Kodachi OS (formerly Linux Kodachi) is a Debian-based Linux distribution developed by Warith Al Maawali. It is designed to provide a privacy- and security-focused computing environment by integrating technologies such as VPN routing, the Tor network, encrypted DNS, application sandboxing, and encrypted storage. The distribution is available in desktop and terminal editions and can be run as a Live operating system or installed on a computer. According to the project's documentation, recent releases have introduced a Rust-based architecture together with AI-assisted system administration(KAICS) and security management features.
Goal
The design goal as outlined by the developer:
The design goal is that an ordinary user can reach a strong, verifiable anonymity posture in minutes rather than hours, can verify that the software they run is the software that was published, and can collapse their posture to a safe state instantly under duress.
—Warith Al Maawali, developer
Architecture and security features
Linux Kodachi integrates multiple privacy, networking, and system-hardening technologies into a unified operating environment. According to the project, network traffic can be routed through configurable privacy paths combining VPN connections, the Tor network, DNSCrypt, and additional routing protocols including WireGuard, OpenVPN, Shadowsocks, V2Ray, Xray, Hysteria2, Mieru, Dante, SOCKS5, HTTP/HTTPS proxies, and tun2socks. The distribution also supports Multi Tor, allowing users to select Tor exit nodes in different jurisdictions, and incorporates PeerGuardian for IP filtering on peer-to-peer networks together with Firejail for application sandboxing.
The distro provides a pre built welcome screen that guides the user about the particular settings according to the need.
Welcome screen
The distribution includes configurable privacy controls such as MAC address randomization, firewall management, IPv6 leak prevention, encrypted DNS resolution, UDP filtering, time-zone spoofing, encrypted storage through VeraCrypt and ZuluCrypt, secure password management using KeePassXC, and operation as a live operating system from removable media. The desktop edition also supports virtual machine environments and includes configurable emergency response functions such as RAM wiping, panic modes, and secure deletion utilities.
Version 9 introduced a Rust-based backend architecture that replaced much of the project's previous shell-script infrastructure. According to the project documentation, the desktop edition bundles 25 Rust binaries (17 service binaries + 8 Kodachi AI workspace binaries on 7 tier offline-first engine). These binaries provide functionality for routing, system integrity verification, permission monitoring, logging, dashboard management, workflow orchestration, process isolation, and AI-assisted administration.
The desktop edition includes the Kodachi Dashboard, which provides a graphical interface for configuring networking, privacy, routing, monitoring, and system-management functions. The project states that the dashboard orchestrates hundreds of commands across the bundled Rust binaries and includes multiple operating modes, integrated system monitoring through Lua-powered Conky widgets, workflow automation, and routing guidance for selecting privacy configurations.
The distribution incorporates Oniux, a Linux namespace-based process isolation framework. According to the project's documentation, Oniux assigns isolated processes separate user, mount, and network namespaces while routing network traffic through dedicated Tor circuits. The project describes this approach as an alternative to library-based routing tools such as Proxychains and Torsocks by relying on Linux kernel namespaces for network isolation.
Kodachi also includes a multilayer USB security framework consisting of USBGuard policy enforcement, kernel-level controls, device authorization, and blacklist management. These mechanisms are intended to regulate removable storage devices and restrict unauthorized USB access according to administrator-defined security policies.
Security Operations Center
Version 9 introduced the Security Operations Center (SOC), a host security monitoring interface integrated into the Kodachi Dashboard. The SOC provides a centralized view of system telemetry, security posture, and network status through a graphical neural map that groups host security information into domain-specific clusters.
The SOC organizes telemetry into eight monitoring domains: Vitals, Network, Connections, Processes, Threats, Authentication, Privacy, and System. The interface displays information including system resource utilization, active network connections, routing anomalies, process activity, authentication events, VPN and Tor status, DNS encryption, MAC address randomization, kernel hardening status, and service integrity. According to the project, threat findings are categorized using the MITRE ATT&CK framework where applicable and are presented with severity indicators and cluster-based visualizations.
The dashboard also provides a weighted Security Score ranging from 0 to 100, together with category scores, a live alert feed, privacy posture indicators, and configurable monitoring controls such as refresh intervals, severity filters, cluster visibility, and notification settings. According to the project, the SOC functions as a monitoring and visualization layer over Kodachi's existing security infrastructure and does not directly modify system state.
Default Apps
Kodachi provides a stack on apps that provides a secure experience while internet surfing and day-to-day use.
Session: A messaging app for secure communications.
Kodachi Browser: A pre-hardened browser based on LibreWolf.
Tor Browser: The native way to access the .onion websites and anonymous web scraping.
The Kodachi Dashboard is a graphical management interface developed using Tauri 2 and Svelte 5 for real time security operations.
Kodachi Dashboard orchestrates 600commands across Rust binaries with zero GUI freezing.
The Kodachi Dashboard contains 4 modes specialised for different purposes. It includes Circle mode (Gamified ring for minimal operation), Lite mode (A compact command center), Full mode (A professional workstation), Autoshield (First boot wizard for automated hardening).
Lite mode: Collapsible sidebar with tabs providing quick access to essential security operations, AI chat, command library, system monitoring, and direct terminal access with live output display.
Kodachi Dashboard
Full mode: Multi-panel command center with various tabs across 4 major sections. Supports drag-and-drop command queuing, resizable panels, and parallel/sequential execution modes for power users.
Full Mode in Kodachi Dashboard
AutoShield: Countdown-driven setup wizard that launches automatically on first boot. Configures anonymity layers, randomizes system identity, and establishes secure connections with real-time telemetry and protection level visualization.
Kodachi Workflows
Kodachi Linux uses a workflow system for emergency response and security operations known as kodachi workflows.
A workflow consists of one or more steps, where each step executes a command and can include conditions, timeouts, retries, or manual approval points. Workflows can make decisions based on command output, including text matching or JSON path evaluation, enabling intelligent branching during execution.
Key capabilities include:
Reusable templates for common administrative tasks.
Sequential execution of multiple commands.
Conditional logic based on command success, failure, or output.
Pause steps for manual verification or approval.
State tracking to monitor workflow progress.
Kodachi classifies the 113 Workflows according to the real time need into 13 different categories.
The categories include: Adaptive, Anonymity, Auth, DNS, Emergency, Network, Privacy, Protection, Recovery, Routing, Security, Setup, System.
Kodachi Workflows
Kodachi also provides a workflow simulator in its official website. These are like the real workflows that ship with kodachi. Any workflow can be loaded and real time action that the workflow does can be observed. These are simulated on the website so nothing touches the device.
Threat level detection and Emergency response
The Kodachi OS follows different paths for different threat levels.
Kodachi Emergency Panel
Temporary Lockout: Lock dashboard for configurable duration. User must wait before retrying. No data affected. Auto-unlocks after timeout.
Block Until Recovery: Lock dashboard indefinitely. Requires recovery code or system-level intervention to unlock.
System Shutdown Immediately powers off the machine. All volatile data in RAM is lost. Requires physical power-on to resume.
Trigger Panic: Initiates full panic mode sequence, which is irreversible. Wipes sensitive data, kills network, clears RAM. See Emergency Response for details.
When compromise is imminent or confirmed, Kodachi provides irreversible data destruction options. Two independent nuke systems, LUKS Nuke at boot and Dashboard Duress Protocol at login, ensure data destruction can be triggered using duress code.
Kodachi Destroy
The OS provides 3 different wipe intensities: Fast, Secure, Paranoid
Also powered with 3 emergency response levels: Panic soft, Panic medium, Panic hard
Every identifying attribute of the user's system can be randomized on demand. MAC address, hostname, time zone, and IPv6 settings combine to make a machine appear as a completely different device in those respects.
Version history
Originally based on Linux Mint and further customized for enhanced privacy and security.
Version 4.3 was released on the Debian 9.5 XFCE / Mint 19.
Version 7.0 "Katana" was released on 25 May 2020, based on the version of Linux 5.4 from the latest Xubuntu 18.04 LTS release, Linux kernel 5.4.0.26.
Version 8 is based on Ubuntu 18.04.5
Kodachi 9.0.1 is based on Debian 13 Stable and is release on 26 February 2026. Kodachi 9.8.4 (Queen), a highly polished modern variant of Kodachi 9.0.1 that includes variety of enterprise-grade security protocols and features
Kodachi 10 (Dragon)
Awards and recognition
First place by Techradar magazine for privacy and security (2020 – 2025).
The Lab Hot Product Award in August 2021 from Australian APC Magazine.
Top privacy distribution by Linux Format World UK magazine in 2020.
Best OS for security and privacy by Techradar magazine in 2021 – 2023.
The best OS for security and privacy by LinuxHint in 2021.
