Stop Burning 7 USBs! One ISO Runs Every Linux Distro with ZFS

What if I told you that every Linux installer you've ever burned was a waste of time?

You've been there. Midnight deploy. Production server down. You're frantically searching for the right USB stick—was Ubuntu on the blue one? Debian on black? Did Fedora even finish copying? Your drawer of half-labeled flash drives mocks you. Meanwhile, your team waits, your SLA bleeds, and you're still not sure if that Rocky Linux image was the right point release.

But what if one USB stick ruled them all?

Enter kldloadOS—the secretly insane project that's making senior infrastructure engineers quietly replace their entire toolkit. No more distro-hopping between ISOs. No more "close enough" installs. One bootable image. Eight distributions. ZFS on root everywhere. And it installs offline through embedded package mirrors they call "darksites."

This isn't another respin. Nothing's forked. Nothing's patched. Every package pulls straight from vendor CDNs—CentOS, Debian, Ubuntu, Fedora, Rocky, RHEL, Arch, even Alpine. The live environment bootstraps your chosen distro using native tools (dnf --installroot, debootstrap, pacman --root, apk add --root) and wraps it in production-grade ZFS with WireGuard mesh networking and eBPF observability from first boot.

Sound impossible? The kldloadOS GitHub repository is already being passed around in infrastructure Slack channels like a forbidden spell. Let's pull it apart.

What is kldloadOS?

kldloadOS is a free, open-source Linux distribution assembly system created by the team behind kldload.com. Released under BSD-3-Clause license, it solves a problem that sounds simple but has plagued Linux deployments for decades: how do you standardize across distributions without creating yet another fork?

The answer? Don't fork. Assemble.

Instead of maintaining patched repositories or custom package sets, kldloadOS builds every target system from stock vendor repositories. The live environment is always CentOS Stream 9, but once you boot the ISO, a web UI opens at :8080 and lets you pick your target distribution and deployment profile. The system then bootstraps your chosen distro using its native package manager, layers in ZFS on root, WireGuard, eBPF tooling, and any profile-specific components, and produces a fully auditable system with complete build logs in /root/kldload-install-logs/.

Why it's trending now:

Infrastructure teams are exhausted by Kubernetes distribution sprawl, proprietary appliance vendors locking them in, and the operational nightmare of maintaining golden images across different Linux flavors. kldloadOS arrives at a moment when ZFS is finally stable on Linux, eBPF is production-ready, and teams desperately need portability without fragmentation. The project hit GitHub with a compelling demo video, active Discord community, and a release cadence that added Kubernetes-on-ZFS, AI workloads with local LLMs, and KVM instant cloning in under six months.

The killer insight? There is no kldload repository. No kldload updates. Future upgrades use your chosen distro's public repos. You're never locked into a middleman.

Key Features That Make Engineers Obsessive

ZFS on Root, Properly Tuned

This isn't "install ZFS after the fact." kldloadOS builds ZFS into the root filesystem from bootstrap, with datasets tuned per workload: 8K recordsize for databases, 128K for general storage, compression and checksums everywhere. Boot environments via ZFSBootMenu (GRUB eliminated), per-dataset encryption, native snapshots, and replication-ready configurations. The kbe command manages boot environments; kupgrade takes automatic pre-upgrade snapshots with rollback capability.

WireGuard Mesh From First Boot

Every install gets encrypted networking immediately. Kubernetes clusters receive dual encrypted backplanes—separate WireGuard tunnels for management and data planes. No manual certificate management, no VPN appliance dependencies.

eBPF-Native Observability

bcc-tools, bpftrace, bpftool pre-installed. BTF (BPF Type Format) compiled into the kernel. When you deploy the KVM profile with Cilium, it runs in full eBPF mode—no kube-proxy, no iptables fallback. Hubble provides L3/L4/L7 flow visibility from the first cluster boot.

KVM + ZFS Instant Cloning (~100ms)

The KVM profile creates VMs on ZFS zvols and clones them via copy-on-write in approximately 100 milliseconds. Zero disk cost. Golden image → snapshot → entire fleet in seconds. The kvm-clone command makes this trivial.

Offline Installation via Darksites

RPM and APT mirrors embedded directly in the ISO. For CentOS, Debian, Ubuntu, Fedora, and Rocky, no internet connection is required during install. Critical for air-gapped environments, compliance-sensitive deployments, and disaster recovery scenarios where connectivity is compromised.

Fully Auditable Builds

Every install produces build logs, package manifests, and smoke test results. The architecture promises: "Cat any file and read what it does." Zero compiled binaries in the bootstrap path. Three transparent methods: dnf, debootstrap, pacstrap.

Use Cases Where kldloadOS Absolutely Dominates

1. Disaster Recovery & Air-Gapped Deployments

Compliance-heavy industries—finance, healthcare, government—often prohibit internet access during system installation. kldloadOS's embedded darksites install CentOS, Debian, Ubuntu, Fedora, and Rocky completely offline. One ISO replaces your entire offline media library.

2. Kubernetes Bare Metal at Scale

The KVM profile's kube-cluster bootstrap --workers 3 command deploys production Kubernetes on ZFS instant-cloned nodes. Cilium replaces kube-proxy with eBPF datapath. WireGuard encrypts both control and data planes. Nodes provision in ~100ms and destroy just as fast. Perfect for ephemeral CI/CD clusters, edge computing, and bare-metal Kubernetes where you need cattle, not pets.

3. AI/ML Workstations with Local LLMs

The AI profile ships Ollama + Open WebUI + NVIDIA GPU drivers pre-configured. Multiple containers share one GPU via CUDA time-slicing—no PCIe passthrough complexity. Run local LLMs without cloud dependencies or API costs. Ideal for security-conscious organizations prohibiting external AI services.

4. Multi-Distro Development & Testing

Need to verify your application on Debian, Fedora, and Arch? One USB stick. Same ZFS tooling. Same WireGuard mesh. Same observability stack. Eliminate "works on my distro" friction. The core profile gives you minimal ZFS + WireGuard with stock distro—nothing else interfering.

5. Secure Boot-Verified Infrastructure

MOK-signed ZFS modules with end-to-end verified boot. ZFSBootMenu replaces GRUB. Secure Boot isn't an afterthought—it's designed into the module signing pipeline from the start.

Step-by-Step Installation & Setup Guide

Download and Burn (Quickest Path)

# Download the latest ISO
curl -L -o kldload.iso https://dl.kldload.com/kldload-free-latest.iso

# Verify checksum (recommended for production)
sha256sum kldload.iso

# Burn to USB with optimal settings for reliability
dd if=kldload.iso of=/dev/sdX bs=4M status=progress oflag=direct conv=fsync && sync

Critical: Replace /dev/sdX with your actual USB device. Use lsblk to identify it. The oflag=direct conv=fsync ensures complete write-through before the command returns—no corrupted boots from impatient ejection.

Build From Source (Customization Path)

# Clone the repository
git clone https://github.com/kldload/kldload.git && cd kldload

# Build with your chosen profile
PROFILE=desktop ./deploy.sh build

# Or build specific darksites for fully offline capability
./deploy.sh build-debian-darksite
./deploy.sh build-ubuntu-darksite
./deploy.sh build-fedora-darksite

Boot and Install

Insert USB and boot target machine (UEFI recommended for Secure Boot)
Live CentOS Stream 9 environment loads automatically
Web UI opens at http://localhost:8080 (or access from another machine via IP)
Select your distro from the 8 options
Select your profile: Core, Server, Desktop, KVM, or AI
Configure disk partitioning (ZFS pool automatically created)
Install proceeds with full logging to /root/kldload-install-logs/

Post-Install Verification

# Check unified system status
kldload-overview

# Verify ZFS pools and datasets
zpool list
zfs list

# Confirm WireGuard mesh is active
wg show

# Validate eBPF tooling availability
bpftool prog list

REAL Code Examples From the Repository

Example 1: Kubernetes Cluster Bootstrap (The Killer Feature)

# Deploy full K8s cluster from golden image
# This single command does what normally requires hours of manual setup:
# - Creates golden VM image on ZFS zvol
# - Instant-clones N worker nodes via copy-on-write (~100ms each)
# - Installs Cilium CNI with eBPF datapath (replaces kube-proxy)
# - Configures MetalLB for bare-metal load balancing
# - Sets up Gateway API for ingress
# - Deploys Hubble for eBPF observability
# - Establishes dual WireGuard encrypted backplanes
kube-cluster bootstrap --workers 3

Before: This command encapsulates the entire infrastructure-as-code philosophy of kldloadOS. Traditional Kubernetes on bare metal requires: OS installation, CNI selection and configuration, load balancer setup, ingress controller deployment, observability stack installation, and security hardening. Here, it's one command because ZFS instant cloning makes node provisioning trivial, and all components are pre-integrated.

After: The cluster is production-ready with eBPF-powered networking. Run kube-demo for 24 interactive scenarios exploring Cilium's features, or kube-smoke-test for automated verification. When done, kube-cluster destroy tears everything down while preserving your golden image for next time.

Example 2: KVM Instant Clone Workflow

# Create base VM on ZFS zvol
kvm-create --name golden-debian --distro debian --profile server

# Create snapshot for cloning point
kvm-snap --name golden-debian --snap production-ready

# Clone entire VM in ~100ms, zero disk cost
kvm-clone --source golden-debian@production-ready --name worker-01
kvm-clone --source golden-debian@production-ready --name worker-02
kvm-clone --source golden-debian@production-ready --name worker-03

# Verify all VMs
kvm-list

# Destroy when done (zvol cleaned up automatically)
kvm-delete --name worker-01

Before: VM cloning traditionally involves copying full disk images—minutes per instance, massive storage overhead. ZFS copy-on-write means clones share unmodified blocks with the parent, consuming space only for differences.

After: This workflow enables true cattle infrastructure. Need 50 worker nodes? Clone in under 10 seconds total. The kvm-demo command provides an interactive exploration of GPU passthrough alternatives, Podman containers, and clone operations.

Example 3: Safe System Upgrade with Automatic Rollback

# kupgrade handles the dangerous part: it creates a ZFS snapshot
# of the current root dataset before any package changes,
# performs the upgrade, and marks the new state as default.
# If boot fails, ZFSBootMenu shows previous environments.
kupgrade

# Manual boot environment management
kbe list                    # Show all boot environments
kbe activate pre-upgrade    # Revert to previous state
kbe destroy failed-update   # Clean up broken environment

Before: System upgrades on production servers are terrifying. A broken kernel, failed driver compilation, or incompatible library update can render systems unbootable. Traditional solutions involve complex snapshot-bootloader integration or external recovery procedures.

After: ZFS boot environments make rollback as simple as selecting a previous snapshot at boot. The kupgrade command automates the snapshot-then-upgrade dance. Combined with kpkg (which snapshots before package operations), you get defense-in-depth against package-related failures.

Example 4: Golden Image Export for Multi-Platform Deployment

# Export ZFS golden images to formats compatible with any hypervisor
kexport --format qcow2 --source golden-debian@production-ready
kexport --format vmdk  --source golden-debian@production-ready
kexport --format vhd   --source golden-debian@production-ready
kexport --format ova   --source golden-debian@production-ready
kexport --format raw   --source golden-debian@production-ready

Before: Converting between VM disk formats requires multiple tools (qemu-img, VirtualBox utilities, Hyper-V tools), each with different syntax and potential compatibility issues.

After: Single command, any format. The OVA export includes cloud-init metadata for immediate deployment to AWS^{↗ Bright Coding Blog}, Azure, or private OpenStack clouds. Your bare-metal ZFS golden image becomes portable infrastructure.

Advanced Usage & Best Practices

Profile Selection Strategy

Start with core for understanding—minimal ZFS + WireGuard, stock distro. Graduate to server for headless infrastructure. Use desktop only when you need GNOME. The KVM profile is surprisingly lightweight if you're not running VMs; consider it for the Kubernetes tooling alone. The AI profile demands NVIDIA hardware; verify compatibility with kldload-overview before install.

ZFS Dataset Tuning

Default recordsizes are optimized for general use. Override for databases:

# PostgreSQL^{↗ Bright Coding Blog}: smaller records reduce write amplification
zfs set recordsize=8K rpool/var/lib/postgresql

# General file storage: larger records improve compression
zfs set recordsize=128K rpool/home

# VM zvols: match virtual disk block size
zfs set volblocksize=64K rpool/vms/golden-debian

Dark Site Maintenance

For fully offline environments, periodically rebuild darksites:

./deploy.sh build-debian-darksite
./deploy.sh build-ubuntu-darksite
./deploy.sh build-fedora-darksite

This downloads updated packages to your local mirror. Test in isolated network segments before production deployment.

Secure Boot MOK Enrollment

First boot after install requires enrolling the Machine Owner Key for ZFS module signing. The installer prompts; don't skip. Without this, Secure Boot fails and falls back to compatibility mode, defeating the verified boot chain.

Comparison with Alternatives

Feature	kldloadOS	Proxmox VE	Fedora Silverblue	NixOS	Canonical MAAS
Multi-distro support	✅ 8 distros	❌ Debian only	❌ Fedora only	❌ Nix only	✅ Many (network boot)
Single bootable ISO	✅ Yes	❌ Separate ISOs	❌ Separate ISO	❌ Separate ISO	❌ PXE required
ZFS on root	✅ Native, tuned	✅ Optional	❌ OSTree/Btrfs	❌ Btrfs/ZFS hacky	❌ Ext4/XFS
Offline install	✅ Darksites	❌ Network required	❌ Network required	❌ Network required	❌ Network required
eBPF pre-installed	✅ Full toolchain	❌ Manual	❌ Manual	⚠️ Partial	❌ Manual
WireGuard mesh	✅ Auto-configured	❌ Manual	❌ Manual	⚠️ Configurable	❌ Manual
KVM instant clone	✅ ~100ms ZFS	✅ ZFS possible	❌ Not applicable	❌ Not applicable	❌ Not applicable
K8s bare metal	✅ One command	⚠️ Manual setup	❌ Not focus	⚠️ Complex	⚠️ Complex
No vendor lock-in	✅ Uses upstream repos	⚠️ Proxmox repos	⚠️ OSTree model	⚠️ Nix ecosystem	⚠️ Canonical ecosystem
License	BSD-3-Clause (free)	AGPL/Subscription	MIT	MIT	AGPL

Why kldloadOS wins: It's the only solution combining multi-distro flexibility, true offline capability, ZFS-native everything, and zero vendor lock-in in a single bootable image. Proxmox is excellent for virtualization but forces Debian. Silverblue is elegant but Fedora-only and network-dependent. NixOS is powerful but has a steep learning curve and no instant cloning. MAAS requires network infrastructure and doesn't solve the "one USB" problem.

FAQ

Q: Is kldloadOS a new Linux distribution? A: No—it's a distribution assembler. The live environment is CentOS Stream 9, but your installed system is pure, unmodified upstream packages from your chosen distro's official repositories. There are no kldload-specific repositories or updates.

Q: Can I install without internet access? A: Yes, for CentOS Stream 9, Debian 13, Ubuntu 24.04, Fedora 41, and Rocky Linux 9. RHEL 10 requires Red Hat CDN access. Arch requires internet due to rolling release. Alpine has partial offline capability via embedded apk cache.

Q: How does ZFS boot environments compare to Btrfs snapshots? A: ZFS boot environments are more robust—separate mountable roots with independent kernel versions, native encryption per dataset, and proven stability at scale. ZFSBootMenu replaces GRUB entirely, providing a cleaner boot management experience.

Q: Is Secure Boot fully supported? A: Yes, with MOK-signed ZFS kernel modules and end-to-end verified boot chain. You must enroll the Machine Owner Key on first boot.

Q: Can I use kldloadOS for production Kubernetes? A: The KVM profile's Kubernetes deployment includes Cilium eBPF CNI, MetalLB, Gateway API, Hubble observability, and dual WireGuard backplanes. The 190+ automated smoke tests validate cluster health. Many users run production workloads; evaluate against your specific compliance requirements.

Q: What's the catch? How is this free? A: BSD-3-Clause license, no strings attached. The project monetizes through enterprise support and custom profile development, per their website. The core ISO and all tools remain free forever.

Q: How do I get help or report issues? A: Active Discord community, GitHub issues on the kldload repository, and demo videos on YouTube.

Conclusion: The USB Stick That Replaced My Entire Toolkit

I've burned thousands of ISOs over fifteen years in infrastructure. Debian for this client, RHEL for that compliance requirement, Ubuntu for the dev team, Arch for my workstation. Each with separate tools, separate update mechanisms, separate disaster recovery procedures.

kldloadOS ends that fragmentation.

One USB. Any distro. ZFS on root everywhere. WireGuard mesh from boot. eBPF observability ready. KVM cloning in 100ms. Kubernetes in one command. Local AI when you need it. All fully auditable, fully offline-capable, and locked to zero vendor control.

The kldloadOS GitHub repository is where this quietly radical project lives. Download the free ISO at dl.kldload.com, join the Discord, or watch the demo video to see it in action.

Your drawer of USB sticks just became obsolete. And honestly? Good riddance.

kldloadOS 1.0.4 — built from the kernel up.