KINGAI OS Server

Version and status

Version 0.1.0-dev, published October 6, 2026, amd64, no desktop environment. It is a server developer preview and is not certified for production, so do not deploy it on a machine that runs real workloads.

What is included

• Minimal headless installer, per the release notes
• OpenSSH for remote login
• Podman container runtime
• cloud-init provisioning
• Fail2ban and Chrony

Positioning: the machine without a screen, run by tools

Server is built for headless servers, virtual machines and container workloads: no desktop environment, and once it is installed your working surface is an SSH session and a command line. Its place in the family is a clean starting point for people who want to run their own server — the system ships what services need to run, and the services and agent runtimes on top are yours to choose, with permission boundaries you draw yourself.

It shares the same Linux base and profile mechanism as Desktop; only the profile content differs, because Server installs a minimal headless set. For operations work that matters: behavior verified in the shared base carries over, instead of being re-discovered edition by edition.

The core components, one at a time

OpenSSH

The front door for remote administration: key-based login, remote commands, file transfer. The install guide lists SSH key login explicitly in its acceptance checklist — a sign the publisher intends to verify it properly — but the preview carries no acceptance verdict yet.

Podman

A container runtime with no central daemon, designed to run containers rootless: an ordinary user starts their own containers without handing root to a permanently privileged service. When you deploy self-hosted services with it, the permission accounting stays simple.

cloud-init

First-boot initialization: hostname, SSH keys, users and first-run scripts are declared in one configuration before the machine ever starts. On cloud VMs and your own hypervisor alike, it is what turns per-machine hand setup into configuration as deployment.

Fail2ban

A watchman for your login logs: when one address keeps guessing SSH passwords, it bans that address for a while. On any server reachable from the network, this is the cheapest layer of brute-force defense there is.

Chrony

Time synchronization. Log timestamps, certificate checks and scheduled jobs all depend on the clock being right, and Chrony keeps it right quietly. It is invisible until it fails — at which point every log you own starts lying to you.

Good first uses

• A practice environment: a long-lived test server in a VM where you rehearse deployments and rollbacks, then restore from snapshot when it breaks
• Trial runs of self-hosted services: personal projects and internal tools in containers first, with production as a later, separate decision
• A container playground: new service combinations under rootless Podman, without touching anything on your main machine

Before any real deployment, work through this list

• Read-only checks first: cat /etc/os-release and uname -a to confirm the system identity, systemctl --failed for services that failed to start, journalctl -p err -b for this boot's errors
• Keep an escape route: before upgrades or big changes, confirm the out-of-band console works, a snapshot exists and the rollback window is real — the install guide makes this a hard rule
• Keep important data in off-site encrypted backups, and keep a bootable recovery medium within reach
• Know your target disk: the installer can format the disk you select, so point it only at a disk you have explicitly authorized

On the roadmap, and not in this preview

The product documents list Server roadmap items: a Cockpit graphical console (explicitly opt-in and authenticated, never a default), Quadlet-managed rootless services, managed backups, patch windows, audit trails, policy-driven firewall templates, vulnerability summaries, zero-trust fleet enrollment and secure remote recovery. Every one of these is a target; none ships in 0.1.0-dev. Equally plain: the preview is not certified for production, claims no default production hardening, the images are unsigned, and install certification is in the same not-yet-passed state as Desktop.

Read the install guide →　Go to downloads →　Read the security page →　Report problems (GitHub Issues) →