ARXOS documentation.

01 What ARXOS is

ARXOS is for security work. It supports red team work, blue team work, reverse engineering, and bug hunting. It also works as a daily computer.

ARXOS uses a clean Arch Linux base. It adds a desktop, a package manager, a set of security tools, and a tuned kernel. ARXOS has its own identity. It does not show the names of the projects it uses.

02 Design rules

Each decision follows a fixed order of priorities. When two options conflict, ARXOS chooses the higher priority, even when it is harder.

• Performance. Native speed and no delay you can feel.
• Low resource use. Little RAM, CPU, disk, and power, above all when the computer is idle.
• Features. Many features, but never at the cost of the two rules above.
• Your security. Safe defaults that are hard to misuse.
• Comfort and looks. Last, and still good.

ARXOS ships no AI

ARXOS has no AI assistant and no cloud AI in the product. Nothing on your system talks to a model, and no data leaves your machine for one. The system stays fully yours.

ARXOS is not a large tool dump

The default install has the tools you use often. You install the rest when you need them. A new system stays small, fast, and easy to check.

03 How it is built

ARXOS follows one clear order: speed first, then a light footprint, then features, then safe defaults. When two designs conflict, the team picks the stronger one, even when it is harder to build. Every part runs on real hardware and in a virtual machine before it ships.

What that has produced so far:

• A clean, standard Arch base with no hidden layer.
• A light XFCE desktop: one top panel, a dock, a terminal, and a matching login screen.
• A secure, themed startup: a themed boot menu, a boot screen that shows real progress, and full-disk encryption that asks for your passphrase before the system starts.
• Two tuned kernels, linux-arxos (default) and linux-arxos-rt (real-time), sharing the same tools and privacy features. See section 03b.
• The arx package manager: official repositories and the AUR in one tool, with no extra helper.

04 The desktop

ARXOS uses XFCE. XFCE is fast and uses little memory. There is one top panel with the menu, the tray, and the clock. There is a dock for your common programs.

• One panel and one dock. No extra bars.
• The same dark theme on the desktop, the login screen, and the lock screen.
• The system uses little CPU when it is idle.

05 The terminal and shell

ARXOS uses Konsole as the default terminal. The shell is zsh. Each new terminal opens with a system report and a rotating anime logo. The shell suggests commands as you type, completes with the Tab key, and colours the command line.

• Konsole with a dark theme, a Nerd Font, and a large scroll history.
• zsh with live suggestions, Tab completion, and command colour.
• fastfetch shows the system report and the logo when a terminal opens. It stays fast.
• Every user gets the same terminal, including users you make after install.

Command shortcuts

ARXOS adds short commands, called aliases, for common work. Type aliases to list every one on your system. The tables below group the main shortcuts.

Files and folders

System

Network

Security

Packages and system control

Git and containers

Handy

06 The arx package manager

arx is one command to manage the system and the tools. It uses the package tools for you. It shows clean output and real progress.

# update the system and the ARXOS tools
$ arx update

# install a package: repo, AUR, or a local .deb, .rpm, or .AppImage
$ arx install <name>

# browse the tool set and install it by category
$ arx weapons
$ arx weapons install <category>

• Starts unprivileged. arx runs as you and asks for administrator rights only when an action actually changes the system, never for a search or a query.
• Every pacman flag still works. arx understands the flags you already know (-S, -R, -Q, -U, -Sy, -Syu, -Ss, -Si, -Qo, -Qs, -F) next to its readable names, so nothing you already type has to change.
• One update for everything. A single command covers the system, the kernel, the AUR, and the ARXOS tools.
• Many formats, checked. It installs Arch packages and local .deb, .rpm, .AppImage, and archive files, maps their dependencies to Arch, and scans each maintainer script before it runs.
• Self-healing. arx repairs keyring, mirror, lock, and database errors on its own, so it rarely stops with a failure.

Every command

This is the complete command reference. arx accepts a readable name for every action, and also the short and long pacman forms you already know, so nothing you type has to change. Full detail on any one is arx help <command>.

Install, remove, and update

The AUR (no yay or paru needed)

Find and inspect

Maintain the system

Kernels

The tool set

07 The Control Center

The Control Center is a native app that runs the whole system from one window. Open it from the dock or the menu (or run arxctl). Every panel is live: it reads and writes the real system directly, so there is no config file to apply afterwards. The left rail lists the panels; the footer shows the running kernel.

Privacy and anonymity from the terminal

The Privacy panel drives the anond daemon, and you can run it directly. It is fail-closed: the network is blocked before Tor comes up and only reopens once every check passes, so a half-started state never leaks.

08 The tool set

ARXOS 0.0.1 ships as a single Slim image. It carries the full ArxOS signature toolkit (the package manager, Control Center, anond privacy, droidB, arxguard, and the rest) with none of the security arsenal pre-installed. You add the tools you want on demand, so the image stays lean and fast on first boot.

The arsenal is thousands of tools in four groups: Offensive, Bug Bounty, Defensive, and Research. On Slim you pull in exactly what a job needs, when it needs it, with the weaponry command:

# slim ships no arsenal. add what you need, on demand:
$ arx weapons                       # browse the categories
$ arx weapons install default       # the 40-tool starter loadout
$ arx weapons install bug-bounty    # a whole category
$ arx weapons install top 10        # the ten essentials
$ arx weapons install all           # the entire arsenal

The default loadout: a one-command starter set

The default loadout is 40 tools: the staples a security workstation is expected to have, curated in order of importance. Install them in one command, arx weapons install default. It is the recommended starting point, and everything beyond it is added on demand.

The core ten (ready for combat)

The first ten are the ones most jobs start with. They are also what arx weapons install top 10 installs, and you can ask for any count with top <N>.

The other thirty, by area

The full arsenal by group

Everything else is one command away, arranged in four groups across 50 categories.

09 The linux-arxos kernel

The kernel is the base of the whole system. A good kernel makes every tool faster and more private. linux-arxos uses the latest base and adds an ARXOS configuration and patches.

• It stays responsive under load. The desktop is smooth while scans or builds run.
• It is built for speed. It uses link-time optimization and a modern CPU baseline.
• It includes all drivers by default, like Kali. This covers wireless, MediaTek, Realtek, and more. USB Wi-Fi adapters support monitor mode and packet injection out of the box.
• Privacy is part of the kernel. It supports full-disk encryption, radio and camera control, address spoofing, and memory wiping.
• Updates are safe. Live patches apply fixes without a restart. ARXOS keeps a known-good kernel so you can roll back, and new kernels arrive over the air through arx.
• Two kernels, your choice. linux-arxos is the default daily driver. linux-arxos-rt is a real-time build for RF, SDR, and wireless capture, where timing must be exact. Both carry the same tools and privacy features; you pick the real-time one from the boot menu when you need it.

What it brings to each kind of user

10 Patches and tunes

ArxOS changes the base for speed, low latency, and privacy. The changes are in the kernel and in the system defaults.

Kernel

• Responsive scheduler. The desktop stays smooth while scans and builds run.
• Built for modern CPUs. Link-time optimization and a modern instruction baseline.
• All drivers by default, like Kali. Wireless, MediaTek, Realtek, and more. USB Wi-Fi adapters support monitor mode and packet injection.
• Privacy in the kernel. Full-disk encryption, address spoofing, radio and camera control, and memory wipe.

System

• One glass panel and a centred dock, the same on every user account.
• Konsole with zsh as the default terminal, with suggestions, completion, and a fast system report on each start.
• Hardened browsers. Firefox, Waterfox, and Brave ship with telemetry off, tracking blocked, HTTPS only, and no address leak. The hardening survives browser updates. If you ever install a browser later, or a reset clears it, open the Control Center and press Patch browsers to re-apply the ARXOS hardening to Firefox, Waterfox, and Brave at any time.
• Low idle use. The system uses event triggers, not polling, so it stays quiet when you do not work.

11 DEATHSTROKE

SKIP THIS ON 0.0.1. Leave it switched off. DEATHSTROKE is in a super experimental stage and is still in active build. Do not enable it during installation on this release. Its purpose is to destroy the encryption keys, the erase cannot be undone, and its pre-boot path has not been verified from an installed system yet. It also takes over the boot prompt, which is where a forgotten or rejected password is recovered, so an armed machine cannot be rescued that way. Read this section to understand what it will do, then leave the option off until a release says otherwise.

Experimental. Proceed with caution. DEATHSTROKE destroys data on purpose and the erase cannot be undone. Exercise it in a virtual machine before you arm it on a real system, keep the one-time recovery key somewhere off that machine, and never arm it on a system holding your only copy of anything. It is off unless you explicitly enable it during installation.

DEATHSTROKE is emergency data destruction for an encrypted ArxOS machine. You arm it while you install, and from then on it protects the disk if you are ever forced to hand the computer over. It is off unless you turn it on, and it only takes effect on a disk you chose to encrypt.

What it is

When you enable it during install, you choose a duress phrase next to your normal disk passphrase. The duress phrase looks like an ordinary password, but it does the opposite of unlocking: typed at any password prompt, it destroys the disk's encryption keys in an instant. There is no undo, and nothing on the outside shows that a machine is armed. Someone who forces you to open the laptop cannot tell the real passphrase from the one that wipes it.

How it works

Changing it after install

Everything is managed from one command, dsctl, in a terminal. You can change the duress phrase, check what is set, or turn the whole thing off at any time.

# change the duress phrase (it asks twice; the phrase itself is never stored)
$ sudo dsctl set-duress

# see what is set: is a phrase enrolled, is it armed, is a recovery key saved
$ sudo dsctl status

# confirm a phrase is the one you think it is, without triggering anything
$ sudo dsctl verify

# trigger the wipe on purpose (asks for your duress phrase to confirm; recovery key still works)
$ sudo dsctl panic

# turn DEATHSTROKE off: removes the duress trigger, keeps your data and encryption
$ sudo dsctl disarm

set-duress replaces the old phrase the instant it finishes, so changing it is immediate. verify only reports a match or no match, it never wipes anything, so it is safe to use to jog your memory. panic is the plain-terminal way to set off the wipe when you cannot get to a password prompt: it only runs when DEATHSTROKE is armed and only after you re-enter your duress phrase, so it cannot fire by accident. disarm removes only the duress trigger: your disk stays encrypted and your normal passphrase keeps working exactly as before.

12 What is new

ArxOS is in active development. Recent changes:

• One login and lock screen. The ArxOS greeter is the login screen, the lock screen, and the default for every user. It shows a welcome, a session picker, and a clear error on a wrong password.
• Same look for all users. The glass panel, the dock, the wallpaper, and the terminal apply to every account, new or old.
• Hardened Firefox, Waterfox, and Brave. Private, debloated defaults, a local welcome page, and a link to this documentation.
• Terminal report. Each terminal opens with a fast system report and a rotating image.

13 Arch Wiki help

ArxOS uses a clean Arch base, so the Arch Wiki answers most questions. Paste an error message or type a keyword to search the wiki.

Paste the whole error. It recognizes common Arch failures, shows the likely fix and the exact command, and links the canonical wiki page. It searches as you type.

Explain a shell command

Type or paste any command to see what each part does, flag by flag, from the man pages. A fast way to read a command you do not recognise yet while you study.

Powered by explainshell. It splits the command into its options and shows the matching man-page text. open in a tab

14 Updates

ARXOS does not use a fast, unstable update stream. Updates are tested, stable snapshots. arx delivers the system and the tools from one place. A change reaches you only when it passes the tests.

$ arx update        # update the system and the ARXOS tools

15 Recovering a login

ARXOS 0.0.1 is a beta release. On this build the login screen can reject the password you chose during installation. You do not need to reinstall. You can set a new password from the boot menu, and the steps are below.

This affects 0.0.1 only. The cause is understood and already fixed in the installer, the fix simply came after this image was built. 0.0.2 will ship with all of these fixes included, so a fresh install of 0.0.2 will not need any of this. If you are already running 0.0.1, you do not have to wait for it: recover the login with the steps below and then run arx update, which brings your tools and Control Center up to date without reinstalling.

What you need first: your disk passphrase, the one you typed when you set up encryption. That still works. It is the account password that is affected, not the encryption.

1. Start the computer and stop at the ARXOS boot menu. If it goes straight past, hold Shift while it starts, or tap Esc.
2. With the first entry highlighted, press e. Do not press Enter. This opens the entry for editing.
3. Use the arrow keys to reach the line that starts with linux. It is the long one and it already contains root= and cryptdevice=UUID=. Leave everything on it exactly as it is.
4. Press End to jump to the end of that line, then type a space followed by:
   add to the end of the linux line

   init=/bin/bash

   Type nothing else. Do not remove cryptdevice=, or the disk cannot be unlocked.
5. Press Ctrl+X to start it. On some machines the key is F10. This change is temporary and applies to this one boot only; nothing on disk is modified.
6. Type your disk passphrase at the unlock prompt, the same one you always use. The screen may show plain text rather than the usual graphical prompt.
7. You arrive at a plain shell as root, with a prompt like bash-5.2# and no password asked. The keyboard is US layout at this point, so if your password contains symbols, keep that in mind while typing.
8. Make the disk writable. Until you do, the next steps cannot save anything:
   root shell

   # mount -o remount,rw /

9. Check your exact user name, since the next commands need it spelled correctly:
   root shell

   # ls /home

10. Set a new password. Replace yourname with what you just saw. It asks twice and shows nothing while you type:
    root shell

    # passwd yourname

    It must answer password updated successfully. If it complains the password is too short or too simple, choose a longer one; it will still accept it if you confirm.
11. Clear the failed-attempt lock that the earlier rejections will have set. Without this, a correct password can still be refused for a few minutes:
    root shell

    # faillock --user yourname --reset

12. Clear any pending forced password change. If this flag is set, the login screen accepts your password and then refuses the session anyway, because it has nowhere to ask you for a new one:
    root shell

    # chage -d "$(date +%F)" yourname

13. Write it all to disk. Do not skip this, or the change can be lost:
    root shell

    # sync

14. Restart. Either hand over to the normal startup:
    root shell

    # exec /sbin/init

    or, if that stalls or looks wrong, simply hold the power button for a few seconds and start the computer again. The new password is already saved, and the boot menu edit was temporary, so it starts normally.
15. Log in with the new password.

$ arx update

If you are not asked for a disk passphrase at step 5, you installed without encryption. Everything else is the same.

If the boot menu will not let you press e, start from the ARXOS USB drive instead, open a terminal on the live desktop, unlock and mount your installed system, and run the same passwd there. Ask on GitHub if you need a hand with that path.

16 What is coming in 0.0.2

0.0.2 is what the team is building now. It carries every fix described above, so a fresh install will not meet the login problem at all. Items marked in progress are being worked on and are not promises.

The installer

• The login defect is fixed at the source. The installer used to read the password field as plain text when the installer framework stores it obscured, so the account ended up holding a different password than the one you typed. Each field is now decoded by its own contract, and the install refuses to finish rather than leave you with an account you cannot enter.
• Failed-attempt locking is tuned so ordinary typos cannot lock you out of your own machine, and that policy ships as part of the system instead of relying on upstream defaults.
• A duress phrase that matches your real password is rejected, rather than quietly arming a machine that would erase itself when you log in normally.
• The filesystem table and bootloader steps fail loudly instead of continuing, so a half-installed system is never handed over as finished.
• Dock launchers are repaired for existing accounts without administrator rights, which also closes a privilege-escalation hole in the old repair.

Control Center

• Rebuilt as a native Rust and GTK4 application instead of a web view. Cold start of the application grid dropped from about 1.8 seconds to roughly 0.2.
• Ricing: themes and accent colours, window buttons and titles, fonts, a floating rounded top bar with adjustable width, height and icon size, dock opacity, rounding, position and icon size, menu opacity, clock style, blur and corners, plus macOS, classic and custom presets. Every change applies to the running desktop at once and is saved as the system-wide default, which new accounts inherit at their next login.
• Show Applications grid, and a lock screen that follows your wallpaper slideshow or holds a single picture.
• Performance reads and writes the real kernel controls across every core, and states plainly when your processor exposes an energy preference rather than a governor choice.
• Network shows live throughput per interface and can close listening ports. Privacy drives the anonymity daemon. Kernels installs and removes kernel builds. Snapshots reaches system restore points.

Bluetooth and audio, new in 0.0.2

• Headphone battery on screen. AirPods and Beats report each bud and the case with no pairing needed, and other headsets report through the standard Bluetooth battery service. A small pill appears when the case opens, when charge runs low, and when the device goes away. Verified against real hardware.
• Find nearby, a proximity finder that reads warmer as you get closer to the device.
• Spatial audio, a head-related transfer function that places sound around you on any headphones. Stated plainly: this is virtual surround. Dolby Atmos cannot be licensed on Linux and is not what this is.
• A 15-band equalizer with presets, chained with spatial audio so both can run at once and both apply to the device you are actually listening on.
• Noise control and ear detection, in progress. The control channel to the earbuds works and its replies are decoded, including the noise-control mode and whether a bud is in your ear. The panel that exposes it is still being built.

Kernel

• 0.0.1 ships linux-arxos 7.2.5-1. The upstream stable series has moved on since that build, so 0.0.2 is expected to carry a refreshed linux-arxos on a newer 7.2 stable base, in both the default and the real-time flavour, with the same hardening and tuning. The exact version is fixed when it is built and boot-tested, not announced beforehand.
• Kernel updates do not need a new image. They arrive through arx.

You do not have to wait for the image

Tools and the Control Center are delivered separately from the ISO, so running arx update on 0.0.1 brings those up to date as they land and most of the list above reaches an existing install without reinstalling. The installer fixes and the kernel are the parts that want the new image.

17 Get ARXOS

ARXOS is in development. The team makes each release complete before it publishes the release. The download opens when ARXOS is ready.

ARXOS 0.0.1 ships as a single Slim image, with the complete ArxOS toolkit, encrypted install, and optional DEATHSTROKE:

• Slim (the 0.0.1 image): the ArxOS toolkit with none of the arsenal pre-installed. Add security tools on demand with arx weapons. Lean and recommended.
• Write the image to a USB drive, start the computer from it, and install ARXOS with full-disk encryption in a few steps.
• Starting the installer. Once the live desktop loads, open the Install ARXOS option from the menu. You reach the menu from the foot icon at the left of the bottom dock, or by right-clicking anywhere on the desktop to open the XFCE Applications menu. The installer is listed there.
• Follow the work on GitHub while the team builds the release.

18 Project and source

ARXOS is built by a small team. The operating system, its tools, and this site are in the thearxos organization on GitHub. The tools are separate projects that update themselves.

The team

• Code and releases. github.com/thearxos
• Site. arxos.uk
• Contact. contact@oxborn3.com

19 FAQ

The questions people ask about almost any Linux distribution, answered for ARXOS.

Is ARXOS free and open source?

Yes. It is free to download and use. The operating system, its tools, and this site live in the thearxos organization on GitHub, and the tools are open projects.

What is ARXOS based on?

It is built on Arch Linux and follows a rolling model, so you install once and keep updating rather than reinstalling for each release. On top of that base ARXOS adds its own kernel, desktop, package manager, security tools, and hardened defaults.

What are the system requirements?

A 64-bit (x86_64) computer that boots in UEFI mode, 4 GB of RAM (8 GB or more is comfortable when you run virtual machines or heavy tools), and about 30 GB of free disk space. A solid-state drive is recommended for the best feel.

Can I keep Windows and dual-boot?

Yes. The installer can use free space alongside an existing system. Back up your data first, and install in UEFI mode to match most modern machines. If you are unsure, try it in a virtual machine before touching your main disk.

Is it beginner-friendly?

The installer is graphical and guided, and the install guide on this site walks every screen. Day to day it is a normal desktop. You will get the most out of the security tools if you are comfortable opening a terminal, and the docs are written to help you get there.

How do I get updates?

One action updates everything: the system packages, the kernel, and the ARXOS tools, together. Run arx update in a terminal or use the Update panel in the Control Center. New kernels arrive over the air and verify themselves before they install.

Does ARXOS collect telemetry or phone home?

No. There is no usage tracking. The browser ships with telemetry off and tracking blocked, DNS defers to the anonymity daemon rather than leaking, and privacy is a default rather than a setting you have to find.

Is it secure out of the box?

The defaults are hardened: optional full-disk encryption at install, a hardened kernel, a hardened browser, and a zero-trust shell guard that checks commands before they run. No operating system is unbreakable, so ARXOS focuses on safe defaults and honest limits, and adds optional emergency protection with DEATHSTROKE.

Which kernel should I use, default or real-time?

Use the default linux-arxos for everything. Pick linux-arxos-rt from the boot menu only when you need exact timing, such as radio, SDR, and wireless capture. Both carry the same tools and privacy features.

Can I game on it?

Gaming is not the focus of this version, so no game launchers or vendor graphics drivers are bundled. The responsive kernel and current graphics support keep the desktop quick, and a gaming-focused edition is planned for later.

Where do I get help or report a problem?

Open an issue at github.com/thearxos, use the Arch Wiki for base-system questions since ARXOS builds on Arch, or email contact@oxborn3.com.