I have no idea what I'm f*cking doing. Something I keep questioning:
Why the hell am I building an operating system for this?
Seriously.
Every couple of weeks I look at ShrekOS, look at the amount of work involved in building an actual Linux distribution, and have basically the same reaction.
This is f*cking ridiculous.
I wanted a safer way to run AI agents on my computer.
Somehow that turned into an immutable Debian system with isolated workloads, capability grants, controlled egress, verified updates, a desktop policy layer, an installer, and enough architecture documents to make me question every decision that led me here.
There has to be an easier answer.
There has to be some tool I missed.
Run the agents in Docker.
Use Podman.
Use a VM.
Use a better agent harness.
Install some security middleware.
Find a desktop application that manages all of this.
Anything other than:
Build a f*cking operating system.
So I keep trying to prove that ShrekOS does not need to exist.
And the annoying part is that every time I do, I eventually end up back at the same problem.
I already wrote the technical version of this question in Why I'm Building ShrekOS When Containers Already Exist.
I am not going to repeat that whole argument here.
Containers are useful. I use them.
The Bench system in ShrekOS literally runs on rootless container technology. I did not invent a magical new isolation primitive because AI showed up.
Namespaces exist.
Seccomp exists.
Landlock exists.
Containers exist.
Virtual machines exist.
Linux already has an absurd number of ways to restrict a process.
That is not the thing I keep getting stuck on.
The thing I cannot seem to find is the user space around all of it.
Not userspace in the kernel terminology sense.
I mean the actual space where the human uses the computer.
The desktop.
The workflow.
The place where I can run several autonomous things on my machine and understand, at a glance, what each one is allowed to do.
This is the part that keeps dragging me back into ShrekOS.
Say I have three agents running.
One is working on a source repository.
One is researching something on the web.
One is processing a folder full of documents.
I want my computer to understand that these are three different actors with three different scopes.
The coding agent might get:
~/projects/foo read/write
github.com network
compiler allowed
shell allowed
secrets scoped GitHub credential
The research agent might get:
~/research read/write
web network
shell no
secrets none
The document agent might get:
~/documents/input read only
~/documents/output read/write
network none
shell maybe
And I do not just want those rules buried in a Docker command somewhere.
I want to see them.
I want the desktop to understand them.
I want an agent to be able to ask:
I need access to this folder.
And I want the machine to show me exactly what is being requested.
Not some vague:
Claude wants permission to use Bash.
What the f*ck does that mean?
Bash can delete my files.
Bash can read my SSH keys.
Bash can run curl.
Bash can launch another program.
Bash is not a permission.
I want the request to be:
This workload wants read/write access to /home/me/projects/foo for this task.
Or:
This workload wants HTTPS access to github.com.
That I can reason about.
That is a thing I can say yes or no to.
And after I say yes, I want something outside the agent to make it true.
Because now I hear myself.
I wanted better permission prompts for AI agents, so apparently I am building a Linux distribution.
Cool.
Totally normal response.
This is usually where I stop and go researching again.
Surely somebody has made the nice version of this already.
And I keep finding pieces.
I find agent interfaces that make running multiple agents nicer.
I find sandboxes that isolate code execution.
I find container runtimes.
I find VM based environments.
I find approval systems.
I find MCP permission mechanisms.
I find orchestration layers.
I find tools for giving an agent its own disposable computer.
All useful.
Some of them are really f*cking cool.
But I keep failing to find the thing I am actually picturing.
A general-purpose desktop environment where autonomous agents are treated as first-class untrusted actors, and where their filesystem access, network access, tools, credentials, persistence, and escalation are coherent parts of the computer's operating model.
Maybe it exists and I have somehow missed it.
I would genuinely love to be wrong about that.
Because it would save me a tremendous amount of work.
Launching an agent is easy.
I can open a terminal right now and run one.
I can put it in a container.
I can put the container in a VM.
I can disconnect the network.
I can bind mount a project folder.
I can build an AppArmor policy.
I can put nftables rules around it.
I can do all kinds of things.
But notice who is doing all of that.
Me.
Manually.
Before the agent runs.
Using a collection of infrastructure tools that were not designed around this interaction.
That is fine for testing a security architecture.
It is a shitty everyday user experience.
I do not want to spend the next ten years launching increasingly powerful agents with increasingly elaborate shell commands.
And I definitely do not expect normal people to do it.
There should be a layer above the primitives.
Something should compose them.
Something should remember that this project gets this directory, this network scope, these tools, and no credentials unless I explicitly grant one.
Something should present that coherently to the human sitting at the machine.
That is the layer I keep looking for.
This is the frustrating part.
Every time I start with:
ShrekOS is probably a stupid amount of work for this.
I eventually reduce the problem again.
I do not need a new kernel.
I do not need a new container runtime.
I do not need to invent filesystem isolation.
I do not need to invent network filtering.
I need a computer that composes those things around agentic workflows as a normal part of using the machine.
And then I look back at ShrekOS.
Oh.
F*ck.
That is what I have been building.
Not "Linux, but with AI."
God, I hope not.
Not an operating system where an LLM gets root and becomes Clippy with sudo.
The idea is almost the opposite.
It is a developer operating system where agents can be extremely capable without capability automatically becoming authority over the whole machine.
The agent can ask.
The agent can work.
The agent can f*ck up.
The machine still owns the boundary.
I want to leave this possibility open because I think it matters.
ShrekOS could still prove itself unnecessary.
Maybe I finish enough of this architecture to understand the problem properly and discover that almost all of it can be extracted into a runtime that installs cleanly on Debian, Ubuntu, Fedora, whatever.
Maybe the useful thing eventually looks less like:
install ShrekOS
and more like:
install the Shrek agent runtime
Maybe ShrekOS becomes the reference implementation where every assumption is controlled, while the useful pieces escape into normal Linux.
That would not make building ShrekOS a failure.
It might actually be the best outcome.
Because right now I do not know where the boundary between "this should be an application" and "this actually needs operating system support" is.
I am finding it by building the f*cking thing.
There are pieces I already suspect could live perfectly well on another distribution.
There are other pieces where the host itself matters a lot more.
If the thing enforcing the policy can be casually replaced or modified by the same environment the agent is operating in, that changes the trust model.
If arbitrary software can silently punch holes around the policy layer, that changes it too.
If the machine boots into some unknown pile of mutable state, I have more assumptions to reason about.
How much of that matters in practice?
I don't completely know yet.
That is part of the experiment.
At first I thought repeatedly asking "why the f*ck am I building an OS?" meant I lacked confidence in the idea.
Maybe some of it is that.
I am building something way outside the scale of anything I have built before. Questioning whether I have massively overcomplicated it seems pretty reasonable.
But I think something else is happening too.
I keep trying to kill the premise.
Every time I find an existing technology that might make part of ShrekOS unnecessary, I want to use it.
Good.
Please make parts of this project unnecessary.
I already have enough shit to build.
If Docker solves something, use Docker.
If Landlock solves something, use Landlock.
If systemd solves something, use systemd.
If somebody releases a better sandbox tomorrow, steal the lesson and reconsider the design.
The goal is not to justify ShrekOS.
The goal is to figure out what the smallest coherent answer to this problem actually is.
So far, every time I strip another unnecessary invention away, I keep arriving at the same stubborn little requirement:
There needs to be a human-facing layer between autonomous agents and the authority of the computer they are operating on.
Not just a prompt.
Not just an agent framework permission checkbox.
Not just a container I manually assembled.
A real operating boundary, exposed as something a person can actually understand and use.
Maybe that eventually belongs in every desktop operating system.
Maybe ShrekOS is an unnecessarily large prototype of something that should eventually be much smaller.
Maybe in three years I will look back at this and wonder why the hell I built half of it.
I am completely open to that.
But I cannot find the thing I want to use today.
So apparently I am still building it.