Introducing AgenticLinux

AgenticLinux is a Linux desktop built for working with AI agents. Everything is there on first boot: the claude, codex, opencode, openclaw and goose agents, a way to run them side by side, a way to watch their usage limits, and the container and GPU tooling they usually need.

It is a bootc image. The whole OS ships as a container, so updates are atomic and rollback is one command.

What is installed

• Agents: claude, codex, opencode, openclaw and goose.
• Around the agents: herdr to run them side by side, and CodexBar to keep an eye on their usage limits. CodexBar shows them in the tray, or with codexbar usage in a terminal.
• Desktop apps: ChatGPT (which includes Codex), OpenCode and Goose, plus Google Chrome.
• Models: llmman runs models locally, or connects any agent to any provider.
• Containers: Docker Engine, rootful and rootless, and Docker Sandboxes to run agents in isolation.
• Virtual machines: QEMU with KVM.
• GPUs: Vulkan, ROCm and NVIDIA/CUDA runtimes.
• A developer toolset, listed in packages.txt.

Variants

The image comes in ten variants. Seven are built from Fedora 44 packages on the fedora-ostree-desktops images, and three from CentOS Stream 10 packages (with EPEL) on the centos-bootc image. All are available for x86_64 and aarch64.

The images are docker.io/ericcurtin044/agenticlinux:<variant>. The variants carry the same packages on both distributions, so the CentOS list is what CentOS Stream 10, EPEL 10 and RPM Fusion have: GNOME and KDE Plasma are the desktops that exist there.

Install

Download the ISO for your desktop and architecture from the latest release, boot it and install as usual. The ISO is a network installer preset to pull the matching image from Docker Hub, so the install needs a network connection. Disk, user and locale are chosen in the installer, with plain xfs partitions as the default.

Or switch an existing bootc system:

sudo bootc switch docker.io/ericcurtin044/agenticlinux:kde

Updates

The whole OS is one image, rebuilt every 4 hours and on every push to main. The variant’s tag (kde) is always the newest build. /etc and /var, so your home directory, carry over between images.

bootc status                # running, staged and rollback images
sudo bootc upgrade          # fetch the newest image, boot into it next time
sudo bootc upgrade --apply  # the same, and reboot now
sudo bootc rollback         # boot the previous image next time; again to undo

A failed update also rolls back by itself. That is bootguard, the subject of the next post.

Every build is also tagged <variant>-<version>, so you can pin one and switch back to the variant’s tag to follow the newest again.

Nothing updates on its own by default. bootc has a timer for it, which checks an hour after boot and about every eight hours after that, and reboots as soon as it finds a new image:

sudo systemctl enable --now bootc-fetch-apply-updates.timer

Signing in

On a local model, through llmman launch, the agents need no account. Otherwise sign in once per agent, for example codex login or openclaw onboard. The ChatGPT app asks you to sign in when it first starts. Credentials stay in your home directory, which updates leave alone.

How it is tested

CI builds every variant on both architectures and runs a smoke test in a container of each image. It pulls a small local model and runs each agent on it. Each x86_64 image is also installed to a disk and booted in qemu with test/smoke.sh, which covers what needs a real boot: Docker, rootful and rootless. Images are published only if every variant passes on both architectures.

Things to know

• The images are not signed. Pulling one, from the ISO or bootc switch, relies on Docker Hub over HTTPS.
• The NVIDIA kernel module is unsigned, so with an NVIDIA GPU you need to disable Secure Boot or enroll your own MOK.
• ChatGPT’s Linux build is a preview.
• The desktop apps live in the read-only /usr, so they update with the image rather than by themselves.

The source is at agenticlinux/agenticlinux, under the Apache-2.0 license.