A hardened operating system built on Debian 13 that loads entirely into RAM at boot, but lives on persistent internal storage so it can be deployed to real workstations.
Boot2Desk runs from a removable medium and forgets everything on shutdown. Boot2Work keeps the same protections but installs to the internal disk, so it can be rolled out to workstations without a USB stick.
The whole system is copied into memory when the machine starts, so the running environment is not executed straight from disk.
The filesystem lives on an internal HDD instead of a USB stick. That makes Boot2Work practical to deploy and maintain.
The same Boot2Desk confinement applies: Firejail, AppArmor, seccomp, and a default-deny firewall around every application.
Boot2Work carries over the full Boot2Desk security model. Isolation, mandatory access control, and the firewall are independent controls, so bypassing one does not disable the rest.
A live USB is ideal for a single trusted session, but it is awkward to deploy across a fleet. Boot2Work puts the filesystem on the internal drive instead, and still copies the system into RAM at boot.
The result is a workstation that keeps the hardened, memory-resident design of Boot2Desk while fitting the way organizations actually roll out machines.
Boot2Work is planned for environments that need a locked-down endpoint they can install and keep, rather than boot from removable media.
Fixed workstations for offices, counters, and shared facilities.
Locked-down desks for staff handling sensitive customer data.
Clinical access points that stay consistent across a facility.
Lab and classroom machines deployed in bulk.
Standard secure endpoints for remote sites without local IT staff.
Hardened access points to privileged and industrial systems.
A hardened endpoint for virtual desktop and remote access workflows.
Workstations where reducing attack surface is a hard requirement.
This page describes the direction of the project. Boot2Work is under active development, there is no public release yet, and details may change as the design is worked out.
It comes from the same developer as Boot2Desk and follows the same principle: reduce the attack surface by design, instead of adding more software on top of it.
Boot2Work is not available yet. In the meantime, learn about Boot2Desk, the hardened live OS it builds on.