CLI

open-source / offline-first / edge computing

One self-extractiblebinary.

daedalus is an open-source tool that compiles your application and its runtime into one self-extractible, signable, encryptable binary.

build ./my-app run <file>

11 runtimes6 targets

daedalus / formatERE · 01

stubpayloadmetadatafooter

11supported runtimes

6compilation targets

Ed25519signing

AES-256-GCMencryption

SISRdelta auto-update

field comparison

Measured against the field.

built innot built in

One .de file, no runtime dependency, SISR delta updates, and a health gate -- compared with the packaging paths developers already know.

Capability	daedalus	Docker	Podman	AppImage	Snap	Flatpak	PyInstaller	Nix
Application + runtime	App + runtime in one .de	Image layers	Image layers	One AppImage file	Snap package	App + separate runtime	App + Python runtime	Store paths
No host daemon at launch	No Docker, cloud, npm/pip/apt	Requires daemon	Daemonless	Requires FUSE	Requires snapd	Requires Flatpak runtime	No Python install	Requires Nix store
Automatic runtime detection	14 runtimes	Manual packaging	Manual packaging	Manual packaging	Manual packaging	Manual packaging	Spec / entrypoint	Derivation
Delta update path	SISR chunk diffing	Full layer redownload	Full layer pull	Full binary redownload	Delta via squashfs	OSTree deltas	Full binary redownload	Store path replacement
Signed artifact	Ed25519 manifest + binary	External signing	External signing	Detached signature	Signed assertions	Repository signing	External signing	Cache signing
Encrypted payload	AES-256-GCM + external key	Not built in	Not built in	Not built in	Not built in	Not built in	Not built in	Not built in
Health gate + rollback	Pending --> Confirmed / Quarantined	Orchestrator concern	Orchestrator concern	Not built in	Refresh rollback	Not built in	Not built in	Generations + rollback
Cross-platform targets	6 targets	Multi-platform images	Multi-platform images	Linux	Linux	Linux	Per-OS builds	Multi-platform packages

01 / Build time

No Docker.
No cloud runtime.

No Docker, no cloud runtime, no npm/pip/apt at runtime.

build timemy-app.de

daedalus build ./my-app -o my-app.de

appruntimerootfs.de

AI-assisted dependency detection

any model

Bring the model to the project.

Attach any model to the project. It detects the dependencies and entrypoint required to build the app or tool.

01 / modelany model

02 / scanproject files

03 / outputdependencies

Runtime detection

Scan the folder to find requirements.txt, package.json, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml, config.toml (Hugo), etc.

Dependency installation

Runs pip install, npm install, go mod download, mvnw package, bundle install, composer install, etc.

Optional compilation

Go, Rust, Java (Maven/Gradle), .NET --> native binary.

Interpreter embedding

Rootfs staging

Copies app files, tree-shaking (--tree-shake), minification (--minify).

Compression

zstd+tar by default (level 1--19, default 3). SquashFS option (--squashfs) for format v5.

SISR indexing (optional)

Content-defined FastCDC chunking (target 8192 bytes by default), delta manifest with Merkle tree, Ed25519 manifest signature.

Encryption (optional)

AES-256-GCM with HKDF-SHA256 derivation, salt/nonce stored in JSON metadata. The key is never in the binary.

Assembly

[stub][payload][metadata][footer]. The stub is the ELF/Mach-O/PE that executes everything.

Signing (optional)

Ed25519 over SHA-256(footer ‖ payload ‖ metadata).

Binary format

[stub][payload]
[metadata][footer]

The stub is the ELF/Mach-O/PE that executes everything.

Footer v2: 84 bytes

Footer v3/v4/v5: 92 bytes

Magics: ERE 01 · 0xBEEF_CAFE

Flags: signed · SISR · encrypted

integrity

stub

payload

metadata

footer

02 / Runtime (user side)

Cache warm.
Cold path.

The user launches ./mon-app.de.

~/.cache/daedalus/<hash>/rootfs/

direct exec

The user launches ./mon-app.de.

The stub reads /proc/self/exe and parses the footer from the end of the file.

Cache warm: if the source file SHA-256 matches an existing cache entry (~/.cache/daedalus/<hash>/rootfs/) AND size/mtime match, extraction is skipped --> direct exec.

Cold path: reads the payload, decrypts if needed, verifies Ed25519 (v3+), verifies SHA-256, verifies embedded SISR authenticity.

Atomic extraction with flock, LRU GC (max 16 entries by default).

Health gate: if the version was just updated (Pending state), supervised launch (fork/spawn). If the app survives the timeout or exits 0 --> Confirmed. Otherwise --> Quarantined + automatic rollback to the backup.

execvp of the entrypoint with LD_LIBRARY_PATH, or user+mount namespaces + pivot_root (level 2 isolation).

Reserved flags --daedalus-version and --daedalus-update are intercepted before the app.

03 / SISR

Automatic updates (SISR)

Only modified layers are rebuilt. Update the model via SISR delta over a 960kbps link without re-downloading the full payload.

FastCDCMerkle treeEd25519

DeltaManifestXBMD magic

Triggered by --daedalus-update[=<URL>] or DAEDALUS_UPDATE_URL (Linux only).

Download the remote XBMR manifest, verify Ed25519 + Merkle root.

Retrieve modified chunks by SHA-256, hash-verified.

Atomically reconstruct the binary, mark Pending.

Pending

Confirmed

Quarantined + automatic rollback to the backup.

04 / detect + execute

Supported runtimes

detection + entrypoints

Runtime	Detection markers	Entrypoints / frameworks
Python	requirements.txt, pyproject.toml, app.py, main.py	Django (manage.py runserver), FastAPI/uvicorn, Streamlit, PEP 621 (python3 -m module)
Node.js	package.json	Next.js standalone, Express (bin/www, dist/main.js), NestJS, Bun (bun.lockb), tsx/ts-node
Electron	package.json + dep "electron"	electron /app/main.js
Deno	deno.json, deno.jsonc	Fresh, deno run --allow-all
Java	pom.xml, build.gradle	Spring Boot fat JAR, mvnw/gradlew
Ruby	Gemfile, _config.yml	Rails (bin/rails server), Sinatra, Jekyll (bundle exec jekyll serve)
.NET/C#	*.csproj	ASP.NET (dotnet run --project), self-contained publish
Go	go.mod, main.go, cmd/	go build --> static binary
PHP	composer.json, *.php	Laravel (artisan + FrankenPHP), WordPress, OpenEMR, Drupal, generic php -S
Perl	Makefile.PL, cpanfile	Mojolicious, Dancer
Hugo	config.toml, hugo.toml	hugo server
Wasm	*.wasm	wasmtime
Native binary	ELF/PE magic bytes	Any static or dynamic binary

05 / universal

Compilation targets

Compile from any host to any target.

host --> target

Short form	Rust triplet	Stub	OS
host	host	host stub	native
linux-x64	x86_64-unknown-linux-musl	static ELF	Linux
linux-arm64	aarch64-unknown-linux-musl	static ELF	Linux
darwin-x64	x86_64-apple-darwin	Mach-O	macOS
darwin-arm64	aarch64-apple-darwin	Mach-O	macOS
win-x64	x86_64-pc-windows-gnu	PE (.exe)	Windows
win-arm64	aarch64-pc-windows-gnu	PE (.exe)	Windows

06 / field

Use cases

Offline-first. Zero Docker. Security by default.

edge computing960kbps

Healthcare - offline diagnostics

Package a diagnostic AI model + Python runtime in a .de. Deploy on a Raspberry Pi at a rural clinic with no cloud, no fiber, intermittent 2G/3G. Update the model via SISR delta over a 960kbps link. Patient data stays on-device.

Agriculture - LoRaWAN + solar gateway

LoRaWAN sensors feed a solar gateway with no local data center. The .de binary fits in a LoRa window. Delta updates compress bandwidth by 90%. No pip install on the gateway. AES-256-GCM keeps production data encrypted at rest.

Energy - isolated sites monitoring

Solar and wind monitoring on isolated sites with no cloud. Production data needs encryption. AES-256-GCM embeds security in the binary. Ed25519 signing guarantees the binary has not been tampered with in transit.

Offline coding assistant - on-device AI

Package Ollama + a model + a custom app in a .de. 100% on-device inference. No cloud GPU, no reliable npm registry needed. Update the model via SISR delta. Hot-swap layers to patch the app without rebuilding the whole binary.

Local development - fast rebuilds

A full app rebuild is slow (Python, Node with 2000 packages). daedalus --update performs an incremental rebuild. Only changed layers are rebuilt. swap patches a layer live in an existing .de without a full rebuild.

Registry-free app distribution

Sell or distribute an app without npm, PyPI, or Docker Hub. One .de file to copy to a USB stick, NAS, or file server. Ed25519 signing guarantees authenticity. Optional AES-256-GCM encryption protects intellectual property.

Developer Tools - multi-language packaging

Distribute apps written in 11 runtimes (Python, Node.js, Go, Rust, and more) without managing complex dependencies, virtual environments, or heavy containers. Daedalus packages runtime + code into one self-extractible .de / .daedalus (SquashFS v5) that runs immediately on any Linux distribution, no install step.

Embedded & IoT edge distribution

Deploy software updates across fleets of thousands of edge / IoT terminals (industrial routers, sensors, kiosks, cameras) exposed to attacks or bandwidth constraints. SISR delta updates cut the size of transmitted patches dramatically, and the auto-update daemon built into the binary stub orchestrates background updates.

Untrusted code isolation & kernel sandboxing

Run third-party code or plugins in sensitive environments without risking the host (privilege escalation, data leaks, malicious syscalls). The stub applies strict kernel-level confinement at launch via Landlock (filesystem isolation), seccomp (syscall filtering), and user namespaces.

Supply-chain security & attestation

Meet regulatory and compliance requirements (Cyber Resilience Act, security audits) by guaranteeing the origin and integrity of every binary deployed in production. daedalus attest signs at build time with Ed25519 + SHA-256, auto-generates provenance, SBOM, and CVE vulnerability scans, and stores integrity evidence on a trusted attestation registry.

Private enterprise registry & internal distribution

Give teams a secure internal channel to distribute their CLI tools and internal utilities without publishing to public repositories. A centralized private registry with org/app organization, role-based access control (RBAC), and direct CI/CD integration (GitHub Actions, GitLab CI).

Deployments

Edge without runtime

Deploy on Raspberry Pi, IoT gateway, or industrial device without Docker, pip install, or cloud. Static ELF stub on ARMv7/ARM64, 512MB RAM is enough.

Deployments

Air-gapped & offline-first

Machine without internet, behind a firewall, in an aircraft, or on an isolated site. The .de is self-contained. Run it. Update via local file copy or SISR over sneakernet.

Deployments

Low-bandwidth sites

Updates over 960kbps links, LoRa, intermittent 4G, and satellite. SISR delta updates only transmit modified chunks. 90% bandwidth compression vs full binary redownload.

Deployments

Android & mobile

Run on Android through the stub, without root. Package a mobile companion app with its runtime embedded. Cross-compile from macOS or Linux to ARM64 Android targets.

Distribution

Registry-free app

One .de file on a USB stick, NAS, or file server. Ed25519 signing guarantees authenticity. No registry needed. Distribute as you would any other binary.

Distribution

Proprietary distribution

Optional AES-256-GCM encryption protects the payload intellectual property. The key is never in the binary. Only users with the key can decrypt and run the app.

Distribution

Offline SaaS

Desktop version of a SaaS that works without a connection, with optional sync when back online. Package the full stack: frontend, backend, database, runtime.

Distribution

Enterprise / on-prem

Deploy in regulated environments (healthcare, finance, defense) without cloud. Air-gapped, strict compliance, mandatory signature verification. Your data never leaves your infrastructure.

Verticals

Clinics / healthcare

Offline diagnostic app on Raspberry Pi at the clinic, no cloud, local data compliance. Patient data stays on-device. HIPAA-ready by design.

Verticals

Agriculture / IoT

LoRaWAN sensors, solar gateway, no local data center. Delta updates over 960kbps. Low-power, low-bandwidth, high-reliability deployments for farms and greenhouses.

Verticals

Energy & utilities

Solar/wind monitoring on isolated sites, production data encryption, no cloud. SCADA-adjacent deployments with signed, verified binaries and strict audit trails.

Verticals

Defense & government

Air-gapped, strict compliance, no cloud runtime, mandatory signature verification. Deploy on classified networks. Your supply chain, your keys, your control.

More verticals

Education

Offline coding tools on low-cost hardware, no reliable registry. Package IDEs, compilers, and learning environments. Students run them anywhere, on any hardware.

More verticals

Media / broadcast

Offline player on set-top box, no manual update. Package media codecs, players, and scheduling software. Update via SISR during off-air windows.

More verticals

Retail / point-of-sale

Checkout app on a low-cost terminal, no cloud, signature guarantees integrity. Package the POS software, payment processor, and inventory system together in one .de.

More verticals

Transport & logistics

Infotainment, logistics, and tracking on vehicles and containers without a permanent connection. Update via SISR when the vehicle docks. Low bandwidth, high reliability.

AI anywhere

Local AI, no cloud required

Package Ollama + any local model with your app. Deploy AI where the cloud does not reach: rural clinics, isolated gateways, air-gapped networks, low-bandwidth links.

OllamaGemma / Llama / MistralSISR delta updatesRaspberry Pi

Local AI stackoffline-first

Attach any model to your project. daedalus detects dependencies and entrypoints, then bundles the runtime + model + app into one .de.

Run entirely offline. No cloud GPU, no API key, no reliable internet. The model and app execute on the target machine.

Update the model via SISR delta over 960kbps links, LoRa, or intermittent 4G. Only changed chunks are transmitted.

Ed25519 signing + AES-256-GCM encryption. The key is never in the binary. Patient data and proprietary models stay on-device.

07 / fail-closed

Security

Memory safety via Rust. The key is never in the binary.

fail-closed

01verified

Zero unsafe in daedalus-core and daedalus-cli. Memory safety via Rust.

02verified

unsafe only in daedalus-stub for FFI calls: execvp, fork, waitpid, mount, pivot_root, flock. Every unsafe block has a SAFETY comment.

03verified

ANSSI-Rust compliant: no panic!() in lib, no unwrap()/expect() without context, checked/wrapping/saturating arithmetic, no mem::forget/.leak().

04verified

Ed25519: Ed25519 bit validation (CVE-2023-48022).

05verified

Encryption: AES-256-GCM + HKDF-SHA256, external key never embedded.

06verified

Seccomp (Linux): optional BPF denylist.

07verified

Landlock (Linux): optional LSM filesystem sandbox.

08verified

App Sandbox (macOS): optional sandbox profile.

08 / workspace

Internal architecture

Workspace crates

daedalus-core
daedalus-stub
daedalus-cli

daedalus-core

daedalus-core/

Shared library -- format, compression, detection, signing, assembly, CAS, SISR. Zero unsafe.

daedalus-stub

daedalus-stub/

Self-extractible launcher (ELF/Mach-O/PE). Only crate with unsafe (FFI).

daedalus-cli

daedalus-cli/

Cross-platform CLI. Zero unsafe.

Key modules in daedalus-core

format.rs -- Footer, MAGIC constants, read/write, version gating

detect.rs -- Runtime detection (14 runtimes), entrypoint resolution

assembly.rs -- Binary assembly [stub][payload][meta][footer]

encrypt.rs -- AES-256-GCM + HKDF-SHA256

sisr_stage.rs / sisr_header.rs -- Build-time chunking, Merkle tree, signature

sisr/engine.rs -- Runtime engine: apply_update, atomic swap

sisr/health.rs -- Health gate state machine (Pending/Confirmed/Quarantined)

sisr/resilience.rs -- Backup/restore/rollback

manifest.rs -- Binary DeltaManifest (XBMD magic)

layer.rs -- RuntimeLayer, ConfigLayer, Capability

metadata.rs -- BunFeatures, EmbeddedInterpreter, EncryptionMeta, Service, HealthCheck

cas.rs -- Content-addressable storage

chunker.rs -- FastCDC content-defined chunking

compress.rs -- zstd

embed.rs -- Interpreter embedding

pkgmgr.rs -- Package manager detection + install

registry.rs -- Layer registry (local dir or HTTP)

universal.rs -- Multi-arch binary polyglot

cron.rs -- Scheduled tasks

minify.rs / treeshake.rs -- JS/TS/CSS minification

persistent.rs -- Persistent storage

09 / terminal

CLI -- all commands

daedalus

build <dir>

Package a folder as .de

run <file>

Execute a .de

inspect <file>

Read .de metadata

keygen

Generate an Ed25519 key pair

sign <file>

Sign a .de with the private key

verify <file>

Verify the Ed25519 signature

trust <keyfile>

Add a public key to the trust store

scan [dir]

Find all .de files and display their metadata

doctor

Check system prerequisites

clean

Remove cache and artifacts

dashboard

TUI dashboard (SISR benchmarks + cache state, ratatui)

selftest

Test a .de in an ephemeral sandbox

upgrade

Auto-update the daedalus binary

migrate

Migrate a legacy .daedalus v1 to v2+ SISR

swap

Hot-swap a layer in an existing .de

publish

Publish a .de to a registry

registry

Push/Pull/List layers in a CAS registry

serve

Start a local registry

env

Display build config and environment

feedback

Open the feedback page

completion <shell>

Generate completion (bash/zsh/fish/elvish/powershell)

man [dir]

Generate man pages

daedalus

An open-source tool for edge computing, IoT, offline-first, and low-connectivity environments.

One .de file to copy to a USB stick, NAS, or file server.

daedalus buildLicense MIT

documentation

Docs.

Get Started Guides Manuals Reference

Everything you need to package, sign, and distribute your applications with daedalus. From your first .de binary to enterprise fleet deployment.

Get Started

If you are new to daedalus, this section guides you through the essential resources to get started.

Foundations

Guides

Step-by-step tutorials, organized by language and workflow.

Languages & runtimes

More runtimes

Workflows

AI & emerging

Manuals

User guides on how to install, set up, configure, and use daedalus products.

Build & package

Runtime & isolation

Updates & versions

Reference

Reference documentation for formats, the build tool, and security.

Formats

Tooling

Security

Security reference

New Updated

Start here.

New to daedalus? Start with Get Started to install and build your first .de binary in under 10 minutes. Then explore the guides for step-by-step tutorials on your specific use case.

Get started Browse guides

blog

DAEDALUS BLOG

Subscribe to get the latest updates

Edge Computing · 2026-09-01

Why SISR beats full-binary updates on 960kbps links

How delta chunking compresses a 200MB payload into 18MB over LoRa + satellite. Field data from 3 rural deployments.

Ted Kouhouenou

Security · 2026-08-20

Ed25519 attestation for IoT fleets: a practical guide

How clinics and agriculture co-ops sign binaries once and verify on 500+ devices without a CA. No cloud required.

Ted Kouhouenou

Product · 2026-08-10

Introducing daedalus attestation: signed provenance for every .de

SHA-256 + Ed25519 + SBOM + transparency log. The trust layer for edge distribution is here.

Ted Kouhouenou

Company · 2026-07-28

Why I build Daedalus? The story behind the name and the tool

Named after the mythical craftsman who built the Labyrinth. A dead SSD, a bootable USB stick, and one year of building on 8GB of RAM with no disk.

Ted Kouhouenou

View all posts

products

The daedalus platform.

daedalus CLI

Build & package

Package any app + runtime into a single .de binary. 11 runtimes, 6 targets, zero host dependencies.

daedalus build ./my-app -o my-app.de

Learn more

daedalus registry

Distribute & verify

CAS registry for .de binaries. Push, pull, version. Ed25519 signing built in. Private or public.

daedalus publish --registry registry.daedalus.dev

Learn more

daedalus attest

Trusted edge runtime

Signed attestation for every binary: SBOM, CVE scan, provenance proof. Deploy with confidence on edge fleets.

daedalus attest --attach sbom,cve,provenance

Learn more

daedalus fleet

Deploy at scale

Auto-update daemon + SISR delta updates + health gate. Deploy signed binaries to 100 to 100,000 devices. Per-device pricing.

daedalus fleet --device-limit 10000 --update-url https://...

See pricing

daedalus AI

Local AI deployment

Package Ollama + any local model + your app in one .de. Runs on a Raspberry Pi, an edge gateway, or a laptop. No cloud GPU. No reliable internet required.

daedalus build ./ai-app -o myai.de

Learn more

pricing

Simple pricing.

Personal

$0/mo

For individual developers and open-source projects.

11 runtimes, 6 targets
Sandbox kernel-level (seccomp + landlock + namespaces)
Signature Ed25519 & SHA-256
SISR delta updates (local)
Registre local & daedalus attest (SBOM de base)
Fleet deployment

Limite : utilisation locale & projets open-source publics.

Get started

You pay for real value: the machines, the fleet, the runtime.

No more absurd "per user" pricing in Enterprise. Enterprise accounts pay for the number of managed devices and the level of guarantee - not for counting developer licenses. Try it with a private cloud, a full SBOM, and a self-hosted registry.

Talk to sales

One self-extractiblebinary.

Measured against the field.

No Docker.No cloud runtime.

Bring the model to the project.

Runtime detection

Dependency installation

Optional compilation

Interpreter embedding

Rootfs staging

Compression

SISR indexing (optional)

Encryption (optional)

Assembly

Signing (optional)

[stub][payload][metadata][footer]

Cache warm.Cold path.

Automatic updates (SISR)

Supported runtimes

Compilation targets

Use cases

Healthcare - offline diagnostics

Agriculture - LoRaWAN + solar gateway

Energy - isolated sites monitoring

Offline coding assistant - on-device AI

Local development - fast rebuilds

Registry-free app distribution

Developer Tools - multi-language packaging

Embedded & IoT edge distribution

Untrusted code isolation & kernel sandboxing

Supply-chain security & attestation

Private enterprise registry & internal distribution

Edge without runtime

Air-gapped & offline-first

Low-bandwidth sites

Android & mobile

Registry-free app

Proprietary distribution

Offline SaaS

Enterprise / on-prem

Clinics / healthcare

Agriculture / IoT

Energy & utilities

Defense & government

Education

Media / broadcast

Retail / point-of-sale

Transport & logistics

Local AI, no cloud required

Security

Internal architecture

daedalus-core

daedalus-stub

daedalus-cli

CLI -- all commands

An open-source tool for edge computing, IoT, offline-first, and low-connectivity environments.

Docs.

Get Started

Foundations

Guides

Languages & runtimes

More runtimes

Workflows

AI & emerging

Manuals

Build & package

Runtime & isolation

Updates & versions

Reference

Formats

Tooling

Security

Start here.

DAEDALUS BLOG

Why SISR beats full-binary updates on 960kbps links

Ed25519 attestation for IoT fleets: a practical guide

Introducing daedalus attestation: signed provenance for every .de

Why I build Daedalus? The story behind the name and the tool

The daedalus platform.

Build & package

Distribute & verify

No Docker.
No cloud runtime.

[stub][payload]
[metadata][footer]

Cache warm.
Cold path.