Cloud Parts

Talos Linux

A Linux distribution that only runs Kubernetes: immutable, minimal, with no shell or SSH, and managed entirely through an API.

What it is
Container orchestration
Part of
Kubernetes distribution
Type
Open source
Made by
Sidero Labs
License
MPL 2.0 (Omni, its management platform, is source-available under BUSL 1.1)
Facts checked
6 October 2026
Website Source code

What it is

Talos Linux keeps the Linux kernel and replaces everything above it with its own components written in Go. PID 1 is machined, not systemd, and it won’t start arbitrary services. There is no shell, no SSH, no package manager and none of the GNU utilities; the whole OS is a signed SquashFS image under 80 MB that is mounted read-only into memory, even when installed to disk. The only writable state is a few files under /system that are rebuilt on each boot and an XFS partition at /var for etcd, the kubelet and containerd, which Talos treats as disposable.

Every machine is described by one YAML machine config, covering both the OS and the Kubernetes it forms. You manage nodes with talosctl, which talks to an encrypted, key-authenticated gRPC API (apid) on each node: apply a config, read logs, reboot, upgrade, bootstrap etcd. Upgrades swap in a new OS image with an A-B scheme and roll back automatically if the new one doesn’t boot. Drivers and extra tools come as system extensions baked into the image, for example by Sidero’s Image Factory. Omni, Sidero’s cluster manager, adds a UI, single sign-on and fleet-wide upgrades as a SaaS or self-hosted, but under a source-available licence that requires a paid licence for production.

Why teams pick it

  • Tiny attack surface: no shell, SSH or passwords, a kernel hardened along Kernel Self Protection Project lines, and fewer than 50 binaries by Sidero’s count
  • Nodes are cattle: one declarative config per role, and any node can be wiped and rebuilt from it
  • Atomic A-B upgrades with automatic rollback, driven by API calls you can script
  • Runs the same on AWS, Azure, GCP and about ten other clouds, on VMware, Proxmox and bare metal, and on boards like the Raspberry Pi 4

Watch out for

  • No shell means debugging is different: you inspect nodes through talosctl API calls such as dmesg and memory, and anything a node needs must be in the image or the config
  • Community support for a release ends when the next minor release ships, about every four months; enterprise support comes from Sidero Labs
  • FIPS-compliant builds, SBOMs per build, CVE SLAs and indemnity are only in the paid Talos Enterprise Linux licence
  • A node in maintenance mode accepts an unauthenticated config by design, so first boot needs a trusted network or a config supplied at boot

More of the Kubernetes family

What all container orchestration have in common →
K3sOpen sourceDistributionsA certified Kubernetes distribution in one small binary, built for edge, IoT and other places where a full cluster is too heavy, with SQLite or embedded etcd for state.MicroK8sOpen sourceDistributionsCanonical’s Kubernetes in one snap package: installs with one command on Linux, forms a highly available cluster by itself at three nodes, and adds features as addons.Red Hat OpenShiftCommercialDistributionsRed Hat’s Kubernetes platform: Kubernetes plus its own OS, operators that install and upgrade everything, and stricter security defaults, sold by subscription.RKE2Open sourceDistributionsSUSE’s security-focused Kubernetes distribution: one binary per node, hardened defaults, FIPS-validated crypto and close alignment with upstream.Amazon EKSAWSManaged servicesAWS runs the Kubernetes control plane for you; you choose how much of the worker side to hand over too.Azure Kubernetes ServiceAzureManaged servicesMicrosoft’s managed Kubernetes: a control plane that can be free, node pools of Azure VMs, and an Automatic mode that runs the nodes too.Google Kubernetes EngineGoogle CloudManaged servicesGoogle’s managed Kubernetes, the oldest one: Google runs the control plane, and in Autopilot mode the nodes too.kindOpen sourceFor local developmentKubernetes IN Docker: each cluster node is a container, so a conformant multi-node cluster starts and disappears inside a CI job.minikubeOpen sourceFor local developmentA local Kubernetes cluster for developers on Linux, macOS or Windows, in a container, a VM or on the host itself, with laptop-friendly extras.kubeadmOpen sourceToolsThe official tool for turning Linux machines you already have into a Kubernetes cluster: `kubeadm init`, then `kubeadm join`.RancherOpen sourceToolsSUSE’s open-source control plane for fleets of Kubernetes clusters: one place to create, import, secure and upgrade them.AgonesOpen sourceBuilt on itRuns dedicated multiplayer game servers on Kubernetes: keeps a fleet of them warm, hands one to each match, and never kills a server while players are on it.KlutchOpen sourceBuilt on itA young open-source control plane, built on Crossplane, that lets many application clusters order databases from one central Kubernetes cluster.

How it fits with other technologies

Turn a machine booted from the Talos ISO into a one-node control plane · bash

# generate controlplane.yaml, worker.yaml and talosconfig (client credentials)
talosctl gen config my-cluster https://$CONTROL_PLANE_IP:6443 --install-disk /dev/sda

# the node waits in maintenance mode for its config
talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file controlplane.yaml

talosctl --talosconfig=./talosconfig config endpoints $CONTROL_PLANE_IP
talosctl bootstrap --nodes $CONTROL_PLANE_IP --talosconfig=./talosconfig   # once, on one node
talosctl kubeconfig --nodes $CONTROL_PLANE_IP --talosconfig=./talosconfig
talosctl --nodes $CONTROL_PLANE_IP --talosconfig=./talosconfig health

See it in a real stack

No architecture uses Talos Linux yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2017–2026

Talos began as a nights-and-weekends project by Andrew Rynhard, who was tired of automating the same general-purpose Linux servers over and over. His question was what an operating system would look like if it existed only to run Kubernetes. The repository dates from late 2017 and the first alpha release from April 2018. Container-optimised systems such as CoreOS already existed, but in Rynhard’s view they still carried the baggage of general-purpose Linux.

Talos Systems launched as a company in June 2019 to support it, planning to sell services, support and management tools. A trademark clash with Cisco’s Talos security group led it to rename itself Sidero Labs in October 2021, while the OS kept the Talos name. Talos 1.0 followed in March 2022. Omni, a hosted manager for Talos clusters, came next; in February 2024 Sidero published its source under the Business Source License so people could self-host it for non-production use.

In September 2026 Yardi, a large private software company that ran Talos in production, acquired Sidero Labs. Sidero said Talos stays MPL-2.0 and the company keeps operating independently, and the next day launched Talos Enterprise Linux, a commercial licence for compliance artifacts and FIPS builds.

Why it’s built this way

An API instead of a shell
Logging into nodes to fix them by hand makes servers drift apart. With no console or SSH, every change goes through one authenticated, declarative API, so nodes built from the same config stay identical.
Rewrite the userspace from PID 1
Trimming an existing distribution still leaves its init system, utilities and libraries. Writing machined and the other services in Go meant shipping only what Kubernetes needs, so there are far fewer packages to patch and vulnerabilities to track.
Run from a read-only image, keep state ephemeral
Because the OS is one signed SquashFS image and the writable partition holds only replicated or rebuildable data, a broken node can be wiped and rebuilt from its config, and its image can be checked for tampering.
A-B image upgrades
Upgrading a whole image instead of packages means each node runs a known, tested version. Keeping the previous image lets a node that fails to boot fall back automatically.

Timeline

  1. 2017

    Talos repository created in November

  2. 2018

    First alpha release, v0.1.0-alpha.0, in April

  3. 2019

    Talos Systems launches as a company in June

  4. 2021

    Company renamed Sidero Labs after a trademark clash

  5. 2022

    Talos 1.0 released in March

  6. 2024

    Omni source code published under the Business Source License

  7. 2026

    Yardi acquires Sidero Labs; Talos Enterprise Linux launches

Sources14 · facts checked 6 October 2026

Improve this page on GitHub