free, diskinfo | Show disk space, memory, and a storage overview. |
| boot-time, boot-blame | Show start time, and what slows the start. |
| service-start|stop|restart | Control a system service by name. |
| service-failed, logs, logs-follow | Show failed services and system logs. |
Network
| localip, myip, gateway | Show your local address, public address, and gateway. |
| ports, portsopen | List network ports, and open listening ports. |
| wifi, wifi-connect | List Wi-Fi networks, and connect to one. |
| ping1, ping8 | Test the connection to 1.1.1.1 or 8.8.8.8. |
| show-MAC | Show the interface, addresses, and gateway MAC. |
| portcheck <host> <port> | Check if a port is open on a host. |
| speedtest, headers <url> | Test speed, or read the headers of a page. |
Security
| nmap-quick <target> | Scan open ports with service detection. |
| nmap-ping <range> | Find live hosts on a network. |
| arxos-selfscan | Scan your own machine for open ports. |
| genpass, sha <file> | Make a strong password, or hash a file. |
Packages and system control
| update | Refresh and update the whole system. |
| install <name>, remove <name> | Install or remove a package. |
| search <text>, orphans | Search packages, or remove unused ones. |
| arxos-health | Show a full health report of the system. |
| arxos-boostmode, arxos-powersave | Set the CPU for speed or for low power. |
| arxos-cpu-status | Show the current CPU mode. |
| mirrors | Pick the fastest download mirrors. |
Git and containers
| gs, ga, gc, gp, gl, gd, gpl | Git: status, add, commit, push, log, diff, pull. |
| dps, di, dcu, dcd | Docker: list, images, compose up, compose down. |
| dclean | Remove unused Docker data. |
Handy
| reload, aliases | Reload the shell, or list every shortcut. |
| weather, calc, now | Show the weather, a calculator, the date and time. |
| http-server, serve | Share the current folder over HTTP. |
| cheat <topic> | Show a quick help sheet for a command. |
06 The arx package manager
arx is one command to manage the system and the tools. It uses the package tools for you. It shows clean output and real progress.
# update the system and the ARXOS tools $ arx update # install a package: repo, AUR, or a local .deb, .rpm, or .AppImage $ arx install <name> # browse the tool set and install it by category $ arx weapons $ arx weapons install <category>
- arx repairs keyring, mirror, lock, and database errors on its own. It rarely stops with a failure.
- One update command covers the system and the ARXOS tools.
- arx installs many package formats, so you are not stuck on one file.
Every command
arx accepts a readable name for every action. It also accepts the short and long forms you already know, so nothing you type has to change.
Install and update
| arx install <name> | Install from the repositories or the AUR. Also: -S, -Sync, --sync. |
| arx install ./file | Install a local file: an Arch package, or a .deb, .rpm, .AppImage, or archive. Also: -U, --upgrade. |
| arx remove <name> | Remove a package and its unused dependencies. Also: -R, -Remove, --remove. |
| arx update | Refresh the databases and upgrade the system, the kernel, and the ARXOS tools. Also: upgrade, -Syu. |
| arx refresh | Refresh the package databases only. Also: -Sy. |
| arx downgrade <name> | Roll a package back to an earlier cached version. |
| arx aur upgrade | Rebuild every installed AUR package that has a newer version. No helper needed. Also: -Sua. |
| arx hold <name> | Keep a package back on upgrade. Release it with arx unhold <name>. |
| arx pip <args> | Run pip with the Arch system-package flag handled for you. |
Find and inspect
| arx search <text> | Search the repositories and the AUR. Results are labelled by source. Also: -Ss, s. |
| arx info <name> | Show a package's details. Also: -Si, show. |
| arx query <name> | Look up an installed package. Also: -Q, -Query, --query. |
| arx -Qi <name> | Show an installed package's full details. Search installed packages with -Qs <text>. |
| arx -Qe | List packages you installed yourself. -Qm lists foreign packages (from the AUR or a local build). |
| arx list | List everything installed. Also: ls, installed. |
| arx files <name> | List the files a package owns. Also: -F, -Files, --files. |
| arx owns <path> | Find which package owns a file. Also: -Qo, whoowns. |
| arx provides <name> | Find what provides a name. Also: prov. |
| arx outdated | List packages with a newer version available. Also: updates. |
| arx deptest <name> | Report dependencies that are not satisfied. Also: -T, -Deptest, --deptest. |
Maintain the system
| arx orphans | List packages that nothing needs any more. |
| arx autoremove | Remove those orphans. Also: sweep. |
| arx clean | Clean the package cache. Add --all to remove everything. Also: -Sc, -Scc. |
| arx doctor | Check the package database for problems. Also: -D, -Database, --database. |
| arx keys | Repair the keyring. |
| arx mirrors | Rank the download mirrors by speed. |
| arx force-remove <name> | Remove a package even if others depend on it. Also: -Rdd. |
Kernels
| arx kernels list | List the ArxOS kernels you can install, with their status. |
| arx kernel install <flavor> | Install a kernel and its headers, checksum-verified. Flavors: linux-arxos (default) and linux-arxos-rt (real-time). |
| arx kernel remove <flavor> | Remove a kernel and its headers. The kernel you are running and the last one left are protected. |
The tool set
| arx weapons | Browse the tool set by category. arx weapons <category> lists one; arx weapons list-all lists every tool. |
| arx weapons install default | Install the recommended loadout: the essential tools most jobs start with. |
| arx weapons install top <N> | Install the top N essential tools, e.g. arx weapons install top 10. |
| arx weapons install <category> | Install a category (or cat <name>), e.g. bug-bounty, research. Use all for the whole arsenal. The first install sets things up for you. |
| arx weapons remove <category> | Remove a category, the default set, or all. |
| arx self-update | Update the ArxOS tools from the ArxOS registry. Also: tools. |
07 The tool set
ARXOS ships lean, on purpose. It pre-installs only a small, curated default loadout: the essential tools most work starts with, across recon, web, exploitation, passwords, wireless, Active Directory, reverse engineering, and forensics. Everything else stays out of the image, so the system boots fast, stays light, and never carries thousands of tools you will not touch.
The full arsenal is thousands of tools in four groups: Offensive, Bug Bounty, Defensive, and Research. You add exactly what a job needs, when it needs it. The recommendation is simple: stay lean. Pull in a category for the task in front of you rather than installing everything by default. Your system stays quick, and your tools stay easy to find.
# the default loadout is already installed. add more, on demand: $ arx weapons # browse the categories $ arx weapons install bug-bounty $ arx weapons install top 10 # the ten essentials $ arx weapons install all # the whole arsenal, if you must
What is pre-installed: the default loadout
About 40 essential tools ship with ARXOS, the ones most work starts with. Everything else is added on demand.
| Recon | nmap, masscan, amass, subfinder, theHarvester, recon-ng, dnsenum, whatweb, wafw00f |
| Web | burpsuite, sqlmap, nikto, ffuf, gobuster, feroxbuster, wpscan, nuclei, wfuzz, dirsearch, dalfox, gospider |
| Passwords | hydra, john, hashcat, hashid |
| AD & network | netexec, impacket, responder, bloodhound, enum4linux-ng, crackmapexec |
| Wireless | aircrack-ng |
| Exploitation | metasploit |
| RE & forensics | radare2, binwalk, foremost, volatility3 |
| Traffic & lists | wireshark, tcpdump, seclists |
The full arsenal by group
Everything else is one command away, arranged in four groups across 50 categories.
| Offensive | 824 tools: recon, web, exploitation, wireless, passwords, C2, and more. |
| Bug Bounty | 1,339 tools: the largest group, tuned for web and application testing. |
| Defensive | 290 tools: forensics, incident response, blue-team tooling. |
| Research | 413 tools: reverse engineering, crypto, hardware, and analysis. |
| Total | 2,866 tools across 50 categories. |
08 The linux-arxos kernel
The kernel is the base of the whole system. A good kernel makes every tool faster and more private. linux-arxos uses the latest base and adds an ARXOS configuration and patches.
- It stays responsive under load. The desktop is smooth while scans or builds run.
- It is built for speed. It uses link-time optimization and a modern CPU baseline.
- It includes all drivers by default, like Kali. This covers wireless, MediaTek, Realtek, and more. USB Wi-Fi adapters support monitor mode and packet injection out of the box.
- Privacy is part of the kernel. It supports full-disk encryption, radio and camera control, address spoofing, and memory wiping.
- Updates are safe. Live patches apply fixes without a restart. ARXOS keeps a known-good kernel so you can roll back, and new kernels arrive over the air through arx.
- Two kernels, your choice. linux-arxos is the default daily driver. linux-arxos-rt is a real-time build for RF, SDR, and wireless capture, where timing must be exact. Both carry the same tools and privacy features; you pick the real-time one from the boot menu when you need it.
09 Patches and tunes
ArxOS changes the base for speed, low latency, and privacy. The changes are in the kernel and in the system defaults.
Kernel
- Responsive scheduler. The desktop stays smooth while scans and builds run.
- Built for modern CPUs. Link-time optimization and a modern instruction baseline.
- All drivers by default, like Kali. Wireless, MediaTek, Realtek, and more. USB Wi-Fi adapters support monitor mode and packet injection.
- Privacy in the kernel. Full-disk encryption, address spoofing, radio and camera control, and memory wipe.
System
- One glass panel and a centred dock, the same on every user account.
- Konsole with zsh as the default terminal, with suggestions, completion, and a fast system report on each start.
- Hardened browsers. Firefox and Brave ship with telemetry off, tracking blocked, HTTPS only, and no address leak. The hardening survives browser updates.
- Low idle use. The system uses event triggers, not polling, so it stays quiet when you do not work.
10 What is new
ArxOS is in active development. Recent changes:
- One login and lock screen. The ArxOS greeter is the login screen, the lock screen, and the default for every user. It shows a welcome, a session picker, and a clear error on a wrong password.
- Same look for all users. The glass panel, the dock, the wallpaper, and the terminal apply to every account, new or old.
- Hardened Firefox and Brave. Private, debloated defaults, a local welcome page, and a link to this documentation.
- Terminal report. Each terminal opens with a fast system report and a rotating image.
11 Arch Wiki help
ArxOS uses a clean Arch base, so the Arch Wiki answers most questions. Paste an error message or type a keyword to search the wiki.
Paste the whole error. The finder pulls out the useful words and shows the closest wiki pages here.
12 Updates
ARXOS does not use a fast, unstable update stream. Updates are tested, stable snapshots. arx delivers the system and the tools from one place. A change reaches you only when it passes the tests.
$ arx update # update the system and the ARXOS tools
13 Get ARXOS
ARXOS is in development. The team makes each release complete before it publishes the release. The download opens when ARXOS is ready.
- Write the image to a USB drive. Start the computer from the USB drive. Install ARXOS with full-disk encryption in a few steps.
- Follow the work on GitHub while the team builds the release.
14 Project and source
ARXOS is built by a small team. The operating system, its tools, and this site are in the thearxos organization on GitHub. The tools are separate projects that update themselves.
The team
0xb0rn3
Founder and lead engineer. Kernel and security architecture: the linux-arxos kernel, the hardening doctrine, OPSEC, and anonymization.
chinam0k
Systems and desktop engineer. The desktop, the terminal, the login and lock screen, the browser experience, and this site.
lukk4n
Packaging and distribution engineer. The arx package manager, arxctl, the kernel history, and the update pipeline.
- Code and releases. github.com/thearxos
- Site. arxos.uk
- Contact. contact@oxborn3.com