ALT
operating systems
Russian software company
Documentation
Ru / En

Alt Orchestra

Alt Orchestra - is a specialized Linux distribution developed by Bazalt SPO based on Talos OS, designed for working with Kubernetes and focused on ensuring security, predictability, and efficiency in Kubernetes environments. It does not replace Kubernetes; rather, it serves as a highly reliable and secure foundational platform for its operation.

Key differences:
1. Immutable, minimalist architecture. The root file system is mounted in read‑only mode, making the system immutable. Any changes to the system — whether updating the kernel, modifying the configuration of a Kubernetes component, or installing new software — are applied only through the update process. The Alt Orchestra architecture is also characterised by extreme minimalism: it includes only the components and services that are absolutely necessary for Kubernetes to operate. All other services, binary files, packages, daemons, and libraries that might be required for general server administration but not for running containers have been removed.
2. API‑centric management. Traditional access via shell and SSH is not available. All operations are performed using the talosctl CLI utility, which interacts with the nodes via a gRPC API secured with mutual authentication based on certificates (mutual TLS, mTLS).

3. Security by default.
The system includes:

  • TPM integration;
  • disk encryption;
  • Secure Boot.

Thus, Alt Orchestra represents a holistic security system where every component — from the hardware layer to the management level — is designed to achieve maximum protection. Immutability, minimalism, built‑in hardware protection mechanisms, and a strict API‑oriented management approach create multi‑layered protection that significantly reduces the risks associated with exploiting vulnerabilities and configuration errors, making it an attractive choice for organisations for which security is an absolute priority.

More information about the operating system can be found in the Alt Orchestra Knowledge Base.

The end‑user rights regarding the operating system are set out in the End‑User License Agreement (EULA) , which is included in the distribution and published on the website.. According to the EULA, individuals are granted the right to use the system free of charge; legal entities, state and municipal bodies, and other economic entities must purchase a license or enter into a written agreement.

The ISO image of the distribution can be downloaded from the distribution’s download page or built independently using the Alt Orchestra Image Generator

Sources for the free software contained in these images can be acquired as src.rpm packages as well as git repos.

  • Use this guide to write the ISO image onto blank DVD; x86 ISO images are also suitable for USB flash drives (NB: UNetbootin and UltraISO cripple the resulting media rendering it unbootable).
  • Note that aarch64 rootfs archives presume the use of alt-rootfs-installer utility to handle target platform differences; the guide is currently available in Russian.