01

Akuma, Bohemian Operating System

Self-hosting a Rust kernel

with mostly open models

Kirill Maksimov · rust.org.il · akuma.sh/self-hosting-rust-kernel

github.com/netoneko/akuma

Meme generated by Daniel Balabanov
02

Capability test

Can a weak open model write a kernel that runs real workloads?

  • Why open models? Dario won’t let you write a Wi-Fi driver.
  • My custom rust kernel Akuma was mostly written by commercial models and it was already self-hosting for a few months.
  • To speed up kernel development I used GLM 5.3 Flash to build KVM from AMD’s spec PDFs.
  • I had a talk in 10 days, a hypothesis, and a lot of free time.
A cat blacksmith tending a forge: “Time to run some JavaScript on it.”
Meme generated by Daniel Balabanov
03

The experiment

Speedrunning cargo build

  • Development runs on Akuma (GLM-5.3-Flash + Goose)
  • Sloppy methodology leads to questionalbe results
  • Every step ends in a gate a machine can check.
  • 390 interventions including real bangers like this one is a classic, read the docs with about 70% accuracy in guessing where the bugs are
  • GLM reached the equivalent of a self-hosting C kernel: HTTPS curl, apk, fork, pipes, all running on Akuma’s KVM.

AI is good at what you can verify.

The Akuma and Taoxichuan verification loop A brief with gates goes to a GLM session, which produces code. The code is built into a guest kernel, booted under Akuma's KVM, and checked against console gates. A pass is merged and committed. A fail goes back as a steer. Finally the kernel builds itself twice and the two builds are compared byte for byte. 1 · brief goal list + exact gates 2 · GLM on Akuma plan, code, test, debug 3 · build + boot guest kernel, Akuma KVM 4 · gates sshd, console, probes fail: adjust, debug, new brief pass: merge, commit then the kernel verifies itself K0 K1 K2 builds builds cmp K1 K2 : identical, byte for byte
04

The Rust bar

Rust is much harder to host

Akuma had already self-hosted Rust, so feasibility was never in question, only the route and the clock.

~7 monthsAkuma’s first self-host
7 d 4 hTaoxichuan
Syscalls dispatchedCountof Linux’s 383
C-level kernel: HTTPS curl, apk, fork, pipes, static binaries8322%
The brief’s estimate for Rust (a guess, before any measurement)~70–9018–23%
Rust self-host: rustc, cargo -j4, K1 == K212031%

Counted from Taoxichuan’s dispatcher at the GLM handoff (bc626f98, 83 arms, 4 of them Akuma-private) and at the first fixed point (6af48c06, 120 with legacy folds).

05

Why Rust

Extraction is cheap, build system is excellent

DateDev stageCratesForbid unsafeAuditable linesunsafe sitesunsafe share
2026-09-02before the amd64 port523252,8143742.8%
2026-09-20after the port’s cleanup705076,3507143.4%
2026-10-17port stabilized8666101,1338112.8%
2026-10-24after KVM10173118,1154851.5%
2026-11-02after Taoxichuan11787123,2094811.4%
  • Composition: the Taoxichuan kernel (a KVM guest) runs inside Akuma (the bare-metal KVM host), and 93% of its live lines were already live in Akuma.
  • Traits and inversion of control.
  • Host-tested crates make debugging cheaper.
  • Isolation of unsafe in specific crates: 87 of 117 crates forbid it outright, and the rest keep it in small leaf crates.
06

Cleanup

GLM and Sonnet got kernel to the fixed point, Opus cleaned up

Audit lines unless notedBefore cleanupAfter cleanupChange
The guest · Taoxichuan
Audit lines (live code in the image)87,76177,839−11%
The kernel’s own code7,8443,771−52%
Third-party code (crates.io)41,748 · 22 crates21,861 · 15 crates−48%
unsafe lines2,8501,668−41%
Build-time host code31,743428−99%
The host · Akuma amd64, and the two together
Host audit lines152,104136,727−10%
Taoxichuan on an Akuma host (shared lines once)161,128141,903−12%
What Taoxichuan adds to the host9,0245,176−43%
Share of Taoxichuan already live in the host90%93%+3 pts

Less capability in theory means a smaller attack surface and it's easier to reason about

07

Kernel that only runs tokio

Install a kernel from crates.io, and have your whole supply chain hijacked

  • Shanghai, new kernel built by GLM from a crate README.
  • This kernel runs tokio.
  • As a regrettable side effect, Python runs too.
//! Shanghai: a kernel built from the `akuma-tokio-kernel` README. The whole
//! kernel is this file plus a skyline.

#![no_std]
#![no_main]

akuma_tokio_kernel::entry!(main);

fn main(kernel: akuma_tokio_kernel::Kernel) -> ! {
    kernel
        .name("Shanghai")
        .banner(include_str!("banner.txt"))
        .console()
        .disk()
        .net()
        .smp()
        .run_init()
}
Nesting: Akuma, Taoxichuan, goose, Shanghai Akuma runs on bare metal and hosts KVM guests. One guest is Taoxichuan. Inside it, goose, talking to GLM, builds Shanghai, a second kernel. The Shanghai image boots as another guest on Akuma's KVM. Akuma · bare metal · KVM guest · Taoxichuan goose GLM over the network cargo build from a crate’s README Shanghai image a second kernel boots guest · Shanghai tokio program
08

Costs and benefits

The real cost is mostly in my sanity

633.1MGLM tokens · 7,909 calls
~$27.2GLM at API prices
~3.2 wkof the $18/mo Lite plan
1,943MClaude tokens · 3.1× GLM

If GLM had done it alone (extrapolation, not a measurement)

GLM slower than Claude byGLM tokensAgent-hoursOne $18 Lite plan
2×0.67–0.81B122–1473.4–4.1 weeks
3×0.81–1.03B147–1874.1–5.2 weeks
4×0.95–1.24B173–2254.8–6.2 weeks

Top row: actual numbers. GLM-alone rows: adjusted for refined process from day one, no supervision counted; extrapolated from Sonnet work as closest available model with similar capabilities.

09

Costs and benefits

Benefits for Akuma

Before the experiment
2026-10-24		Now
2026-11-03		Change
Crates in Akuma98117+19
Fixes in Akuma’s bug-fix list1,470 · 406 docs1,493 · 424 docs+23
Fixes in Taoxichuan’s own list0119 · 35 docs+119
Third-party crates in the guest image *2215−7
Third-party code in the guest image, lines *41,74821,861−48%
Third-party unsafe lines in the guest image *1,872789−58%
Build-time host code, lines *31,743428−99%

* Dependency cut: before = the cutover (2026-11-01), after = B15 (2026-11-02). The in-tree virtio driver replaced virtio-drivers and its stack in every kernel, and with it went syn, the proc-macros and most of the third-party unsafe. Our own barely moved (978 to 879 lines).

10

Real workload

GLM strips AWS out of an agent runtime, builds it, and runs it on the new kernel

664 → 399crates in Cargo.lock
21 → 11workspace members
−32,623lines (+2,453), 156 files
~18 minof build, six attempts
  • Unattended: goose with GLM, inside a Taoxichuan guest, under Akuma’s hypervisor on bare metal.
  • The job: clone infinity, cut every AWS dependency, build what is left (cut first, then build).
  • It swapped OpenSSL for rustls, since the guest has no OpenSSL headers, cmake or clang.
  • Proof: the agent answered PONG through api.z.ai, then ran uname -a through its own tool path.
  • Three of the six builds failed on kernel bugs, which were fixed along the way.
11

What’s next

Hardening, then verification

Hardening

  1. Read-only disk image, no ext2 write paths.
  2. Syscall table as a compile-time allow-list built from the census.
  3. No dynamic library loading.
  4. Execution locked to signed binaries under a signed kernel.
  5. Egress allow-list in the socket table.
  6. Kernel code locked by the hypervisor through nested page tables.
  7. Layered walls: box, ring 3 process, KVM guest.

Verification

  1. Fuzzing and static analysis on the pure crates.
  2. Kani and Miri on the invariants.
  3. LLM-drafted Verus proofs for small pure crates.
  4. Linux differential tests.
12

Sources

Everything is in the repo

WhatDocumentHolds
Talk notesRUST_ORG_IL_TALK.mdthe numbers and arguments behind these slides
Taoxichuan: the briefMINIMAL_SELF_HOSTING_EXPERIMENT.mdthe experiment as set up, with its syscall estimate
Taoxichuan: the logMINIMAL_SELF_HOSTING_EXPERIMENT_AGENT_LOG.mdstage by stage, supervision, tokenomics, prompt counts
Taoxichuan: the fixed pointTAOXICHUAN_FIXED_POINT.mdK1 == K2, step by step
Infinity: the logINFINITY_ON_TAOXICHUAN.mdGLM strips AWS out of an agent runtime and builds it

github.com/netoneko/akuma

↑ ↓ to navigate