Hosting applications — gaps, and containers

What ctos can host today under the scoped Track A product claim (a loaded freestanding user-mode binary with a stable ABI on an OS/app slot), what is still missing for stronger isolation, and whether it can host containers.

Today you also extend the kernel (Building or porting). Samples that exist: What can run today. Isolation notes: el0.md. Kernel SVC numbers: syscall.md.

Do not say ctos hosts Linux programs, POSIX apps, or containers. The scoped freestanding slot-hosting claim is Verified under ADR-048 / ADR-052.

Today vs the slot split (A9 + product claim)

Today (Verified miles + product claim): QEMU -kernel still loads one OS ELF. Published freestanding samples live on FAT /hello (A9), /fsdemo (ADR-059), /fatdemo (ADR-061), and /yldemo (ADR-062). A2–A4 load /hello (no production embed). The same hello ELF boots on this OS and on ba6541c (ADR-032). Under ADR-048 criteria Met×5 (ADR-052), the product sentence “apps run independently of the OS” / “app hosting is done” is Verified for that freestanding slot path. It is not containers, not OTA, and not Linux/POSIX.

Product claim (Verified): “apps run independently / hosting done” is Verified under ADR-048 (checklist below). Scope stays freestanding slots — not Linux userspace.

flowchart LR
  OS["OS ELF<br/>QEMU -kernel"] --> FAT["FAT16 volume"]
  H["/hello"] --> FAT
  F["/fsdemo"] --> FAT
  D["/fatdemo"] --> FAT
  Y["/yldemo"] --> FAT
  FAT --> LOAD["Guest PT_LOAD<br/>standing EL0"]
  LOAD --> CLAIM["Product hosting<br/>Verified — ADR-048/052"]

Freestanding slot-hosting is Verified (Met×5). Catalog samples deepen recipes; they do not reopen the claim. Do not say Linux hosting, containers or OTA. Say “EL0 isolated” only as the accepted ADR-091 sentence. Runtime cost vs embed is a lab measurement pair (ADR-046), not a marketing delta.

Gaps before hosting applications

These are missing pieces for richer hosting / isolation, not a schedule. Rows without a probe stay Planned or unbuilt. “Later” is not a promise.

A supervisor call (SVC) is how user-mode code asks the kernel for help. Reserved SVC #0–#2 stay test miles. A1 documented exit / uart_write / yield (syscall.md). That is not a CRT or loader.

“Host an application independently of the OS” / “app hosting is done” is Verified under ADR-048 (documented recipes + slot cross-update + no production embed + honesty about missing Linux/POSIX/containers + sponsor accept / ADR-052). That block is Track A. A1–A9 first cuts alone were never enough; the checklist Met×5 is. A5: PAN ID-field Verified; enable is non-goal on default cortex-a57 (ADR-047). A8 documented rebuild recipes (what-can-run.md). A9 + leftover: FAT /hello, no production embed, cross-update on ba6541c. See Immutability.

Containers

Non-goal. ctos cannot host OCI / Docker / Kubernetes workloads, and it is not aiming to.

Those need Linux kernel features (namespaces, cgroups, a Linux ABI, usually overlay or equivalent, a rich syscall surface) that this learning kernel does not have. Decision: ADR-029. Track B B7 (#47).

Today the arrow is the other way: Docker on a host (arm64 workstation linux/arm64) runs the ctos smoke image. That is “Docker hosts ctos,” not “ctos hosts containers.” See the README Docker notes and the Docker rows in the ledger.

flowchart LR
  HOST["Linux host + Docker"] -->|"builds and QEMU-smokes"| CTOS["ctos guest"]
  CTOS -.->|"does not host"| OCI["OCI / Docker / k8s"]

Host harness ≠ guest runtime. File presence of this page is not a container probe.

Container support is not Planned on this page. Do not add a Planned row. Reopen only with a new GitHub epic plus a new ADR — not a Track B win, and not a new FR/NFR ID.

Claim criteria (ADR-048)

Product “apps run independently / hosting done” is Verified when all of the following are ledger-Verified and sponsor-accepted (ADR-048 / ADR-052):

1. Documented freestanding-app recipes (existing markers only).
2. Slot cross-update (same published ELF on this OS and a documented prior OS).
3. No production hello embed (slot: embed never appears on the production path).
4. Docs still refuse Linux ABI / POSIX / guest containers (ADR-029).
5. Explicit sponsor accept on the flip PR (no self-merge).

Progress vs tip main (honesty checklist)

Tip audited: 190ef5a (Merge #106 / docs polish; or newer main with ADR-062). Product row Verified — criteria 1–5 Met. Catalog samples /fsdemo / /fatdemo / /yldemo deepen recipes; they do not reopen ADR-048/052.

A1–A9 first cuts alone remain insufficient without the checklist. Matching ledger section: honesty-ledger.md — ADR-048 progress.

Honesty