StartOS v0.4.0

v0.4.0 is a complete rewrite of StartOS. After six years of building, we believe we have arrived at the correct architecture and foundation to deliver on the promise of sovereign computing.

⚠️ Before You Update

Everyone is welcome to participate in the public beta! However, the only way to update is by following the 0.4.0 Update Guide precisely. This is a sensitive update between two essentially distinct operating systems — skipping steps or improvising can result in data loss.

👉 Read the full update guide before proceeding

If anything goes wrong, stop and contact support — do not attempt to troubleshoot on your own.

Highlights

• Redesigned UI — faster, more intuitive, mobile-friendly, with a real-time system metrics dashboard
• Completely new networking stack — LAN port forwarding, Wireguard VPN gateways, private and public domains (clearnet), Let's Encrypt, built-in DNS, and Tor as an optional plugin
• StartTunnel — free, open-source reverse tunnel to expose services on a public domain without revealing your home IP
• LXC container runtime — replacing Docker/Podman with a reliable, nested container architecture supporting hardware acceleration and multi-container setups
• Improved backups — differential backups, cross-server restore, and a new FUSE module for cross-platform reliability
• Internationalization — multiple languages and keyboard layouts for StartOS and services
• TypeScript SDK — build and ship a StartOS package in minutes
• New S9PK format — signature verification, partial downloads, and multi-architecture support
• SMTP notifications — email alerts from StartOS and services via Gmail, SES, or any SMTP provider

Important

Previous backups are incompatible with v0.4.0. After updating, immediately update all services and create a fresh backup.

What's Changed

• fix(tunnel/web): allow non-ECDSA leaves in import-certificate by @helix-nine in #3199
• docs(contributing): drop --branch next/major from clone snippet; clarify PR target by @helix-nine in #3198
• feat(net): reverse-proxy auth gate (Bearer / Basic) with X-Forwarded-User by @helix-nine in #3190
• fix(net/acme): honor Retry-After after failed ACME orders by @helix-nine in #3194
• feat(core): drive setup mode from start-cli for unattended bring-up by @helix-nine in #3196
• perf(net/vhost): skip cert resolution for TLS passthrough by @helix-nine in #3191
• refactor(core/net): expose CertBranding for downstream cert issuance by @dr-bonez in #3200
• feat(core): limited os update via diagnostic api by @dr-bonez in #3192
• fix(setup): deduplicate install-os calls via shared future by @dr-bonez in #3193
• chore: bump StartOS to 0.4.0-beta.8 and SDK to 1.3.4 by @helix-nine in #3201
• feat(sdk): yaml file helper accepts options for custom-tag round-trip by @MattDHill in #3205
• fix(sdk): pin zod to 4.3.6 by @MattDHill in #3206
• fix(ui): preserve marketplace search query when opening service drawer by @helix-nine in #3195
• fix(cifs): use vers=3 to support older SMB servers by @helix-nine in #3202
• fix(net/acme): validate contact entries on init by @helix-nine in #3203
• fix(i18n): break language-change restart-banner loop by @MattDHill in #3204

New Contributors

• @helix-nine made their first contribution in #3199

Full Changelog: v0.4.0-beta.7...v0.4.0-beta.8

ISO Downloads

• x86_64/AMD64
• x86_64/AMD64 + NVIDIA
• x86_64/AMD64-slim (FOSS-only)
• aarch64/ARM64
• aarch64/ARM64 + NVIDIA
• aarch64/ARM64-slim (FOSS-Only)
• RISCV64 (RVA23)
• RISCV64 (RVA23)-slim (FOSS-only)

StartOS Checksums

SHA-256

87cd7af9e594d5f65478751d43f9a2024d39420cd6926fdc274e24691a7f73c8  startos-0.4.0-beta.8_aarch64.iso
9e1f5cfa12612e0d647d22f51a08747799fcf32f76943135aac497d89345006c  startos-0.4.0-beta.8_aarch64-nonfree.iso
a4debacdf08c79281ab25b10a67dbafda49a7174b564642932b267d0c95eb971  startos-0.4.0-beta.8_aarch64-nvidia.iso
286d59a263525db7ae8a74c0e8d170772e5306c5109ccf97831ddf19e3bc1e5b  startos-0.4.0-beta.8_riscv64.iso
5a7dbc70667ac8bf32ce7f7d47d172b68a1eaa2befe06f44974456433d6ef2bb  startos-0.4.0-beta.8_riscv64-nonfree.iso
da6f88004c5c25e4231ec50adc216d9f62d573bf7cae49043bea1f5e2eb7398e  startos-0.4.0-beta.8_x86_64.iso
5ea9a2832708acaa493e56af9c737cd5dc39681ea7a9030ae05c5d0dd8d7b720  startos-0.4.0-beta.8_x86_64-nonfree.iso
98d1bbbe1a8934eb669a7bd188d56a284dcadb5ea1ebf64c37de29bfc3bd900a  startos-0.4.0-beta.8_x86_64-nvidia.iso
b2b7a0187bdc344d25e1f921a0566f5207f3b6fd2e409ac0b9148d270e966a27  startos-0.4.0-beta.8_aarch64-nonfree.squashfs
a68f074b49d1dfcea8defdfcb6adeeec8242110ceb3752dab5775dad058fee62  startos-0.4.0-beta.8_aarch64-nvidia.squashfs
ee04f15ec6b3e996ca4be583c5fddb4c74107e9f74fa6fb583cdfcca0b016346  startos-0.4.0-beta.8_aarch64.squashfs
e0796a062cd09c08a5294d155311e2ec797c2366ad28f2588a170133f003ac43  startos-0.4.0-beta.8_riscv64-nonfree.squashfs
ea97804896412026263bf81b57cb0f11847adb60d1ea5550bc930423b387d508  startos-0.4.0-beta.8_riscv64.squashfs
e143cd712e73ff5894c2a176fde29017d01877033112aa0921b4b1f1e9c6b75a  startos-0.4.0-beta.8_x86_64-nonfree.squashfs
b3cf63e7a537ceced670dd9ab44e15c4ac3c4d59346c3ba2677baf761f36c5f5  startos-0.4.0-beta.8_x86_64-nvidia.squashfs
26f745dc305c389c7bd7d3bea53cc6091253cf44576a9fbb26c1e8f331fde54f  startos-0.4.0-beta.8_x86_64.squashfs

BLAKE-3

2d8710cd57b375c6b87d8f108a1f8e591c8528ea917e85323816dc6fa96e254e  startos-0.4.0-beta.8_aarch64.iso
f1ca5dad8feed779af725533a0e48468220e48711e15b8ec3e3ba31b495a417b  startos-0.4.0-beta.8_aarch64-nonfree.iso
336c748a5218ddee52048a47217df217867e0d0b7f8203a6a2f07e3003f253c5  startos-0.4.0-beta.8_aarch64-nvidia.iso
1e106f56e9910ab9f539ea0407a15a8f1e14266923014953d778763d6610fdcc  startos-0.4.0-beta.8_riscv64.iso
86d05b3e4795d4fc15ff0df631646a142f0a14a5d74d32f5bfd01a9f561a0796  startos-0.4.0-beta.8_riscv64-nonfree.iso
3683f7e803f772b189f5226fc5fa4eafb96db8e08133f82c378983d75e299d22  startos-0.4.0-beta.8_x86_64.iso
396592604cc5ada636a849644a0795846f26e159565732905dd607165d6aaed9  startos-0.4.0-beta.8_x86_64-nonfree.iso
5665cdbfe7994a1249851f93afe14771c062229afadb112c15c2c8a021da8128  startos-0.4.0-beta.8_x86_64-nvidia.iso
7d3f82d62677d7b8fd2b15061206959baf29ff590d49d285fce10524395c2286  startos-0.4.0-beta.8_aarch64-nonfree.squashfs
95da592e99899c6711c99fd2c3b36ccf59576cb70db453f18ed4d3b848b48fdc  startos-0.4.0-beta.8_aarch64-nvidia.squashfs
7da757a03f8341bdd9194942268026d4cd8226bfbd78d6fae9961cc2eedf658d  startos-0.4.0-beta.8_aarch64.squashfs
6f86d349f5ea5801e6a1702435720dd9243b43d4f42b8a2070e42537c55d3e00  startos-0.4.0-beta.8_riscv64-nonfree.squashfs
0d2c54788da576e802bbdff8f800823853c08dc53fb9e472360bb3fcd076db82  startos-0.4.0-beta.8_riscv64.squashfs
7c1f0023deac84f58dcba57100ffe1b3a985dd3dfe7590064731b58d83b463e5  startos-0.4.0-beta.8_x86_64-nonfree.squashfs
6a753ff22a4ebe30a68af918ad6ccbb058c85c22422e495b12ea265c21ce37bb  startos-0.4.0-beta.8_x86_64-nvidia.squashfs
0df4b76b19f8894a5b434b3f8b0c0d2eb7db7e5d684954336375f02ac7015f99  startos-0.4.0-beta.8_x86_64.squashfs

Start-Tunnel Checksums

SHA-256

edf61515df9a3c27d3d805188ad8f66db1d74cab5b8ccefdfd4fdba3e8aed6a8  start-tunnel-0.4.0-beta.8-502c3a9~dev_aarch64.deb
0464fc818121f3dbbe289e46999276b1355935433e8faae4c33cc44d9aed0fec  start-tunnel-0.4.0-beta.8-502c3a9~dev_riscv64.deb
197046c3a46028d73ee5ee592fff8685e4c0fd4135cc120b0d3a0f8e26e46255  start-tunnel-0.4.0-beta.8-502c3a9~dev_x86_64.deb

BLAKE-3

a2235e0962c4557f300ded571012ff9ebd23f6412406d186926afaa6cc651ccb  start-tunnel-0.4.0-beta.8-502c3a9~dev_aarch64.deb
dfcfcee27fdc301b52539e11a8dc77cef1b2b5718359784528862aac79a2a456  start-tunnel-0.4.0-beta.8-502c3a9~dev_riscv64.deb
2d6488cf04d3212fff220fa9bc7b4c595498c479f16c4bba35f60b7865fc78f9  start-tunnel-0.4.0-beta.8-502c3a9~dev_x86_64.deb

start-cli Checksums

SHA-256

1f44498d20271a9b4c8201f959d7f1f5c32926ea78dbf978f3725043298161bf  start-cli_aarch64-linux
4c7e0867bfd9703137826d1467a9c87fd9cba9d735c0703d943ce443eb133fce  start-cli_aarch64-macos
030a56cb94a258813e3cf6028b5d66796825a0572067c84b0751995db88b7f60  start-cli_riscv64-linux
2ea327fa4e4c2a4036ffdb098b4d2645f1180976eaf94b8405dc07d4dc3243f9  start-cli_x86_64-linux
ee01971a5b6bcf41460662cd8f3440b1900f1480e824b430af341961863975fc  start-cli_x86_64-macos

BLAKE-3

57c239fdc5434a3328dd29e7a9494a6cc0767d6c068d562272c03f683e9802a3  start-cli_aarch64-linux
6b75bd44669cea9394115af96b7fd6283f89642dd82a83f24398f499cffff767  start-cli_aarch64-macos
a24dcdca24f1c2b8faf8fc7fffce339e62edb9f71844816d2349915a67d5c6c1  start-cli_riscv64-linux
8ad1226a5f65341ee21d3d54eb958fc25dda055510952130d685d40b5de8c6f9  start-cli_x86_64-linux
11ad93559d365129bc3c61133e85d7e8bed4fe818ad8664e2bb4b6a48d757cc8  start-cli_x86_64-macos