Skip to content

v1.0.1 — The AI OS, containerised

Latest
Latest

Choose a tag to compare

View all tags
@ZDStudios ZDStudios released this 06 Oct 13:45
v1.0.1
4faa79f

Eleven open-source AI projects. One operating system. One Control Room. — and now one container.

The AI OS unifies opencode, hermes, openclaw, CrewAI, claude-code-api, Codex, Paperclip, LifeOS, Fabric, Caveman, Ponytail and Ruflo into a single auto-configured system you drive from one command (aios) and one dashboard.

🐳 Run it in two commands

The image is published to GitHub Container Registry — no build, no toolchains, no API keys to start:

docker pull ghcr.io/zdstudios/aios:latest

Grab docker-compose.yml from the assets below (or use the one in the repo), then:

docker compose up -d

Open http://localhost:8787 — the access token is printed in docker compose logs.

📦 Package: https://github.com/users/ZDStudios/packages/container/package/aios
🖼️ Image: ghcr.io/zdstudios/aios:latest · linux/amd64 · 3.88 GB compressed (~11 GB on disk)
📖 Full guide: docs/DOCKER.md

Prefer to build it yourself? docker compose up -d --build still works from a clone.

Use your Claude Pro/Max subscription instead of an API key:

docker compose exec aios aios claude-login

Why a container is the right home for this: The AI OS gives every agent full control of the machine it runs on. On your laptop that means your laptop; here it means a container you can delete. Guardrails and the hub token still apply inside — no-new-privileges, SYS_ADMIN/NET_ADMIN dropped, and the hub only binds 0.0.0.0 because non-loopback requests require AIOS_HUB_TOKEN. Only the Control Room port is published by default, so it won't collide with a native aios start on the same machine.

State survives rebuilds: .aios (memory, tasks, flows, audit log) is a named volume, and ~/.claude mounts through so the claude-code service inherits your host login.

What's in this release

🖥️ Full machine control, gated. Every agent gets shell, filesystem and network via each project's own supported switch. Paired with a real gate, because full control plus an open control plane is exactly what made OpenClaw's CVE-2026-25253 critical: loopback trusted, everything else needs a token, CSRF and DNS-rebinding closed, guardrails that refuse rm -rf / / mkfs / fork bombs, and every command audited.

🌐 It can actually read the web. Paste a link and the agents read it — YouTube (full transcripts, chapters, metadata), Reddit (threads with comment trees, subreddits, search), Hacker News, any page, plus keyless search. aios web youtube <url>, or /yt in chat.

🛡️ Self-healing agents. A watchdog restarts anything that stops responding; if the restart fails, a healthy agent reads the logs and diagnoses the cause.

⬆️ Agent-supervised updates. When a bundled project moves upstream, an agent reviews the actual commits and changed files and returns SAFE / RISKY / BLOCK before anything is touched. Applying backs up, reinstalls, health-checks, and rolls back automatically on failure.

🎨 Agents can redesign the dashboard. Colours, sizing, density, sidebar, and live OpenUI panels — all through an API, never by editing code, so a bad instruction can't break the UI and one Reset undoes everything.

⚙️ Task Brain & 🔀 TaskFlow. One SQLite-backed scheduler for cron, intervals and shell; durable multi-step flows that commit state per step and resume after a crash.

🧠 Active Memory + self-improving skills. A memory sub-agent runs every turn (free FTS5 recall), and a Curator turns completed procedures into reusable skills.

📡 28 messaging channels. WhatsApp, Telegram, Discord, Slack, Signal, Matrix, Teams, iMessage and more from one gateway.

🧵 Fabric · 🗿 Caveman · 🎀 Ponytail. 255 task patterns on your own model; conciseness mode (~65% fewer output tokens); and laziness mode (~54% less code). The last two compose — one trims what agents say, the other what they build.

🤖 Ruflo. Agent meta-harness: swarms, 314+ MCP tools, vector memory, 30+ plugins.

🆕 Since the initial release

🏢 Paperclip — the agents run as a company. paperclipai/paperclip runs on :3100 and AIOS hires its own agents into it: AIOS Brain as CEO, opencode as CTO, CrewAI as Head of Research (all over Paperclip's HTTP adapter into the hub), and Claude Code and Codex as engineers on Paperclip's native local adapters. File a ticket from the new Company view, the 🏢 Company chat chip, or aios paperclip task "…"; Paperclip wakes the assignee, the hub checks the ticket out, does the work, posts the result as a comment and closes it, or marks it blocked with the reason and the board as owner. The Company view shows the org chart, a live ticket board, each ticket's thread, and Paperclip's own UI. Finished swarms are mirrored in as parent + child tickets. Paperclip needs Node 24, so aios setup installs a private Node 24 under .aios/runtime; your system Node is untouched. aios paperclip status | setup | task | open | install.

🌐 New website. https://zdstudios.github.io/AIOS/ is rebuilt as a plain technical page with real screenshots, every project and port, the ticket flow, and the security model stated with its limits. Pages now builds from /docs, which fixes the failing deploys.

⌁ Codex — your ChatGPT subscription as an API. services/codex_api.py wraps the local codex CLI as an OpenAI-compatible endpoint on :8010, the mirror of claude-code-api. No API key; auth is codex login. Both subscription routes are now offered in the setup wizard before any API-key option.

🐝 Swarm. Big requests are decomposed into a DAG of subtasks, each assigned to the specialist that fits. Independent subtasks run in parallel, a running agent can consult a peer mid-task (ASK opencode: …) and gets a real answer back, then one agent synthesizes. Fires automatically for big asks, or force it with the Swarm chip.

👁 Live action monitor. A toggle that streams everything the agents do — shell commands, web reads, config writes, blocked attempts — with the actor that asked. Cursor-based so nothing replays, and in-flight actions appear while still running, with a live timer.

🔐 Master password + aios uninstall. A scrypt-hashed vault gates uninstall and disabling the guardrails. The password is never stored, so it can't be read back — and deleting the vault refuses protected operations rather than unlocking them, so destroying it grants nothing. The agents' own shell is blocked from touching it.

🧱 Plugin Store. 80 installable things across four real mechanisms — 26 OpenClaw channels, 40 ruflo packs, 13 skills, plus OpenClaw feature plugins — read from what's actually on disk.

🎨 Themes from plain CSS. Paste a :root{--accent:…} block someone shared; light/dark is detected from --bg. JSON still works.

⚙️ Setup improvements. Choose the Claude or Codex subscription right in the model menu, and skip the messaging agent entirely if you only want the coding/research side (aios channels --enable to bring it back).

Fixes in this round

  • claude-code-api on Windows: multi-line prompts were cut at the first newline by cmd.exe, so the model only saw line one. Prompts now go over stdin and the system prompt via --system-prompt-file. This was also why swarm planning sometimes came back empty.
  • The Brain falls back to your Claude subscription bridge when no API key is set, instead of replying "no key".
  • Supervised updates: a reviewer that errors (provider refusal, crashed CLI) no longer has its error text read as a RISKY verdict; the next agent reviews instead, and ANSI codes are stripped.
  • Dashboard deep links: http://127.0.0.1:8787/#company, #swarm, #status, …

Plus: agents can restyle the dashboard through an API (never by editing code), OpenUI panels in the hub chrome, a colourised grouped CLI with "did you mean…?", and live Canvas auto-pinning.

Install without Docker

# Linux / macOS / WSL
curl -fsSL https://raw.githubusercontent.com/ZDStudios/AIOS/main/install.sh | bash
# Windows
irm https://raw.githubusercontent.com/ZDStudios/AIOS/main/install.ps1 | iex

Notes & known limits

  • Codex on Paperclip needs a ChatGPT plan with Codex model access. If codex exec itself returns "model does not exist or you do not have access", the Codex seat shows an error until the account has access; the rest of the company is unaffected.
  • The image is large — 3.88 GB to download, ~11 GB on disk. Eleven projects with full dependency trees genuinely is that big. The build already drops pnpm's 4.7 GB store (its hardlinks keep node_modules intact) and purges build toolchains.
  • linux/amd64 only. Emulating arm64 under QEMU for an eleven-project install exceeds the CI time limit. On Apple Silicon it runs under Rosetta emulation, or build natively with docker compose up -d --build.
  • First boot takes a few minutes — the stack starts every project. The healthcheck allows a 180s grace period.
  • YouTube transcripts need yt-dlp (bundled in the image). YouTube serves its caption endpoint an empty body without a proof-of-origin token, so nothing else works reliably.
  • Reddit blocks its JSON API from many networks, so AIOS falls back to RSS. Responses say source: "rss" and scores are null there — agents are told not to report vote counts they didn't get.

MIT licensed. Built on the work of the upstream projects — see the README for credits.

Assets 3
Loading