Ubuntu 24.04 LTS · k3s · KubeVirt.
One ISO · workstation, server or IoT.
Your hardware, managed from the cloud.
askFinz OS is a purpose-built Linux distribution that turns a workstation, a server or an IoT device into a managed dual-role appliance. On the front, a fullscreen kiosk for the askFinz cloud. Underneath, a k3s + KubeVirt compute node the cloud schedules onto — your CPU, your GPU, your NPU, your storage, your network, given back to you as a Vercel-style deploy target.
The kiosk opens straight into the cloud — same workshop you get in any browser, served fullscreen on the device.
Boot from USB or installed disk, pair the device to your askFinz account, and the Chromium kiosk opens fullscreen on the askFinz workshop. Same workshop you get in any browser — served on the device, with the cloud session persisted across reboots.
CPU, GPU, NPU, sensors, GPIO, microphones, displays — every capability becomes a REST endpoint on the device and a K8s device-plugin resource for workloads that need direct passthrough. The cloud sees the hardware; workloads can claim it.
Deploy from code.askfinz.ai, run training jobs from train.askfinz.ai, host KubeVirt VMs — all onto your own hardware, orchestrated by the askFinz cloud. Vercel-style UX, on metal you own. LAN peers join a single k3s cluster automatically.
askFinz OS is not a general-purpose desktop distro. It does not ship a custom shell or window manager — the Workstation profile is a Chromium kiosk pointed at the askFinz cloud, not GNOME or KDE with our wallpaper. If you want a desktop Linux, install one and use the browser extension.
It is also not a self-contained askFinz server. The entire application stack — every frontend, every backend, every database, the vector store, the queue, Vault — lives in askFinz's cloud infrastructure. The device contributes hardware and schedulable compute; the cloud is the source of truth for application data.
Privacy posture follows from that: application data (chat threads, documents, code, mail) lives in the cloud against your askFinz account. User-deployed workloads (the containers you push from code.askfinz.ai, the training jobs you submit from train.askfinz.ai, the KubeVirt VMs you boot) run on your own hardware and keep their data local. /trust documents the split in full.
The Workstation profile turns a desktop or laptop into a kiosk + compute node: fullscreen Chromium pointed at the cloud, hardware bridge exposing your GPU and NPU, k3s scheduling your own workloads alongside the kiosk session. The Server profile is headless — no kiosk, k3s control-plane on by default, KubeVirt enabled, primary host for vLLM serving, training runs, and VM workloads. The IoT profile is a stripped ARM64 image that joins the LAN cluster as a k3s agent — sensors, GPIO and small-model inference (on Jetson) exposed to the cloud, no KubeVirt, no kiosk. All three are managed from access.askfinz.ai with Proxmox-equivalent depth — SSH, NoVNC, RDP, Wake-on-LAN, package install, cluster ops, GPU passthrough — and every action lands in the immutable device audit log.
| Profile | ISO | Note |
|---|---|---|
| Workstation · amd64 | askfinz-os-workstation-amd64.iso | Desktops and laptops. Chromium kiosk + hardware bridge + schedulable k3s node. KubeVirt opt-in. vLLM optional on capable GPUs. |
| Server · amd64 | askfinz-os-server-amd64.iso | Rack servers and GPU boxes. Headless k3s control plane, KubeVirt enabled, primary workload host. No kiosk UI. |
| IoT · ARM64 | askfinz-os-iot-arm64.iso | RK3588 SBCs, Pi 5, Snapdragon X. Joins LAN cluster as k3s agent. Exposes sensors, GPIO, small-model inference. No KubeVirt. |
| IoT · Jetson | askfinz-os-iot-jetson.iso | NVIDIA Jetson Orin (L4T base). Same role as the ARM64 IoT image, with Jetson-native CUDA + TensorRT bindings active. |
Every image ships SHA-256 + GPG-signed by askFinz Release Engineering. Disks are LUKS-encrypted with TPM2 auto-unlock; AES-NI keeps the overhead under five per cent. Secure-Boot-signed shim ships in Phase 11.
No application secrets ever land on device disk. Vault values reach pods via external-secrets into tmpfs. SSH uses 1-hour certs minted by the askFinz CA — there are no static authorized_keys on the device.
Email hello@askfinz.com with your hardware list and target profile — we send a signed ISO, the SHA-256 + GPG block, and a first-boot pair code for access.askfinz.ai.
