The Silent Kernel

A unikernel for one‑shot secure enclaves.
Boots in milliseconds, executes a single Go binary with zero standard library surface, then irreversibly zeroes its own memory and powers off.

Architecture

• Hand‑written multiboot2 loader (NASM) transitions to 64‑bit long mode.
• Custom Plan 9 assembly entry sets up TLS and invokes the enclave.
• Go enclave never touches the standard library, signals, or the OS.
• Deterministic memory destruction – all physical pages are wiped before ACPI power‑off.
• No garbage collector – manual memory management only.

Build

make

Requires:

• Go 1.22+
• NASM
• GNU ld
• Multiboot2‑aware bootloader (GRUB2 recommended)

Boot

Add to GRUB configuration:

menuentry "Silent Kernel" {
    multiboot2 /boot/silent-kernel.elf
}

Or run directly with QEMU:

qemu-system-x86_64 -kernel silent-kernel.elf -serial stdio

Enclave

The enclave logic resides in kernel/entry.go. Modify the enclave() function to embed any secret computation. On completion the kernel wipes itself.

Security

• No I/O beyond the serial console.
• No persistent storage.
• Full memory zeroisation on exit.
• Self‑contained binary, no dependencies.