We are excited to announce the release of Rugix Ctrl 1.3. 🎉
Rugix Ctrl 1.3 focuses on three areas: preventing incompatible deployments, providing a clear privilege boundary for local management, and improving recovery when early boot does not go as planned. To this end, the release introduces component compatibility checks, adds a privileged operation daemon, and provides new options for handling boot failures.
Compatibility Checks Before Installation
A validly signed update is authentic, but that does not necessarily make it suitable for a particular device. A fleet may contain several hardware revisions, applications may depend on a specific base-system interface, and two workloads may both expect to own the same port or systemd unit.
Rugix Ctrl 1.3 can now represent these constraints as components. A component describes a system, application, runtime, or hardware fact. It can provide capabilities, require or conflict with other capabilities, and claim resources that must have a single owner.
System and application bundles can carry component metadata alongside their payloads. Before installing anything, Rugix Ctrl combines the candidate components from the bundle with the components installed on the device. This can prevent, for example, an application from being installed on an unsupported hardware revision, a system update from breaking an application dependency, or two workloads from claiming the same port.
Component metadata is optional, so existing bundles remain valid. When an operator has to override a known incompatibility, --skip-compatibility-check makes that decision explicit.
Component compatibility checks are experimental in Rugix Ctrl 1.3. We expect to refine the model and its interfaces as we gain practical experience with deployments.
Check out the compatibility documentation for the complete component model and practical examples.
A Clear Privilege Boundary
Rugix Ctrl performs operations that inherently require root privileges: writing partitions, changing bootloader state, managing applications, and resetting persistent state. A local management interface should still not need unrestricted root access just to invoke those operations.
The new privileged operation daemon separates the caller from the privileges required to carry out a request. A root-owned Rugix Ctrl process executes typed operations on behalf of unprivileged clients and enforces its own policy. Sensitive operation families, including factory reset, system commit, explicit reboot, and application lifecycle management, are disabled by default and can be enabled individually.
Rugix Admin, the project’s local web interface, now uses this daemon and has moved into its own repository, with its own installer and release artifacts. As an experimental component, Rugix Admin was never part of Rugix Ctrl’s compatibility promise. The move lets it evolve independently while keeping the privilege boundary explicit. We plan to release the first version from the new repository next week.
Booting Through Failures
On systems with state management enabled, Rugix Ctrl runs early during boot to mount persistent state, prepare the root filesystem, and coordinate with the configured boot flow. Failures at this stage need a deliberate failure policy because the normal userspace environment is not available yet.
Rugix Ctrl 1.3 improves diagnostics for init errors. For development and on-site debugging, the new rugix.init.shell_on_error[=<seconds>] kernel parameter can open a shell after an init failure. It is disabled by default because an automatic root shell would give anyone with console access control of the device.
Deployments can also configure an in-memory overlay as a fallback when the persistent root overlay cannot be mounted. Boot flows now declare whether they can recover from a userspace failure, allowing Rugix Ctrl to choose an appropriate fallback.
Data-partition mount failures now fall back to ephemeral state by default so that the device can continue booting. Changes made in that mode do not survive a reboot. Set data-partition.fail-on-mount-error = true when continuing without persistent data is unsafe for your product.
Further Improvements
Rugix Ctrl 1.3 also includes reliability and interoperability improvements across bundle handling, system updates, Rugix Apps, and the supported boot flows. See the changelog for the complete list.
Get Started
Download Rugix Ctrl 1.3 and Rugix Bundler from the GitHub release, or follow the Rugix Ctrl documentation to integrate them into an existing embedded Linux system.
We welcome your feedback and contributions on GitHub. If you have questions or want to discuss a deployment, join our Discord community.
At Silitics, we help companies build robust and secure embedded Linux products. If you need help designing an update architecture or integrating Rugix into an existing platform, we’d love to hear from you.