Oxide Computer Company

A conventional server has a baseboard management controller (BMC), a small second computer for remote power control and monitoring. Oxide left it out. Every sled, Sidecar switch and power shelf controller carries a service processor (SP), always paired with a hardware root of trust (RoT). On a sled the SP runs thermal control, powers the host on and off, exposes the host’s serial console and updates some device software. The SPs sit on a physically separate management network in the backplane, wired to a dedicated management switch in each Sidecar. The Management Gateway Service, on the sled attached to each switch, carries requests from Nexus and from the Wicket technician UI onto that network, and its traffic never crosses the data network or leaves the rack.

SPs and RoTs run Hubris, an operating system for microcontrollers that Oxide wrote in Rust after existing embedded systems kept being pushed out of their design centers. Cliff Biffle sketched it in early 2020. It is a memory-protected microkernel with a synchronous task model, and every task a board will ever run is fixed at build time, so the build produces a single image that can be attested, and a faulted task can always be restarted because its resources are reserved. Hubris and its debugger, Humility, were open-sourced in November 2021, and the repository has an application for each board: the Gimlet and Cosmo sleds, Sidecar, the power shelf controller and the root of trust.

The RoT checks that its own firmware is genuine and unmodified, and keys for encryption at rest are built on it. When a rack powers on, the sled agents must first form a trust quorum, which verifies the rack secret, before any sled can decrypt its local storage; only then do time sync, internal DNS, CockroachDB and Nexus start, in that order. On the host side Oxide also dropped the UEFI firmware stack: AMD’s platform security processor loads Oxide’s phbl loader from flash, which unpacks Helios and jumps straight into its kernel.

Each silo, the rack’s unit of tenancy, gets its own console and API endpoint under a DNS name delegated to the rack, such as engineering.sys.example.com. Behind every endpoint is Nexus, and the public API reference is generated from the OpenAPI document that is itself generated from Nexus’s code. Oxide’s CLI and Rust SDK are generated from that document with its Progenitor tool, the Terraform provider is built on the Go SDK, and there is a TypeScript SDK as well. The console uses the same public API, so anything a user can click is also scriptable. The docs warn that the SDKs are still under development and may break between releases.

The same discipline applies inside. Nexus, the sled agents, Propolis and most other services expose Dropshot APIs with generated OpenAPI documents, which Oxide uses to catch breaking changes between components. That matters because a rack is never updated atomically: during an update, sleds run different software versions side by side, so only compatible combinations may be deployed. The exceptions are a few services with custom TCP protocols, such as Crucible’s data path and the trust quorum, which handle compatibility themselves.

It is all or nothing. You buy a whole rack with fixed hardware (one AMD CPU per sled, Oxide’s switches and power shelves), and as of release v23 it must be installed and configured under the guidance of Oxide technicians. You can’t slot your own servers or switches into it. Each rack is its own pool: the docs list combining several racks into a single pool of infrastructure as a roadmap priority that is not yet available.

The software is young, and each release lists known issues. Release v23’s include a limit of 1,024 NAT entries in the system before new instances can’t be created, and instances that can become unreachable on a sled that loses contact with the switches until a reboot. Updates restart sleds, and running instances on a restarted sled go to the failed state, so sensitive guests should be shut down first.

Open source here means open to read, not a community project. Omicron’s README says Oxide is focused on its own goals and can’t help outside contributors, many of the design documents it cites are internal RFDs, and some of the Helios build, such as AMD CPU firmware and Chelsio NIC firmware, is not yet public. And supply has been the limit lately: in October 2026 Oxide said it had scaled manufacturing capacity 20 times over twelve months and demand still exceeded it.