An operating system that is actually yours.

What Duxner is made of

Duxner runs on Chrome or Edge 86+, Safari 17+, or Firefox 111+ — it needs the browser's Origin Private FileSystem and Web Crypto, over https. Desktop only for now.

• Filesystem

  Folders, trash, tags and quick look, backed by your browser's Origin Private FileSystem. Metadata in IndexedDB, the bytes themselves in OPFS — on your disk, not in a bucket somewhere.

  • OPFS + IndexedDB
  • Chrooted per app
  • 512 MB quota

• Encryption

  Your password derives a key that wraps the master key. The master key exists in memory and nowhere else — closing the tab wipes it, and the next visit starts locked.

  • Derived from your password
  • Encrypted at rest
  • In memory only

  Encrypted. On this device. Nowhere else.

  Which also means the usual warning applies: clearing your browser's site data clears Duxner. Keep a backup of anything you would miss.

• Apps

  Thirty-one built-in apps, plus anything installed as a .duxapp package. An install runs in seven stages and stays reversible until the final commit, so a failure rolls back instead of leaving half an app behind.

  • 31 built in
  • .duxapp packages
  • Atomic install, 7 stages

• Network

  An app reaches the internet only through a guard that rate-limits it, checks the origin and counts its open sockets — and only if it asked for the permission and you granted it.

  • Rate limited
  • Origin checked
  • Opt in, per app
  Weather → Guard → weather.example.com ✓

  Weather → Guard ✕ evil.example.com Blocked

• Processes

  Every running app is a process with a pid, windows and a lifecycle. A governor watches its CPU and memory and can suspend or terminate one that misbehaves, without touching anything else.

  • pid + windows
  • Process governor
  • Kill switch
  Filespid 214

  Browserpid 231

  Runaway Scriptpid 244 Killed

• Sandbox

  Each app is chrooted to its own directory. Path traversal is rejected at two separate layers, runaway loops are killed after five seconds, and a crash takes down only the app that caused it.

  • Chroot per app
  • Loops killed at 5s
  • Isolated crashes
  "Weather" wants access to

  Network — weather.example.com only

  Deny Allow

  /home/user/.ssh/id_rsa Blocked

• Permissions

  Apps declare what they need and get nothing beyond it. Once installed the permission set is sealed: nothing an app can call will widen it, because only the kernel itself holds the token that can.

  • Sealed after install
  • Three guard layers
  • Audited

  	fs.read	network	notify
  Files	✓
  Weather		✓
  Notes

• Sessions

  Booting runs in five phases — kernel, probe, authenticate, initialise, ready. There is no account to create and no server to ask; the only thing between the lock screen and the desktop is your password.

  • Five boot phases
  • No account
  • Locked by default
  Encrypted at rest

  Your password derives the key. It is never sent anywhere.

  In memory only. Wiped the moment the tab closes.

• Windows

  The desktop itself — floating windows, a dock, apps that can open more than one at a time.

  • Floating windows
  • Multi-window apps
  • Real wallpaper tokens

• Marketplace

  Browse and install .duxapp packages without leaving the OS. Every listing is versioned and rated, and installing one runs it through the same seven-stage pipeline as anything else.

  • Search + ratings
  • Version tracking
  • Same install pipeline

• Search

  One overlay finds files, apps and settings at once. It only ever looks through what you have permission to see — a search index is not a way around the sandbox.

  • Files + apps + settings
  • Respects permissions
  • Instant, local

• Backup

  An encrypted export of your system, made on your terms — nothing is scheduled to leave the device unless you export it yourself.

  • Encrypted export
  • Manual, not silent
  • Restores in place
  Encrypting export… 214 MB

  Encrypted, on this device — nothing leaves until you choose where it goes.

• Settings

  Every app's preferences live in their own namespace, so one app can never read or overwrite another's — the same boundary the sandbox draws everywhere else, just applied to config.

  • Per-app namespace
  • Written to disk
  • No cross-app reads

• Notifications

  An app can ask to notify you, and you decide per app whether it's allowed to. A notification is not a way to wake up code you never granted permission to run.

  • Opt in, per app
  • OS-level queue
  • No background wake
  Files Backup finished — 248 MB copied

  now

  Calendar Team sync starts in 10 minutes

  2m

  Messenger 2 new messages

  15m

• Clipboard

  Copy and paste move through one broker that every app shares, not a channel any two apps can quietly read from behind your back — it only ever holds what your last action actually put there.

  • One shared broker
  • No silent reads
  • Sandboxed like the rest
  Q3-report.pdf File · 2m

  https://duxner.com/docs/api Text · 8m

  IMG_0231.png Image · 1h

• Account

  An optional cloud layer for syncing across devices — never required. Duxner works completely signed out, on this device only, the same way it always has.

  • Fully optional
  • No sync without it
  • Local-first either way
  —

  Signed out Working locally, this device only

  Nothing syncing — optional, off by default

• History

  Every action you take can be undone. The stack lives in memory for the session, same as the master key — nothing about what you did today is written down anywhere you didn't ask it to be.

  • Undo / redo stack
  • Per session
  • In memory only
  Deleted "old-notes.md"

  Renamed "draft" → "proposal.md" Now

  Moved "diagram.svg" to Projects

  Created folder "Projects"

• Quick Look

  Preview a file without opening the app that owns it — a fast, read-only look that never launches a process or touches the file itself.

  • Read-only preview
  • No app launch
  • Instant
  diagram.svg 240 KB · read only

  Space to preview, no app opens