Open-Source Embedded Linux Container Framework

Pantavisor Linux

Your whole embedded Linux system — kernel, drivers, and apps — managed as one signed, versioned state, with atomic, rollback-safe OTA updates.

Flash a ready image on any of our 12 supported boards, then update your fleet transactionally — no full reflashes.

Download Pantavisor Quick Start
Or build in the cloud with Pantacor Hub & MCP →
Pantavisor architecture: app containers and system containers linked by pv-xconnect, the BSP with the Linux kernel, all run by Pantavisor as PID 1 with signed state, OTA updates and rollback. APP CONTAINERS Embedded appgateway · PLC UI & servicesWayland · web UI AI & visionPyTorch · ROS 2 PV-XCONNECT SYSTEM CONTAINERS NetworkNM · VPN · D-Bus Managementpvr-sdk · SSH GPU driversCUDA · Vulkan BSP Linux kernelDTB · firmware · modulesHW modules PantavisorPID 1 · SIGNED, VERIFIED STATEOTA updatesRollback
Pantavisor architecture: app containers, system containers, the BSP, Pantavisor as PID 1. APP CONTAINERSEmbedded · UI · AI & vision PV-XCONNECT SYSTEM CONTAINERSNetwork · Management · GPU BSPLinux kernel · HW modules PantavisorPID 1 · SIGNED STATEOTA updates · rollback
~1 MB
Runtime, as a compressed initramfs
12 Boards
Tested official images
5
CPU architectures
ARM & ARM64 images; x86-64, RISC-V, MIPS from source
MIT
Open-source device runtime
Lifecycle

From dev board to fleet, one workflow

Go from a first prototype board to factory flashing and fleet updates with the same workflow.

Build: a signed state.json is built with pvr into a device stackstate.jsonbsp/kerneldrivers/cudaapps/vision✓ SIGNEDpvrDEVICEAppsDriversBSPPantavisor
01 : BUILD

Say it once, rebuild it exactly

Eliminate configuration drift between developer workstations, CI pipelines, and production images.

  • Declarative state manifest: Kernel, BSP, hardware drivers, and apps defined in one versioned tree.
  • OCI & Yocto native: Combine standard OCI/Docker containers with meta-pantavisor BSP builds. Already on Yocto? Pantavisor works alongside it. Compare with Yocto and Balena →
  • Cloud & Git builds: Build signed container exports in the cloud from a GitHub or GitLab repository.
Explore Hub Remote Builds →
Ship: a signed factory image per board, for NXP, Rockchip, Allwinner and Raspberry Pi boardsFactory imageARM64NXP · RockchipARMAllwinnerRaspberry Piall modelsSIGNED STATE · DM-VERITY · AUTO-JOIN
02 : SHIP

One path from lab to factory floor

Transition smoothly from carrier boards to volume manufacturing, OEM signing, and zero-touch provisioning.

  • Containers connected by declaration: apps state the services they need (D-Bus, REST, Unix sockets, Wayland, display devices) and pv-xconnect wires them to the containers that provide them, with role-based access.
  • Signed security on every board: signed state on every board, dm‑verity for containers that enable it, plus a verified bootloader wherever the SoC supports secure boot.
  • Factory images: Generate signed flashable production images with auto-join enrollment tokens.
Flashable Device Images Guide →
Operate: a new revision is tested, then kept or rolled back automaticallyrev 41 · runningrev 42 · testing✓ DONE↺ ROLL BACK TO 41health check
03 : OPERATE

Updates that roll back on their own

Transactional OTA updates, live health verification, and automatic rollback across connected or offline fleets.

  • No-reboot app updates: Services, AI models, and runtimes update in place as containers. Only BSP changes, or changes to containers with a system restart policy, trigger a transactional reboot.
  • Atomic updates and auto-rollback: Updates verify health in a testing state and revert automatically if services fail.
  • Flash-friendly CAS storage: Objects are stored by content hash and shared between revisions, so an update writes only the objects that changed.
Updates & Rollback Guide →
Cloud builds & AI

Build in the cloud, or from your AI assistant

Build signed packages directly in the cloud from Git, or let your AI assistant inspect devices and trigger builds.

CLOUD CI

Pantacor Hub Remote Builds

Point to a GitHub or GitLab repository, or a registry image pinned by digest, to build signed multi-arch container exports in the cloud.

# Build a multi-arch signed app export in the cloud with pvr pvr build start \ --project hello-http \ --git-url https://github.com/acme/hello-http \ --git-ref main \ --platform arm64,amd64 \ --limit-seconds 7200
Builds with pvr ↗ How Builds Work → GitHub Actions → Signing Identities →
MCP PROTOCOL

Pantacor Hub MCP & Agent Skills

Connect your coding agent directly to https://api.pantahub.com/mcp — examples below for Claude Code and Antigravity — with OAuth and the open-source pantavisor-apps skill to inspect devices, read live logs, trigger builds, and deploy revisions.

# 1. Install the official Pantavisor Agent Skill npx skills add pantavisor/pantavisor-skills # 2. Connect your coding agent to Pantacor Hub MCP claude mcp add --transport http pantahub https://api.pantahub.com/mcp agy mcp add pantahub https://api.pantahub.com/mcp
MCP Connector Docs ↗ Building with an AI Assistant → MCP Service Reference → GitHub Skill Repo →
Security

A chain of trust from boot ROM to container

On boards with secure-boot hardware, every layer is verified in turn. On boards without it, Pantavisor still rejects revisions whose signatures fail to verify (and requires signatures in strict mode), and containers can enable dm‑verity.

STAGE 01 · SILICON

Boot ROM checks the bootloader

Hardware OTP fuses and on-chip ROM authenticate the first-stage bootloader.

STAGE 02 · BOOTLOADER

Bootloader checks the kernel

The secure bootloader verifies digital signatures on the kernel, device tree, and initramfs.

STAGE 03 · SIGNED STATE

Pantavisor checks the system state

Pantavisor validates the signed state manifest against its onboard truststore.

STAGE 04 · CONTAINERS

Each container is verified when mounted

Container volumes can be protected with dm‑verity, which checks block integrity at mount time.

Security architecture →
Deployment

Run it in the cloud, on your servers, or offline

Choose the control plane that fits your security and operational requirements. Every option runs the same open-source device runtime.

Cloud hosted

Pantacor Hub SaaS

Manage devices with a multi-tenant cloud control plane for rapid prototyping, remote cloud builds, AI MCP workflows, and production fleet management.

  • ✔ Instant device claiming & auto-join tokens
  • ✔ Remote Git-to-device container & image builds
  • ✔ Live logs, Web SSH terminal & MCP endpoint
  • ✔ Free for up to 25 devices; paid plans from $60/month
Launch on Pantacor Hub →
Private fleet

Dedicated enterprise fleet

Run isolated enterprise environments with custom OEM signing hierarchies, dedicated build runners, and commercial SLAs from Pantacor.

  • ✔ Custom OEM root-of-trust & signing policies
  • ✔ Dedicated cloud infrastructure & webhook pipelines
  • ✔ Direct engineering support from Pantacor Ltd
Talk to Pantacor →
Air‑gapped

On-premise & offline edge

Operate completely disconnected from the public internet. Manage devices over local LAN with pvr and the PVR SDK (local API and web UI on port 12368).

  • ✔ Direct local updates via pvr & PVR SDK port 12368
  • ✔ Open-source device stack (MIT) and pvr CLI (Apache 2.0)
  • ✔ Factory floor & private data-center ready
Explore the PVR SDK →

Pantacor Hub plans: Free (up to 25 devices), Business $60/month (500 devices), Business Plus $600/month (5,000 devices), Enterprise $9,000/month (20,000 devices, 99.9% uptime, 4-hour response SLA).

Management tools:
PVR CLI → MCP Connector → PVR SDK → Pantacor Hub →
Quick start

Get started in minutes

Flash a physical board, run Pantavisor AppEngine in Docker without hardware, or build signed containers in the cloud with AI.

# 1. Flash the image to an SD card or eMMC (see Downloads), connect the board to your network # 2. Install the pvr CLI, then find the device on your network curl -sL https://gitlab.com/pantacor/pvr/-/raw/master/install.sh | bash pvr device scan # 3. Clone your device firmware repository over LAN pvr clone http://DEVICE_IP:12368/cgi-bin device_name && cd device_name # 4. Add the container, sign the revision, commit, and deploy pvr app add --from registry.gitlab.com/pantacor/pantavisor-web-status:master pwebstatus pvr add . pvr sig update pvr add . pvr commit -m "add pwebstatus" pvr post # pvr sig update signs the new state before it is committed; pvr post deploys it to the device # Done! Container deployed - web status available at http://DEVICE_IP:5001
# 1. Install the pvr CLI curl -sL https://gitlab.com/pantacor/pvr/-/raw/master/install.sh | bash # 2. Load Pantavisor AppEngine: download the "AppEngine test container" from Downloads, then tar -xzf docker-x86_64-scarthgap-*.tar.gz && ./test.docker.sh install-docker # 3. Start Pantavisor AppEngine in Docker docker volume create pantavisor-storage docker run --name pv-engine -d --privileged -v pantavisor-storage:/var/pantavisor/storage -p 12368:12368 -p 5001:5001 pantavisor-appengine:latest # 4. Clone the device firmware repository from AppEngine pvr clone http://localhost:12368/cgi-bin device_name && cd device_name # 5. Add the container, sign the revision, commit, and deploy pvr app add --from registry.gitlab.com/pantacor/pantavisor-web-status:master pwebstatus pvr add . pvr sig update pvr add . pvr commit -m "add pwebstatus" pvr post # pvr sig update signs the new state before it is committed; pvr post deploys it to the device # Done! Container deployed - web status available at http://localhost:5001
# 1. Install the official Pantavisor Agent Skill npx skills add pantavisor/pantavisor-skills # 2. Connect your AI assistant to the Pantacor Hub MCP endpoint claude mcp add --transport http pantahub https://api.pantahub.com/mcp # 3. Or trigger a remote container build directly with the pvr CLI pvr build start \ --project my-app \ --git-url https://github.com/acme/my-app \ --git-ref main \ --platform linux/arm64 \ --limit-seconds 900 # Output: .pvrexport.tgz built in the cloud (signed with the developer key unless you pass --signing-secret), ready to deploy to your device in Pantacor Hub
Download the image for your board
Start building today

Ready to ship your first board?

Download ready-to-flash Pantavisor images for Raspberry Pi, NXP i.MX, Rockchip and Allwinner boards, or start building signed containers in the cloud with Pantacor Hub.

Download Pantavisor Start free on Pantacor Hub

Shipping a fleet? Talk to Pantacor →