americankernel.com

What It Is

µKernel is a safety-critical microkernel platform written in Rust. It is not positioned as a general-purpose development framework, but rather as an RTOS / virtualization / container runtime foundation for aerospace, defense, industrial embedded systems, and enterprise infrastructure. Its main selling points include a Rust TCB of around 5,000 lines, 617 auditable unsafe blocks, 15 system calls, and a design that accounts for DO-178C and Common Criteria certification requirements from the outset.

Core Capabilities and Architecture

The product brings an RTOS, Type-1 Hypervisor, and native POSIX container runtime into a single system. The certification boundary consists of three Rust crates: sys-kernel, sys-hal, and sys-traits. The Hypervisor, POSIX shim, data plane, and customer workloads sit outside the TCB but remain supervised by the kernel. The main materials mention support for Hyper-V enlightenments, virtio, NPT isolation, capability-based IPC, a scheduler, and Linux ABI translation. Compared with the traditional approach of running Linux VMs on top of a certified RTOS, it aims to reduce audit and certification complexity through a smaller trusted computing base.

Language, Ecosystem, and Documentation

µKernel’s key differentiator is “Rust from the kernel up”: Rust is used not only at the application layer, but also inside the kernel, relying on Rust’s type system to reduce memory-safety risks. The only third-party crates mentioned in the TCB are log and serde. In terms of ecosystem integration, it covers virtual machines, POSIX containers, BSPs, and certification evidence. However, the public materials do not provide an SDK, API reference, sample projects, or developer guides, so developer onboarding difficulty and ecosystem maturity still need further validation.

Pricing and Licensing

The website does not disclose specific pricing. It uses an enterprise-style modular licensing model: Kernel Runtime, Hypervisor Runtime, and POSIX Runtime can be purchased separately; developer access is licensed per seat and includes source code under NDA, 12 months of updates, and engineering support; BSPs are licensed per target hardware platform; and the DO-178C DAL C evidence package is licensed per architecture. This model fits project-based procurement, but it is not very transparent for early-stage evaluators.

Pros, Cons, and Who It Is For

Its strengths include a small TCB, a Rust-based kernel, auditable source code, built-in virtualization and container capabilities, and a certification-oriented design. Limitations include the fact that DAL C and EAL4+ status are still in progress, while DAL A requires customer-funded upgrades; pricing, customer references, performance data, and public documentation are also limited. It is better suited to teams with requirements around safety certification, supply-chain audits, hard real-time behavior, and hardware isolation, rather than ordinary web or mobile developers.

Access from China

The materials do not provide information about access, payment, or代理 support for China, so the status is unknown. For Chinese teams evaluating similar options, alternatives to watch include VxWorks, Green Hills INTEGRITY, QNX, seL4, and Zephyr, though certification level, licensing model, and supply-chain requirements should be compared case by case.