xiaonux

Real Debian Linux in your browser. Nothing to install.

A full Linux machine runs inside this tab, on your computer. Practise the shell, run Python, inspect a suspicious file. Reset it whenever you like.

First start downloads about 17 MB. After that it starts in under a second.

GuidesCommands typed for you, checked when they run

  1. Learn Unix

    Files, pipes, permissions and processes, one command at a time.

  2. Python & packages

    Python 3 with pip. numpy, pandas and more install without internet.

  3. Security lab

    Upload a file and take it apart with file, strings, yara and strace.

Machine
Debian 13, riscv64
Runs on
Your computer, in this tab
Internet
Off until you choose
Login
User root, password root

What's on the machine

Installed and working with the internet off.

Shell and system

  • bash shell
  • coreutils files, text, pipes
  • sudo users and permissions
  • jq JSON
  • 7zip archives
  • xxd hex dumps

Python, offline

  • python3
  • pip installs from a bundled wheel index
  • numpy
  • pandas
  • cryptography
  • pillow
  • pyyaml

Security tools

  • file
  • binutils-multiarch objdump, readelf, strings
  • strace
  • ltrace
  • gdb
  • yara
  • binwalk
  • hexedit
  • tcpdump
  • nmap
  • netcat
  • python3-pefile

Only RISC-V Linux programs run here. Windows, x86 and ARM executables can be read and taken apart, but not run.

What people use it for

Examples from classes and security workshops. Each command runs as shown.

Classrooms

  1. Zero-install lab

    Chromebooks and locked-down PCs get a real Linux shell with no install and no account. Reset gives every student a clean machine.

    pwd && id

  2. Text-processing drills

    Count status codes in a log, pull out a field with awk, sort the unique values.

    awk '{print $9}' access.log | sort | uniq -c | sort -rn | head

  3. RISC-V assembly

    objdump and gdb read the binaries in the machine, so students see the instructions a compiler produced.

    objdump -d /bin/true | head -40

Security learners

  1. Log forensics

    Find the source addresses of failed logins in an uploaded auth.log.

    grep 'Failed password' /root/uploads/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head

  2. YARA workshop

    Write a rule for a sample and scan a folder with it.

    yara -s dropper.yar .

  3. Static deobfuscation

    Decode the hidden part of a shell dropper without running it.

    grep -o '[A-Za-z0-9+/=]\{20,\}' sample.sh | base64 -d; echo

How it works

One machine, inside one tab, on your computer.

Your browser tab

The browser's own sandbox, on your computer.

WebAssembly

The emulator, compiled to run in the page.

Emulated RISC-V CPU

Guest code never runs on your processor.

Debian 13

Your files are kept in this browser (OPFS).

  1. Starts from a snapshot

    The machine resumes from a saved state, so a warm prompt arrives in about half a second.

  2. Your changes stay

    Files you make are saved in this browser and are there next time.

  3. Reset is one button

    It deletes your changes and returns to the shipped image.

  4. Internet is your choice

    Off by default. Turn it on through the small xiaonux-net helper on your computer, or a free relay limited to pip, apt and GitHub.

Safety, plainly

What is isolated, and what isn't.

Isolated

  • Programs run on an emulated RISC-V processor inside WebAssembly, never on your computer's processor.
  • The machine can't see your files or devices. It only gets what you upload.
  • Uploads land in /root/uploads and are never marked executable.
  • Nothing you type or store is sent to a server.

Not isolated

  • With the internet on, anything you run can reach the internet from your IP address.
  • It is not a hardened malware lab. Don't analyse targeted or high-value samples here.
  • Don't put passwords or secrets in the machine.

Read the full security notes.

Open source

Apache-2.0. Read it, run it, change it.

xiaonux is free and open source. The emulator, the page and the image build are all in one repository.

Guides are small JSON files. If you teach with it, write a guide for your class.

Source on GitHub