How it works

Inside Kova OS

A premium, managed gaming OS built from plain Arch Linux packages, assembled into signed, read-only images, with support, security and updates handled by the Kova OS Dev Team. This page explains the design so nothing on the machine is a mystery.

The image model

Kova is not installed package by package. The whole operating system, everything under /usr, is one image built on the Kova build server, hashed with dm-verity and signed with the Kova key. Your machine holds two slots for it, A and B. The running slot is never modified; an update is written into the other slot, the machine boots into it once, checks itself, and either keeps it or falls back.

CheckClient reads the signed manifest at images.kovaos.org.

DownloadOnly the partition images that changed.

WriteInto the inactive slot. Nothing running is touched.

Boot onceThe boot loader tries the new image with a boot counter.

VerifyGPU, session and network must come up.

Keep or revertPass marks it default, fail boots the old slot.

What stays yours

Path	Filesystem	On update
`/usr`	erofs, read-only, verity-checked, slot A or B	Replaced atomically
`/` incl. `/etc` and `/var`	btrfs, writable	Untouched. Settings, users, Wi-Fi, Flatpaks live here.
`/home`	btrfs with zstd compression	Untouched. Games, saves, files.
ESP	FAT32	New kernel image added, two kept

The kernel, drivers and initrd ship inside a single signed UEFI executable per release. No DKMS, no module rebuilds on your machine, nothing to break.

Secure Boot

Kova signs its kernel images with a private key that lives only on the build server. The installer USB carries enrollment files: with the firmware in Setup Mode, the boot loader enrolls the Kova key plus Microsoft's UEFI certificates, so graphics card firmware still loads. From then on only Kova-signed images boot on that machine.

Sessions

Session	What it is
Gaming mode (default)	Steam Big Picture inside gamescope with adaptive sync, HDR passthrough and FSR. Controller from power-on.
Desktop	Hyprland with the Kova rice: waybar, rofi, kitty, hyprlock, carbon dark-white theme. Tearing and direct scanout for fullscreen games.
Sandbox (0.3)	Disposable Windows VM with the GPU passed through, isolated from your files and LAN.

Gaming stack

Steam, Heroic (Epic, GOG, Amazon), Lutris in the image. Roblox via Sober and Roblox Studio via Vinegar as Flatpaks. Brave browser as a Flatpak.
Proton from Steam today, Proton-GE preinstalled from 0.2.
gamescope, MangoHud, gamemode, LACT for GPU power and fans.
Mesa RADV for AMD. NVIDIA's open kernel modules from 0.2.

Performance defaults

Layer	Setting
Kernel args	`amd_pstate=active`, watchdogs off, split-lock detection off, AMD overclocking mask unlocked
Scheduler	scx_lavd via sched-ext, ananicy-cpp priorities, gamemode
Memory	zram at half of RAM, `vm.max_map_count` raised, swappiness tuned for zram
Storage	mq-deadline on NVMe and SSD, bfq on spinning disks, btrfs zstd:1 on home
Audio	PipeWire, low-latency quantum
Coming	Custom kernel from the CachyOS patch set (BORE, 1000 Hz, x86-64-v3), power modes with GPU limits and C-state control

The kova command

Command	Does
`kova update` / `check` / `list`	Fetch the next image into the spare slot, or show what is available and installed
`kova rollback`	Boot the previous image next time
`kova session gaming\|desktop`	Switch session
`kova power max\|balanced\|quiet`	Power mode
`kova doctor`	One-screen health report
`kova version`	Image version and credits

Kova Cloud and support

At first boot the machine registers with the Kova server and opens a WireGuard tunnel to it. Nothing listens on your home network; SSH is reachable only over the tunnel and only with the Dev Team's key. Logs, crashes and settings sync to the server, and kova logs share produces a private, expiring link for whoever is helping. The dashboard and leaderboard live behind their own logins.

The model: Red Hat for gaming

Red Hat took a community operating system and made it something a business could rely on: tested releases, a support contract, security patches on a schedule, and someone to call. Kova applies that idea to gaming. The community builds Arch, Mesa, Proton and Hyprland; the Kova OS Dev Team curates, tests, signs and supports the result so a gamer gets a machine that simply works.

Closed source, honestly

Everything the Kova OS Dev Team writes, the CLI, installer, cloud, themes, build recipes, stays private and ships as binaries. The Linux kernel, Mesa, systemd, Hyprland, gamescope and every Arch package keep their own open licences; Kova redistributes them unchanged.