<!DOCTYPE html>
<html class="client-nojs vector-feature-night-mode-disabled vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-sticky-header-enabled" lang="en" dir="ltr"><head>
<meta charset="UTF-8">
<title>Subgraph (operating system)</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="canonical" href="https://en.wikipedia.org/wiki/Subgraph_(operating_system)"> <link href="./mw/ext.cite.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.icons.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.search.codex.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/user.styles.css" rel="stylesheet" type="text/css">
<meta name="ResourceLoaderDynamicStyles" content="">
<link rel="stylesheet" type="text/css" href="./mw/site.styles.css">
<link rel="stylesheet" type="text/css" href="./mw/noscript.css">
<link rel="stylesheet" type="text/css" href="./footer.css">
<link rel="stylesheet" type="text/css" href="./vector-2022.css">
</head>
<body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Subgraph_operating_system rootpage-Subgraph_operating_system skin-vector-2022 action-view">
<div class="mw-page-container">
<div class="mw-page-container-inner">
<div class="mw-content-container">
<main id="content" class="mw-body">
<header class="mw-body-header vector-page-titlebar">
<h1 id="firstHeading" class="firstHeading mw-first-heading">
<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Subgraph (operating system)</span></span>
</h1>
</header>
<a id="top"></a>
<div id="bodyContent" class="vector-body ve-init-mw-desktopArticleTarget-targetContainer" aria-labelledby="firstHeading" data-mw-ve-target-container="">
<div id="mw-content-text" class="mw-body-content mw-content-ltr" lang="en" dir="ltr"><div class="mw-content-ltr mw-parser-output" lang="en" dir="ltr">
<style data-mw-deduplicate="TemplateStyles:r1295905060">
/* start https://en.wikipedia.org/ */
.mw-parser-output .infobox-subbox{padding:0;border:none;margin:-3px;width:auto;min-width:100%;font-size:100%;clear:none;float:none;background-color:transparent}.mw-parser-output .infobox-3cols-child{margin:auto}.mw-parser-output .infobox .navbar{font-size:100%}@media screen{html.skin-theme-clientpref-night .mw-parser-output .infobox-full-data:not(.notheme)>div:not(.notheme)[style]{background:#1f1f23!important;color:#f8f9fa}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .infobox-full-data:not(.notheme)>div:not(.notheme)[style]{background:#1f1f23!important;color:#f8f9fa}}@media(min-width:640px){body.skin--responsive .mw-parser-output .infobox-table{display:table!important}body.skin--responsive .mw-parser-output .infobox-table>caption{display:table-caption!important}body.skin--responsive .mw-parser-output .infobox-table>tbody{display:table-row-group}body.skin--responsive .mw-parser-output .infobox-table th,body.skin--responsive .mw-parser-output .infobox-table td{padding-left:inherit;padding-right:inherit}}
/* end https://en.wikipedia.org/ */
</style><table class="infobox vevent"><tbody><tr><th colspan="2" class="infobox-above" style="background-color: #e0e0e0;">Subgraph OS</th></tr><tr><td colspan="2" class="infobox-image"><span typeof="mw:File"></span></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;">OS family</th><td class="infobox-data"><a href="Linux" title="Linux">Linux</a> (<a href="Unix-like" title="Unix-like">Unix-like</a>)</td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;">Working state</th><td class="infobox-data">Discontinued<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;">Source model</th><td class="infobox-data"><a href="Open-source_software" title="Open-source software">Open source</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Software_release_life_cycle" title="Software release life cycle">Final preview</a></th><td class="infobox-data">2017.09.22<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> / 22 September 2017<span style="display:none"> (<span class="bday dtstart published updated">2017-09-22</span>)</span></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Repository_(version_control)" title="Repository (version control)">Repository</a></th><td class="infobox-data"><span class="url"><a rel="nofollow" class="external text" href="https://github.com/orgs/subgraph/repositories">github<wbr>.com<wbr>/orgs<wbr>/subgraph<wbr>/repositories</a></span></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Kernel_(operating_system)" title="Kernel (operating system)">Kernel</a> type</th><td class="infobox-data"><a href="Monolithic_kernel" title="Monolithic kernel">Monolithic</a> (<a href="Linux_kernel" title="Linux kernel">Linux</a>)</td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="User_space_and_kernel_space" title="User space and kernel space">Userland</a></th><td class="infobox-data"><a href="GNU" title="GNU">GNU</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;">Influenced by</th><td class="infobox-data"><a href="Tails_(operating_system)" title="Tails (operating system)">Tails</a>, <a href="Qubes_OS" title="Qubes OS">Qubes OS</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="User_interface" title="User interface">Default<br>user interface</a></th><td class="infobox-data"><a href="GNOME" title="GNOME">GNOME 3</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Software_license" title="Software license">License</a></th><td class="infobox-data"><a href="GPLv3" class="mw-redirect" title="GPLv3">GPLv3+</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;">Official website</th><td class="infobox-data"><span class="url"><a rel="nofollow" class="external text" href="https://subgraph.com">subgraph<wbr>.com</a></span></td></tr></tbody></table>
<p><b>Subgraph OS</b> was a <a href="Debian" title="Debian">Debian</a>-based project designed to be resistant to surveillance and interference by sophisticated adversaries over the Internet.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-6" class="reference"><a href="#cite_note-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-7" class="reference"><a href="#cite_note-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-8" class="reference"><a href="#cite_note-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup> It has been mentioned by <a href="Edward_Snowden" title="Edward Snowden">Edward Snowden</a> as showing future potential.<sup id="cite_ref-9" class="reference"><a href="#cite_note-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup>
</p><p>Subgraph OS was designed to be locked down, with a reduced attack surface, to increase the difficulty to carry out certain classes of attack against it. This was accomplished through system hardening and a proactive, ongoing focus on security and attack resistance. Subgraph OS also placed emphasis on ensuring the integrity of installed software packages through <a href="Deterministic_compilation" class="mw-redirect" title="Deterministic compilation">deterministic compilation</a>.
</p><p>The last update of the project's blog was in September 2017,<sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup> and all of its <a href="GitHub" title="GitHub">GitHub</a> repositories haven't seen activity since 2020.<sup id="cite_ref-11" class="reference"><a href="#cite_note-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup>
</p>
<meta property="mw:PageProp/toc">
<div class="mw-heading mw-heading2"><h2 id="Features">Features</h2></div>
<p>Some of Subgraph OS's notable features included:
</p>
<ul><li><a href="Linux_kernel" title="Linux kernel">Linux kernel</a> hardened with the grsecurity and <a href="PaX" class="mw-redirect" title="PaX">PaX</a> patchset.<sup id="cite_ref-12" class="reference"><a href="#cite_note-12"><span class="cite-bracket">[</span>12<span class="cite-bracket">]</span></a></sup></li>
<li><a href="Linux_namespaces" title="Linux namespaces">Linux namespaces</a> and <a href="Xpra" title="Xpra">xpra</a> for application containment.</li>
<li>Mandatory file system encryption during installation using <a href="LUKS" class="mw-redirect" title="LUKS">LUKS</a>.</li>
<li>Configurable firewall rules to automatically ensure that network connections for installed applications are made using the <a href="Tor_(anonymity_network)" class="mw-redirect" title="Tor (anonymity network)">Tor anonymity network</a>. Default settings ensure that each application's communication is transmitted via an independent circuit on the network.</li>
<li><a href="GNOME_Shell" title="GNOME Shell">GNOME Shell</a> integration for the OZ virtualization client,<sup id="cite_ref-13" class="reference"><a href="#cite_note-13"><span class="cite-bracket">[</span>13<span class="cite-bracket">]</span></a></sup> which runs apps inside a secure Linux container, targeting ease-of-use by everyday users.<sup id="cite_ref-14" class="reference"><a href="#cite_note-14"><span class="cite-bracket">[</span>14<span class="cite-bracket">]</span></a></sup></li></ul>
<div class="mw-heading mw-heading2"><h2 id="Security">Security</h2></div>
<p>Subgraph OS's <a href="Sandbox_(computer_security)" title="Sandbox (computer security)">sandbox containers</a> have been critiqued as inferior to <a href="Qubes_OS" title="Qubes OS">Qubes OS</a>'s <a href="Virtual_machine" title="Virtual machine">virtualization</a>. An attacker can trick a Subgraph user to run a malicious unsandboxed script via the default <a href="GNOME_Files" title="GNOME Files">Nautilus</a> file manager or in the terminal. It is also possible to run malicious code containing <a href="Shortcut_(computing)#Unix" title="Shortcut (computing)">.desktop</a> files (which are used to launch applications). Malware can also bypass Subgraph OS's <a href="Application_firewall" title="Application firewall">application firewall</a>. Also, by design, Subgraph does not isolate the <a href="Protocol_stack" title="Protocol stack">network stack</a> like Qubes OS.<sup id="cite_ref-15" class="reference"><a href="#cite_note-15"><span class="cite-bracket">[</span>15<span class="cite-bracket">]</span></a></sup>
</p>
<div class="mw-heading mw-heading2"><h2 id="See_also">See also</h2></div>
<ul><li><a href="Tails_(operating_system)" title="Tails (operating system)">Tails (operating system)</a></li>
<li><a href="Qubes_OS" title="Qubes OS">Qubes OS</a></li></ul>
<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>
<style data-mw-deduplicate="TemplateStyles:r1239543626">
/* start https://en.wikipedia.org/ */
.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}
/* end https://en.wikipedia.org/ */
</style><div class="reflist reflist-columns references-column-width" style="column-width: 30em;">
<ol class="references">
<li id="cite_note-1"><span class="mw-cite-backlink"><b><a href="#cite_ref-1">^</a></b></span> <span class="reference-text"><style data-mw-deduplicate="TemplateStyles:r1238218222">
/* start https://en.wikipedia.org/ */
.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}
/* end https://en.wikipedia.org/ */
</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://distrowatch.com/table.php?distribution=Subgraph">"DistroWatch.com: Subgraph OS"</a>. <i>DistroWatch.com</i>. 2023-01-30<span class="reference-accessdate">. Retrieved <span class="nowrap">2023-10-13</span></span>.</cite></span>
</li>
<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://subgraph.com/blog/subgraph-sep2017-iso-availability/">"Subgraph OS September 2017 ISO Availability"</a>. <i>subgraph.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">22 September</span> 2017</span>.</cite></span>
</li>
<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.linux.com/topic/desktop/subgraph-security-focused-distro-malwares-worst-nightmare/">"Subgraph: This Security-Focused Distro Is Malware's Worst Nightmare"</a>. <i>Linux.com</i>. 2018-01-26<span class="reference-accessdate">. Retrieved <span class="nowrap">2023-10-13</span></span>.</cite></span>
</li>
<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://distrowatch.com/weekly.php?issue=20170130#subgraph">"DistroWatch.com: Put the fun back into computing. Use Linux, BSD"</a>. <i>DistroWatch.com</i>. 2017-01-30<span class="reference-accessdate">. Retrieved <span class="nowrap">2023-10-13</span></span>.</cite></span>
</li>
<li id="cite_note-5"><span class="mw-cite-backlink"><b><a href="#cite_ref-5">^</a></b></span> <span class="reference-text"><cite id="CITEREFupdated2022" class="citation web cs1">updated, Mayank SharmaContributions from Brian Turner last (May 9, 2022). <a rel="nofollow" class="external text" href="https://www.techradar.com/news/best-linux-distro-privacy-security">"Best Linux distro for privacy and security of 2023"</a>. <i>TechRadar</i>.</cite></span>
</li>
<li id="cite_note-6"><span class="mw-cite-backlink"><b><a href="#cite_ref-6">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.wired.co.uk/article/subgraph-security-conscious-os">"Subgraph announces security conscious OS"</a> – via www.wired.co.uk.</cite></span>
</li>
<li id="cite_note-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-7">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://itsfoss.com/privacy-focused-linux-distributions/">"Secure Your Online Privacy With These Linux Distributions"</a>. <i>It's FOSS</i>. February 22, 2017.</cite></span>
</li>
<li id="cite_note-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-8">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://lwn.net/Articles/679366/">"Subgraph OS, a new security-centric desktop distribution [LWN.net]"</a>. <i>lwn.net</i>.</cite></span>
</li>
<li id="cite_note-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-9">^</a></b></span> <span class="reference-text"><cite id="CITEREFStyles2016" class="citation web cs1">Styles, Kirsty (16 March 2016). <a rel="nofollow" class="external text" href="https://thenextweb.com/insider/2016/03/16/subgraph-os-will-snowdens-os-choice-not-quite-ready-humans/#gref">"Subgraph will be Snowden's OS of choice – but it's not quite ready for humans yet"</a>. The Next Web<span class="reference-accessdate">. Retrieved <span class="nowrap">7 July</span> 2016</span>.</cite></span>
</li>
<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://subgraph.com/blog/index.en.html">"Subgraph - Blog"</a>. <i>subgraph.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2023-08-03</span></span>.</cite></span>
</li>
<li id="cite_note-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-11">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/subgraph">"Subgraph"</a>. <i>GitHub</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2023-08-03</span></span>.</cite></span>
</li>
<li id="cite_note-12"><span class="mw-cite-backlink"><b><a href="#cite_ref-12">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://subgraph.com/sgos/hardening/index.en.html">"Hardening"</a>. <i>subgraph.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2023-08-03</span></span>.</cite></span>
</li>
<li id="cite_note-13"><span class="mw-cite-backlink"><b><a href="#cite_ref-13">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/subgraph/oz">"subgraph/oz: OZ: a sandboxing system targeting everyday workstation applications"</a>. <i>GitHub</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2023-10-13</span></span>.</cite></span>
</li>
<li id="cite_note-14"><span class="mw-cite-backlink"><b><a href="#cite_ref-14">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/subgraph/oz">"GitHub - OZ: a sandboxing system targeting everyday workstation applications"</a>. Subgraph<span class="reference-accessdate">. Retrieved <span class="nowrap">6 October</span> 2016</span>.</cite></span>
</li>
<li id="cite_note-15"><span class="mw-cite-backlink"><b><a href="#cite_ref-15">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/">"Breaking the Security Model of Subgraph OS | Micah Lee's Blog"</a>. <i>micahflee.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2017-04-25</span></span>.</cite></span>
</li>
</ol></div>
<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>
<ul><li><span class="official-website"><span class="url"><a rel="nofollow" class="external text" href="https://www.subgraph.com">Official website</a></span></span></li>
<li><a rel="nofollow" class="external text" href="https://distrowatch.com/table.php?distribution=Subgraph">Subgraph (operating system)</a> at <a href="DistroWatch" title="DistroWatch">DistroWatch</a></li></ul></div><!--htdig_noindex--><div><div class="zim-footer">
This article is issued from <a class="external text" title="Last edited on 2025-04-25" href="https://en.wikipedia.org/wiki/?title=Subgraph_(operating_system)&oldid=1287374019">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.
</div>
</div><!--/htdig_noindex--></div>
</div>
</main>
</div>
</div>
</div>
</body></html>