PowerCloudAn OS for x86-64 and arm64
Run your own cloud. Trust no provider.
PowerCloud runs one cloud across your home, a colo and any public provider at once. They only ever hold ciphertext, so their breaches aren't yours, and no single one can pull the plug or overbill you into staying.
Early and under active development. There are no builds to download yet.
Why
Use the providers without trusting them
Renting compute and storage is cheap and convenient. Handing someone your data, and your ability to keep running, is not. PowerCloud keeps the first and drops the second.
Their breach isn't your breach
Everything is encrypted before it leaves a node you trust. Buckets, disks and plain VMs only ever hold ciphertext, so an attacker inside a provider, or the provider itself, gets nothing it can read.
No one can pull the plug
Data is replicated or erasure-coded across independent providers and your own machines. A ban, an outage, a bankruptcy or an account cut off over a billing dispute takes out one location, not your data.
No lock-in, no overbilling
Providers are dumb blob stores and VMs. When one raises prices or bills you for things you didn't use, add another location, let it fill, and drop the old one.
The OS
A Linux kernel, and Go for everything else
PowerCloud is a native operating system, not an app on top of one. It boots on bare metal and on cloud VMs, x86-64 and arm64, from the same small, signed image.
- A Linux kernel, minimal and hardened
- A current Linux kernel with no loadable modules and lockdown forced to confidentiality mode. Every hardening option is checked after the kernel config resolves, so none is dropped silently.
- An all-Go userland
- Only static Go binaries: no shell, no libc, no package manager, no SSH. pcinit is PID 1 and supervises the services.
- Managed only through an API
- There is no login. Everything goes through pcctl, over mutually authenticated TLS, with role-based authorisation.
- One image, x86-64 and arm64
- The kernel is its own signed EFI application, with the initramfs and a command line nobody can override built in. No boot loader.
Everything encrypted
At rest, in storage, and on the wire
State volumes
Each node's disk is dm-crypt with an HMAC-SHA256 tag on every sector. Its key is wrapped by one only cluster admins can derive.
Storage
Every chunk is sealed with XChaCha20-Poly1305 before it leaves the node, and its ID is an HMAC, so a provider can't tell what's inside or swap one for another.
The mesh
Nodes talk over WireGuard, with mutual TLS inside the tunnel, so traffic between them crosses any network as ciphertext.
Working today
Built and working, not slideware
- WireGuard meshwith NAT traversal and relays
- Encrypted storagededuplicated, erasure-coded across providers
- Consensusa Raft group among your nodes
- Exclusive appsat most one copy, with fencing
- App volumesdata that follows the app
- Secure Boot + TPMunattended unlock on your own machine
- SEV-SNP attestationbefore a cloud VM gets a key
- A/B upgradestrial boot, automatic rollback
- Cluster appsplaced by the nodes, with failover
Honest about the limits
Encryption can't hide memory from a host
On someone else's VM, the hypervisor can read the machine's memory, and with it the keys. So a cloud VM only holds keys when its memory is encrypted by the CPU (AMD SEV-SNP today; Intel TDX and Arm CCA are planned) and PowerCloud has checked the chip's attestation. Everything else stores ciphertext and nothing more.
What a trusted cloud node costs
Your own hardware costs nothing extra. On a public cloud, confidential VMs run about 10% over the same plain VM on Google Cloud, AWS and Azure. A small trusted node (2 vCPU, 8 GiB) is about $68–81 a month on demand, compute only.
Prices checked 2026-10-24. Storage-only locations don't need one.
Read the design
PowerCloud is early, and there are no builds to download yet. The security model says what it protects and what it can't; the roadmap says what's built and what's next.