An organization focused on developer tooling and core (mostly go) libraries.

Small, dependency-light, aggressively pinned. Everything here is built the same way, because the rules are written down and a tool enforces them.

🔒 marks a private repository

• limen — every rule written, verifiable, enforceable. Checks, fixes and bootstraps our repositories: mandatory files, pinned tooling, GitHub settings. Its engineering handbook is the doctrine the rest of this organization follows.
• limen-install — one script to make a machine ready for development: aqua and limen, pinned and signature-verified, on macOS, Linux and Windows.
• homebrew-brews — our Homebrew tap: our own tools, plus hardened forks of upstream formulas (openssh without OpenSSL, ed25519-only, baked-in config).
• mumbrew — keep your brews updated automatically.
• tarmac — a dependency-free shell script that installs a per-user Homebrew on a blank macOS, and seeds .profile.
• ssh-agent — a macOS user launch agent for ssh-agent, for YubiKeys and other sk- keys the vanilla macOS agent does not support.
• 🔒 onboarding — workstation provisioning: shell dotfiles and a bootstrap on top of tarmac.

• ossein — a minimalistic, rootless, daemonless, microVM-based container runtime and image builder for macOS.
• ossein-kernel — a Linux kernel image builder for macOS: baseline configuration and patches tuned for Apple VZ, producing sub-10MB images.
• lepton — a modern containerd CLI (Linux, kernel 5.13+, containerd 2.0+).
• quark — a declarative container image management SDK in Go: build, sync, scan and audit images across platforms and registries, plus SSH and secret primitives.
• hadron — a declarative Docker deployment tool that brings remote Docker hosts to a desired state over SSH.
• gluon — deployment plans and helpers built on quark.
• godolint — a Dockerfile linter, written in Go.
• healthcheckers — tiny http, dns and rtsp clients meant to be used as container HEALTHCHECKs.
• 🔒 go-vz — Go bindings for Apple's Virtualization.framework.

• go-core — the basics every one of our Go projects uses: logging, error reporting, telemetry, network/TLS settings, exec, and human-readable units and durations.
• go-containers — basics for the containers ecosystem, deriving from containerd, nerdctl and moby.
• go-mdns — mDNS, on top of third-party Go libraries.
• go.farcloser.world — the vanity import root for our Go packages.

• open-source-help-desk — documentation easing the mundane hurdles of contributing to open source, starting with a thorough git cheat sheet (DCO, signing, rebasing, squashing).
• .github — this repository: the organization profile and the community health files every other repository inherits.

• tigron — a modern testing framework for command-line applications. Superseded upstream: use github.com/containerd/nerdctl/mod/tigron.
• tag — ID3, MP4 and OGG/FLAC metadata parsing in Go.

Projects here are provided as-is, best-effort, without warranty.

• Contributing guide — sign-off (DCO), mandatory commit signing, commit rules, pull request flow.
• Security policy — never report a vulnerability in a public issue; use private vulnerability reporting.
• Bugs and ideas go to the issue tracker of the repository they concern.