SibillaOS v0.7.0

The adoption cycle, built on an honest reading: the feature depth already exceeded what an adopter needs, and what was missing was being found, being believed, and working on the hardware people actually own. Systems installed from 0.4.0 onward receive this release through a plain sudo apt update && sudo apt upgrade, and CI keeps proving that survival on every push.

What is new

Believed: the README now answers the question every visitor silently asks - "why not just Ollama?" - front and center, six differences in a table, with the honest closing that localhost-only users need none of it. And the terminal demo stops being acted: the CI pipeline records the real session (asciinema) on every push, asserts the completion is present and the API key absent, and ships the recording; what the README shows is generated, not staged.

Working on real hardware: following the only real inbound signal the project has received (a Strix Halo/ROCm question), AMD is now first-class on the consumer path. First boot completes the ollama ROCm runtime on AMD machines whose GPU was not visible at image bake time - cloud images are baked in GPU-less VMs, so AMD deployments used to fall back to CPU silently. sibilla status, doctor and bench name AMD cards and say loudly whether the ROCm runtime is present. The detection logic is a deterministic CI matrix (datacenter NVIDIA, consumer NVIDIA, AMD discrete, APU, none), and docs/validation/gpu.md is the tester guide with a structured issue form: if you own an NVIDIA card, an AMD card or a Ryzen APU, thirty minutes of your time is exactly the data this project cannot produce alone.

Supply freshness: the ollama pin moves to 0.32.1, the vLLM container is pinned to v0.25.1 (a ":latest" had survived from the PoC), and sha256 digests are now recorded for every entry of the catalog - 161 of them - so model use, model pull, sibilla model import and the air-gapped payload verify any catalog model, not just the CI ones. One finding became policy: recent ollama ships with cloud routing enabled by default and can transparently offload ":cloud" models to ollama.com; every SibillaOS install now pins OLLAMA_NO_CLOUD=1 and CI asserts it, because "nothing leaves the machine" has to include the engine's own cloud.

The config track completes: sibilla apply check audits without changing - drift against the declared profile, a hand-edited Caddyfile (which the next toggle would silently overwrite), the served model against its catalog digest, key file permissions - and exits nonzero on findings, cron-ready.

Local RAG, from feature to recipe: examples/rag-quickstart.py is a complete pipeline in ~100 lines of Python standard library, environment straight from sibilla connect --env, run end to end by CI; LangChain and LlamaIndex configurations ship with the local-endpoint gotchas stated.

The developer kit grows its missing half: sibilla connect --remote generates a deliberately keyless script for the workstation - it prompts for the key on stdin there (never argv, never shell history), refuses to write anything until the gateway accepts the key, then places Continue and aider configs plus an optional project .env. Zed gets an honest print-only section (its keys live in its own credential store).

And the machine now looks like itself: the long-form commands (status, doctor, bench, apply check) wear the emerald oracle style - color only on a TTY, so pipes and CI see byte-identical plain text; the appliance images greet SSH logins with the ASCII oracle eye, the served model and where to start (guest installs stay untouched, asserted); the gateway answers Server: SibillaOS; Open WebUI presents itself as part of the appliance; the wallpaper is redesigned ("quiet corner") and the eye lost its gold glint across every asset - the slit pupil carries the mark alone.

What has been verified

Everything the previous releases established, plus: the recorded demo asserted on every push, the hardware-detection matrix, OLLAMA_NO_CLOUD on both install paths, the config audit catching a tampered Caddyfile and a drifted profile, the RAG example running the documented flow, the remote kit refusing a bad key and writing three files correctly on a good one, the login banner present on images and absent on guests, the Server header, and the hard embedding assert in the pinned VM (the native runners follow the same best-effort policy as chat inference, with engine failures named and our own failures still red). The catalog pipeline itself came out hardened: the updater can no longer truncate its own catalog, signed files are pinned to LF, and lint and build check substance, not just syntax and signature.

Installation

On an existing Ubuntu 24.04 machine:

$ curl -fsSL https://engineering87.github.io/sibillaos/apt/sibillaos-archive-key.asc \
    | sudo gpg --dearmor -o /usr/share/keyrings/sibillaos-archive-keyring.gpg
$ printf 'Types: deb\nURIs: https://engineering87.github.io/sibillaos/apt/\nSuites: ./\nSigned-By: /usr/share/keyrings/sibillaos-archive-keyring.gpg\n' \
    | sudo tee /etc/apt/sources.list.d/sibillaos.sources
$ sudo apt update && sudo apt install llmd
$ sudo sibilla setup

Reversible with sudo sibilla remove, CI-verified. From the ISO (amd64): .part files plus SHA256SUMS, reassemble, verify, write to USB. From the cloud image (amd64/arm64): verify against SHA256SUMS-cloud-<arch>, boot with your cloud-init user-data - optionally including an /etc/llmd/profile the machine converges on.

Known limitations

Plain HTTP with mandatory bearer keys by default: enable TLS with sibilla tls before exposing the port. Rate limiting is per-IP; per-key fairness stays deferred with the Caddy-vs-nginx decision recorded. Air-gapped payloads cover the Ollama engine. GPU support on real silicon awaits tester reports (see the call in the README); vLLM on physical datacenter GPUs remains the standing v1.0 debt. The curated catalog only contains permissively licensed, non-gated models.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums and attestations

See the attached SHA256SUMS files; SBOMs and the installed-package inventory are attached to this release.

What's Changed

• release: v0.7.0 - found, believed, working on real hardware by @engineering87 in #6

Full Changelog: v0.6.0...v0.7.0

SibillaOS v0.6.0

Three audiences, one release: agent users who want a local model their frameworks can discover, on-premise deployments where the network is not a given, and whoever runs more than one machine. Systems installed from 0.4.0 onward receive it through a plain sudo apt update && sudo apt upgrade - and for the first time that promise is not just kept but tested: CI now installs the previous release from the live repository, upgrades, and requires the serving machine to survive untouched.

What is new

The local model as an MCP server. sudo sibilla mcp enable exposes chat and list_models tools at /mcp, behind the same API keys as the API. The point is the direction of trust: an agent (Claude Code, or any Model Context Protocol client over Streamable HTTP) can delegate work on sensitive material to a model that cannot exfiltrate it. The server is ~250 lines of Python standard library, stateless, loopback-only, sandboxed, and never reads the keys; sudo sibilla connect --mcp prints the ready claude mcp add command. Details in docs/mcp.md.

Air-gapped installs, end to end. Machines with no outbound network are exactly where the on-premise pitch matters, and they are now first-class: prepare a companion volume on a connected machine with tools/build-airgap-payload.sh (every file resolved on Hugging Face by its catalog digest and verified before it enters the payload), label it SIBILLA-AIRGAP, attach it before first boot - the machine imports the models through the signed-catalog digest gate and serves without ever reaching for the network. The same gate powers sibilla model import FILE for by-hand delivery: a USB stick becomes a reviewable channel, because identification and integrity come from the same signed record and there is no --force to bypass it. CI proves the whole story on every push by booting the cloud image in a VM whose outbound network is dropped. Details in docs/airgap.md.

Configuration as code. One KEY=value profile file declares the machine (model, TLS, metrics, MCP, WebUI; every key optional, so partial profiles compose) and the idempotent sudo sibilla apply converges onto it, running only the commands that close a gap. sibilla apply export turns a configured machine into a profile, which makes replication one file copy. cloud-init or a fleet tool writes /etc/llmd/profile and first boot picks it up, on the images and on the apt path alike; the air-gapped payload can carry it too. API keys are deliberately not part of a profile. Details in docs/configuration.md.

Embeddings for local RAG. The curated catalog gains an embedding role - nomic-embed-text v1.5 is the first entry, digests recorded - and /v1/embeddings answers behind the same keys, so a fully local RAG stack points at this one machine. Embedding models can never become the chat default: the selector skips them and sibilla model use refuses them. sibilla model pull stages any catalog model, digest-verified, without switching what is served. Details in docs/embeddings.md.

Developer kit. sudo sibilla connect grows single-purpose outputs that print only their payload: --env (the variables every OpenAI SDK and framework reads), --mcp, --snippet python|node; --write places the aider configuration next to the Continue one (which also covers JetBrains), backups and 600 permissions included. sudo sibilla bench measures what a client of this machine actually experiences - time to first token and generation speed, through the authenticated gateway - and prints a shareable markdown table.

Rate limiting baseline. Appliance first boot installs a kernel-level per-IP limit on new gateway connections (generous for keep-alive clients, a wall for floods), proxy-agnostic by construction; sibilla remove strips it. Per-key fairness limiting is deferred with its design recorded: the gateway evaluation (Caddy vs nginx, all facts verified) lives in the architecture decision log.

Hardening this cycle forced: the MCP unit signals readiness to systemd so sibilla mcp enable returns only when the endpoint answers; the pinned ollama install retries a mid-download reset in setup, cloud bake and ISO alike; the payload builder honors HF_TOKEN and reuses digest-verified files without touching the network.

What has been verified

The full pipeline on every push, now fourteen jobs deep: ISO build, BIOS/UEFI/Secure-Boot boots, unattended install with real inference, TLS and the complete auth matrix, multi-model, digests, metrics, firewall (rate limit rule asserted in the file and in the kernel), sandbox, SBOM and the CVE gate, cloud images on amd64 and arm64, the guest lifecycle (install, setup, MCP initialize/tools/call with a 401 guard, offline import positive and negative, declarative profile drift/idempotence/rejection, bench, doctor without key leaks, connect kit outputs, verified-clean removal), the air-gapped deploy with outbound network dropped, and the upgrade from the published release with key, model and gateway intact. Known limits stay documented: Open WebUI's login flow and vLLM on physical GPUs remain outside CI; arm64 token generation is exercised but not asserted under emulation.

Installation

On an existing Ubuntu 24.04 machine:

$ curl -fsSL https://engineering87.github.io/sibillaos/apt/sibillaos-archive-key.asc \
    | sudo gpg --dearmor -o /usr/share/keyrings/sibillaos-archive-keyring.gpg
$ printf 'Types: deb\nURIs: https://engineering87.github.io/sibillaos/apt/\nSuites: ./\nSigned-By: /usr/share/keyrings/sibillaos-archive-keyring.gpg\n' \
    | sudo tee /etc/apt/sources.list.d/sibillaos.sources
$ sudo apt update && sudo apt install llmd
$ sudo sibilla setup

Trying it is reversible: sudo sibilla remove takes out exactly what was installed, verified in CI. From the ISO (amd64): download the .part files and SHA256SUMS, reassemble, verify, write to USB. From the cloud image (amd64 or arm64): verify against SHA256SUMS-cloud-<arch>, boot the qcow2 with your cloud-init user-data - optionally including an /etc/llmd/profile the machine will converge on.

Known limitations

The default gateway mode is plain HTTP with mandatory bearer tokens; enable TLS with sibilla tls before exposing the port beyond the machine. Rate limiting is per-IP; per-key fairness is deferred (design recorded in the architecture log). The MCP surface is tools-only by design. Air-gapped payloads cover the Ollama engine; vLLM machines are out of scope for now. The curated catalog only contains permissively licensed, non-gated models. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request and is not part of the images. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums and attestations

See the attached SHA256SUMS files; SBOMs (sbom-llmd-packages.*.json) and the installed-package inventory (installed-packages.tsv) are attached to this release.

What's Changed

• release: v0.6.0 - agents, the road off the network, configuration as code by @engineering87 in #5

Full Changelog: v0.5.0...v0.6.0

SibillaOS v0.5.0

The adoption release: this cycle is about lowering the cost of trying SibillaOS. You no longer need to reinstall a machine to evaluate it, and walking away is as clean as arriving. This is also the first release where the upgrade promise from 0.4.0 is exercised: systems installed from the previous images receive these llmd packages through a plain sudo apt update && sudo apt upgrade.

What is new

Zero-reinstall path. An existing Ubuntu 24.04 machine becomes the appliance with two commands: sudo apt install llmd from the project repository, then sudo sibilla setup. Setup detects the hardware, installs the pinned engine if it is missing, pulls a fitting model and serves the authenticated API on port 8080 - the same stack the images ship, without touching the disk layout. It behaves as a guest, not an owner: no firewall changes, no package source flips, no appliance takeover (those behaviors stay exclusive to the installed images). If the machine already runs Caddy, the existing configuration is backed up before the gateway is rendered.

Reversible trial: sibilla remove. The teardown removes only what SibillaOS put on the machine - services, downloaded models, configuration, keys, the llmd packages themselves, and the engine only if sibilla setup installed it - then restores anything it displaced, including a pre-existing Caddy configuration. It shows an inventory (with the disk space coming back) and asks before acting; --yes skips the prompt for scripts. CI proves the promise on every push: after removal it asserts that no llmd package, no configuration, no model store and no engine binary remain, and that the gateway port is dead.

sibilla doctor. One command collects what a bug report needs - OS, kernel, hardware, package versions, configuration (paths only), unit states, endpoint probes, storage, recent service logs - into a single paste-ready report. The report contains no secrets by construction: every configured API key is scrubbed from the whole output before it reaches the terminal, and CI asserts on every push that the key never appears. This matters more than it looks: the packaged Caddy unit starts with --environ, which dumps the process environment (gateway keys included) into the journal, exactly the kind of leak a naive log excerpt would paste into a public issue.

sibilla connect --write. The connection kit could already print ready-to-paste configuration for VS Code (Continue, Cline), aider and any OpenAI-compatible client; with --write it now places the Continue configuration directly in the invoking user's home (the user behind sudo, not root), backing up any existing file first and restricting permissions on the result, since it contains the key.

README and first-run experience. The README now leads with the two-command quick start, shows an example session up front and carries a proper architecture diagram. Issue templates were already in place; sibilla doctor gives reporters something precise to paste into them.

What has been verified

The full pipeline on every push, now including a complete guest lifecycle on a plain Ubuntu runner: repository install of the llmd metapackage, sibilla setup, gateway up with mandatory auth, an authenticated API call, a doctor report asserted complete and free of the API key, the Continue configuration written for the sudo user, and sibilla remove followed by proof of a clean machine. Alongside it, everything the previous releases established: ISO build, BIOS, UEFI and UEFI-Secure-Boot boots, unattended install, real chat completion, TLS and the complete auth matrix, multi-model serving, model digest verification, webui plumbing, metrics, firewall and sandbox assertions, SBOM generation and the CVE gate, and the cloud image built and deployed on amd64 and arm64. Known limits stay as documented: the Open WebUI login flow and vLLM on physical GPUs remain outside CI, and arm64 token generation is exercised but not asserted under emulation.

Installation

On an existing Ubuntu 24.04 machine (new in this release):

$ curl -fsSL https://engineering87.github.io/sibillaos/apt/sibillaos-archive-key.asc \
    | sudo gpg --dearmor -o /usr/share/keyrings/sibillaos-archive-keyring.gpg
$ printf 'Types: deb\nURIs: https://engineering87.github.io/sibillaos/apt/\nSuites: ./\nSigned-By: /usr/share/keyrings/sibillaos-archive-keyring.gpg\n' \
    | sudo tee /etc/apt/sources.list.d/sibillaos.sources
$ sudo apt update && sudo apt install llmd
$ sudo sibilla setup

From the ISO (amd64): download all .part files and SHA256SUMS, reassemble, verify, write to a USB drive:

$ cat sibillaos-0.5.0-amd64.iso.part* > sibillaos-0.5.0-amd64.iso
$ sha256sum -c SHA256SUMS
$ sudo dd if=sibillaos-0.5.0-amd64.iso of=/dev/sdX bs=4M status=progress

From the cloud image (amd64 or arm64): verify against SHA256SUMS-cloud-<arch>, then boot the qcow2 with your cloud-init user-data as usual.

Known limitations

The default gateway mode is plain HTTP with mandatory bearer tokens; enable TLS with sibilla tls before exposing the port beyond the machine. Gateway rate limiting is not implemented yet. sibilla setup targets Ubuntu 24.04, the same base the images build on. Model digests currently cover the CI-verified entry; the tooling to extend them to the whole catalog ships in tools/. The curated catalog only contains permissively licensed, non-gated models. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request and is not part of the images. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums and attestations

See the attached SHA256SUMS files; SBOMs (sbom-llmd-packages.*.json) and the installed-package inventory (installed-packages.tsv) are attached to this release.

What's Changed

• release: v0.5.0 - adoption: zero-reinstall path and the good-guest lifecycle by @engineering87 in #4

Full Changelog: v0.4.0...v0.5.0

SibillaOS v0.4.0

The supply chain release: this cycle is about being able to answer, with evidence, the questions a security review asks. Who can call the API, how updates arrive, whether the model you serve is the one that was reviewed, and what exactly is inside the images.

Upgrading from 0.3.0 still means reinstalling once: from this release onward, installed systems receive llmd package updates through apt.

What is new

API key lifecycle. The gateway accepts multiple keys: sudo sibilla key add NAME creates one per client or teammate, revoke kills it on the next request, rotate replaces the default. Revocation is immediate. The gateway also writes structured JSON access logs to /var/log/caddy/sibilla-access.log, so "who called what, when" has an answer.

APT repository. Each release publishes a GPG-signed package repository on GitHub Pages. Freshly installed systems come preconfigured (the source activates itself at first boot, once the repository answers) and sudo apt update && sudo apt upgrade keeps the llmd stack current between reinstalls. Manual setup for existing systems is one keyring and one sources file, documented in apt/README.md.

Signed catalog, verified models. The curated model catalog is signed with the project key and verified before every use: a tampered catalog is refused everywhere. Catalog entries now record the sha256 of the model artifacts (the same digest Hugging Face publishes and ollama stores blobs under): sibilla model use refuses to serve an artifact that does not match, and first boot warns loudly if the downloaded model differs from the reviewed one.

SBOM and CVE scanning. Every release attaches a Software Bill of Materials (SPDX and CycloneDX) for the packages this project builds, plus the full package inventory of a system actually installed by the CI install test. CI scans that inventory for vulnerabilities on every push; the gate and the triage policy are documented in docs/supply-chain.md.

Secure Boot, verified. CI now boots every ISO under UEFI firmware with Secure Boot enforced and Microsoft keys enrolled, and requires the kernel itself to report Secure Boot active. The signed shim and GRUB chain from Ubuntu survives the SibillaOS repack, provably, on every push. Reports from physical Secure Boot machines remain welcome.

Reliability work that this cycle forced: the installer now pins the apt mirror (no geoip redirect), skips apt Translation indexes (a mid-sync CDN serving one stale localization file used to fail the whole install), retries transient fetches, and dumps real diagnostics to the serial console if it ever fails, powering off instead of hanging. The cloud image bake gained the same robustness.

What has been verified

The full pipeline on every push: ISO build, BIOS, UEFI and UEFI-Secure-Boot boots, unattended install, real chat completion, TLS and the complete auth matrix (missing key, wrong key, added key, revoked key, rotated default), multi-model serving, model digest verification against the catalog, webui plumbing, metrics endpoint, firewall and sandbox assertions, access log content, package inventory capture, SBOM generation and the CVE gate; plus the cloud image built and deployed on amd64 and arm64. Known limits stay as documented: the Open WebUI login flow and vLLM on physical GPUs remain outside CI, and arm64 token generation is exercised but not asserted under emulation.

Installation

From the ISO (amd64): download all .part files and SHA256SUMS, reassemble, verify, write to a USB drive:

$ cat sibillaos-0.4.0-amd64.iso.part* > sibillaos-0.4.0-amd64.iso
$ sha256sum -c SHA256SUMS
$ sudo dd if=sibillaos-0.4.0-amd64.iso of=/dev/sdX bs=4M status=progress

From the cloud image (amd64 or arm64): verify against SHA256SUMS-cloud-<arch>, then boot the qcow2 with your cloud-init user-data as usual.

Known limitations

The default gateway mode is plain HTTP with mandatory bearer tokens; enable TLS with sibilla tls before exposing the port beyond the machine. Gateway rate limiting is not implemented yet. Model digests currently cover the CI-verified entry; the tooling to extend them to the whole catalog ships in tools/. The curated catalog only contains permissively licensed, non-gated models. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request and is not part of the images. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums and attestations

See the attached SHA256SUMS files; SBOMs (sbom-llmd-packages.*.json) and the installed-package inventory (installed-packages.tsv) are attached to this release.

What's Changed

• Release/0.4 by @engineering87 in #3

Full Changelog: v0.3.0...v0.4.0

SibillaOS v0.3.0

The operations release: SibillaOS grows from a working demo into something you can run and watch on real infrastructure, and it stops being x86-only. Upgrading from 0.2.0 means reinstalling; an APT repository for in-place package updates is planned for the next cycle.

What is new

One CLI. sibilla is the single entry point: sibilla status, sibilla model, sibilla tls, sibilla metrics, sibilla webui, sibilla connect. The old sibilla-* commands keep working as aliases. sibilla status is now a real health view (engine state, models actually served by the engine, disk usage of the model store, GPU utilization, gateway reachability in the configured mode) and exits nonzero when the engine or gateway is down, so scripts can use it as a check. sibilla model rm and sibilla model prune reclaim disk and refuse to touch the served model.

Cloud image, on two architectures. Alongside the ISO, each release now ships a qcow2 cloud image for amd64 and arm64. Attach your own cloud-init user-data (user, SSH keys) as on any Ubuntu cloud image; the LLM stack configures itself at first boot, detecting the hardware it actually landed on, GPU included. Works with Proxmox, libvirt, Ampere and Graviton instances, and anything that speaks cloud-init.

Observability. sudo sibilla metrics enable serves Prometheus metrics at /metrics/gateway, behind the same bearer token as the API: request rate, latency histograms, status codes, upstream health. A ready-made Grafana dashboard and a Prometheus scrape configuration live in docs/observability/. With vLLM as the engine, its native metrics pass through the gateway at /metrics; Ollama at the pinned version exposes no Prometheus endpoint (verified in its source; the pin will be revisited).

Security baseline. The firewall is on from the first boot, with only SSH and the gateway port open; Open WebUI's port stays closed until you open it deliberately (the enable command prints how), and sibilla tls --acme opens 80/443 itself. Automatic security updates are enabled by default. The systemd sandbox now covers the gateway and first-boot units and both containers run with no-new-privileges; CI asserts these directives on every install.

Fixes worth noting: sibilla webui enable no longer blocks silently until the multi-GB image pull completes; the llmfit tarball is verified against its published sha256 on both architectures; the llmd packages declare their real curl dependency instead of inheriting it from the base images.

What has been verified

Every commit goes through a pipeline that builds the ISO, boots it under BIOS and UEFI, performs a complete unattended installation, and exercises the whole surface on the installed system: real chat completion, TLS certificate issuance and the full auth matrix, multi-model serving, the webui plumbing, the metrics endpoint (on, authenticated, surviving TLS mode switches), the firewall state, the sandbox directives, prune keeping the served model. New in this release: the cloud image is built and then deployed in CI with a plain user seed on both amd64 and arm64, with a chat completion obtained on amd64.

Honest limits of the pipeline: GitHub's arm64 runners have no KVM, so the arm64 deploy runs under TCG emulation; the API surface (gateway auth, served model, health view) is asserted there, token generation is exercised but not asserted. The Open WebUI web interface itself and the vLLM path on physical datacenter GPUs remain outside CI; reports are welcome.

Installation

From the ISO (amd64): download all .part files and SHA256SUMS, reassemble, verify, write to a USB drive:

$ cat sibillaos-0.3.0-amd64.iso.part* > sibillaos-0.3.0-amd64.iso
$ sha256sum -c SHA256SUMS
$ sudo dd if=sibillaos-0.3.0-amd64.iso of=/dev/sdX bs=4M status=progress

From the cloud image (amd64 or arm64): verify against SHA256SUMS-cloud-<arch>, then boot the qcow2 with your cloud-init user-data as you would the stock Ubuntu cloud image. Give the VM at least 8 GB of RAM and 10 GB of disk plus room for your model.

Known limitations

The default gateway mode is plain HTTP with a mandatory bearer token; enable TLS with sibilla tls before exposing the port beyond the machine. The arm64 build is available as the cloud image only; an arm64 ISO is deferred. The curated catalog only contains permissively licensed, non-gated models; gated models require a Hugging Face token and are not supported yet. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The images bundle vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI is pulled at the user's request and is not part of the images. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums

See the attached SHA256SUMS (ISO) and SHA256SUMS-cloud-<arch> (cloud images) files.

What's Changed

• release: v0.3.0 - operations (unified CLI, cloud images, metrics, security baseline) by @engineering87 in #2

Full Changelog: v0.2.0...v0.3.0

SibillaOS v0.2.0

The operability release: everything needed to run SibillaOS beyond the first demo. Upgrading from 0.1.0 means reinstalling; an APT repository for in-place package updates is on the roadmap.

What is new

HTTPS on the gateway. sudo sibilla-tls enable myserver.lan switches the gateway to HTTPS with a locally trusted certificate from Caddy's internal CA; --acme you@example.org uses Let's Encrypt for public hostnames instead. sibilla-tls disable returns to plain HTTP. The proxy now rewrites the upstream Host header, fixing a bug where Ollama's DNS-rebinding protection silently rejected every authenticated request as soon as the gateway served a hostname.

Editor and agent hookup. sudo sibilla-connect prints ready-to-paste configuration for VS Code (Continue and Cline), aider and any OpenAI-compatible client, wired to your endpoint, API key and served model, including the CA certificate note when TLS runs in local-CA mode.

Chat interface. sudo sibilla-webui enable starts Open WebUI on port 3000 as an opt-in container; disable stops it and keeps it off across reboots.

Multi-model serving. The gateway passes the model field through, so several models can be pulled with sibilla-model use and addressed by name in the same API.

Self-contained install. llmfit now ships as a Debian package built from the pinned upstream release, removing the last install-time dependency on an external install script.

Security policy. SECURITY.md documents the private disclosure channel and the project's current security posture; the roadmap gained a dedicated security track (default firewall profile, unit sandboxing checks, automatic security updates, signed catalog).

What has been verified

Every commit goes through a pipeline that builds the ISO, boots it under BIOS and UEFI, performs a complete unattended installation, reboots into the installed system, downloads a model and obtains a real chat completion through the authenticated gateway. New in this release's pipeline: the TLS path (certificate issuance from the local CA, rejection of missing and wrong API keys, return to plain HTTP), a second model pulled and queried by name, the connection kit output, the rendered gateway configs validated by Caddy itself, the container units validated by the podman Quadlet generator, and the Open WebUI plumbing (unit generation, flag gating, enable/disable). Engine versions are pinned (Ollama 0.31.1, llmfit 0.9.36) and the Ubuntu base image is verified against its official checksums during the build.

Not covered by the pipeline: the Open WebUI web interface itself (the container image is too large to pull in CI; the packaging around it is tested, the login-and-chat flow is not) and the vLLM path on physical datacenter GPUs. Reports on both are welcome.

Installation

GitHub caps release assets at 2 GiB, so the ISO is published in parts. Download all .part files and SHA256SUMS, reassemble, verify, then write the image to a USB drive:

$ cat sibillaos-0.2.0-amd64.iso.part* > sibillaos-0.2.0-amd64.iso
$ sha256sum -c SHA256SUMS
$ sudo dd if=sibillaos-0.2.0-amd64.iso of=/dev/sdX bs=4M status=progress

Boot from the drive and select "Install SibillaOS (automated)". A wired network connection during installation is recommended: the model download starts during install and resumes at first boot if interrupted. Minimum practical requirements: 8 GB of RAM, 25 GB of disk, and either a supported GPU or patience with CPU inference.

Known limitations

The default gateway mode is still plain HTTP with a mandatory bearer token; enable TLS with sibilla-tls before exposing the port beyond the machine. Open WebUI listens on all interfaces when enabled; treat port 3000 accordingly. The curated catalog only contains permissively licensed, non-gated models; gated models (Llama, Gemma) require a Hugging Face token and are not supported yet. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The image bundles vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); Open WebUI (BSD-3-Clause with a branding clause in recent versions) is pulled at the user's request and is not part of the image. NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums

See the attached SHA256SUMS file.

What's Changed

• release: v0.2.0 - operability (TLS, multi-model, connect kit, WebUI) by @engineering87 in #1

New Contributors

• @engineering87 made their first contribution in #1

Full Changelog: v0.1.0...v0.2.0

SibillaOS v0.1.0

First public release. SibillaOS is a Linux distribution based on Ubuntu 24.04 LTS that ships with a local LLM: install it, and the machine serves an OpenAI-compatible API from its first boot.

What this release does

The installer walks you through the standard Ubuntu screens (locale, keyboard, network, disk, your own user and password). Everything LLM-related happens automatically: the system detects your hardware, selects an inference engine (vLLM in a container on datacenter GPUs with 24 GB of VRAM or more, Ollama everywhere else, CPU-only machines included), asks llmfit which model actually fits your memory, downloads it from Hugging Face and brings up an authenticated gateway on port 8080.

After installation:

$ sibilla-model status
engine:  ollama
model:   hf.co/bartowski/Qwen_Qwen3-4B-GGUF
api:     http://192.168.1.50:8080 (key in /etc/llmd/apikey)

$ curl http://192.168.1.50:8080/v1/chat/completions \
    -H "Authorization: Bearer $(sudo cat /etc/llmd/apikey)" \
    -d '{"model": "default", "messages": [{"role": "user", "content": "hello"}]}'

sibilla-model list shows the curated models that fit your machine; sibilla-model use ID downloads and switches the served model.

What has been verified

Every commit on main goes through a pipeline that builds the ISO, boots it under both BIOS and UEFI firmware, performs a complete unattended installation in a virtual machine, reboots into the installed system, downloads a model and obtains a real chat completion through the authenticated gateway. This release is cut from a fully green pipeline. Engine versions are pinned (Ollama 0.31.1, llmfit 0.9.36) and the Ubuntu base image is verified against its official checksums during the build.

Installation

GitHub caps release assets at 2 GiB, so the ISO is published in parts. Download all .part files and SHA256SUMS, reassemble, verify, then write the image to a USB drive:

$ cat sibillaos-0.1.0-amd64.iso.part* > sibillaos-0.1.0-amd64.iso
$ sha256sum -c SHA256SUMS
$ sudo dd if=sibillaos-0.1.0-amd64.iso of=/dev/sdX bs=4M status=progress

Boot from the drive and select "Install SibillaOS (automated)". A wired network connection during installation is recommended: the model download starts during install and resumes at first boot if interrupted. Minimum practical requirements: 8 GB of RAM, 25 GB of disk, and either a supported GPU or patience with CPU inference.

Known limitations

The gateway serves plain HTTP with a mandatory bearer token. Do not expose port 8080 beyond your LAN; TLS termination is planned for a future release together with a hostname setup step. The vLLM path (datacenter GPUs) is implemented but has not yet been exercised on physical GPU hardware; reports are welcome. The curated catalog only contains permissively licensed, non-gated models; gated models (Llama, Gemma) require a Hugging Face token and are not supported yet. Sharded GGUF repositories are not supported by the Ollama pull path.

Licensing

SibillaOS components are licensed under Apache-2.0. The image bundles vLLM (Apache-2.0), Ollama (MIT) and llmfit (MIT); NVIDIA drivers are installed from the Ubuntu restricted component and are not redistributed by this project. Models are downloaded by the user from Hugging Face under their respective licenses.

Checksums

See the attached SHA256SUMS file.

Full Changelog: https://github.com/engineering87/sibillaos/commits/v0.1.0