frostyard / nsl

# nsl — WSL-style Linux machines on a Linux host
**Leave the host alone. Work in another distro.**
Keep your development tools separate from your Linux host. You may need somewhere to `apt install` a project's dependencies, try a toolchain packaged for another distro, or run a service. nsl gives you persistent Linux machines for that work, as WSL does on Windows. Each machine is a whole distro with its own packages and services. It opens in the directory you were in, works on your files, and stops when you stop using it.
Create your first machine walks through creation, a login shell, running a command and stopping the VM.
**Documentation: frostyard.github.io/nsl**
## What you get
- **Eleven signed machine images.** Debian 13, Ubuntu 26.04 LTS and 24.04 LTS, Fedora 44, CentOS Stream 10, Arch, openSUSE Tumbleweed and Leap 16.0, the Debian testing and Fedora Rawhide development branches, and the Azure Linux 4.0 beta, rebuilt weekly and verified against the Frostyard publishing workflow before use. Machine images →
- **Your files and your account.** Your home, removable media and `/mnt` appear at `/mnt/host`, and you have your own username, UID and GID with passwordless `sudo`. Host files →
- **Ports and windows on the host.** A server in a machine is reachable at the same port on host `127.0.0.1`, and Wayland applications open windows on your desktop. Ports → · Desktop applications →
- **Your editor.** `nsl ssh-config` gives VS Code or any SSH client a host alias for a machine. Editors over SSH →
- **Isolation when you need it.** `--isolated` puts a machine in a VM of its own, with no host files, desktop or host actions, for software you do not trust. Isolated machines →
- **Backups and moves.** Export a stopped machine to an archive, and import it later or on another host. Export and import →
- **A host left alone.** nsl runs as your user, with no daemon of its own. It installs no host packages and changes no device permissions, groups or sudoers.
## How it works
Machines are systemd-nspawn containers inside one small VM, launched with systemd-vmspawn and QEMU/KVM. The VM's root is replaceable and holds no user state; your machines live on its data disk. How nsl works →
An ordinary machine is trusted as you: it can read and write your home, including keys and tokens, just as WSL can. It cannot become root on the host or reach host sockets. Use `--isolated` for anything you would not run as yourself. Trust model →
## Is it for you?
nsl needs an x86-64 Linux host with KVM, systemd-vmspawn from systemd 259 or newer (as in Fedora 44 and Ubuntu 26.04 LTS), QEMU with UEFI firmware, virtiofsd and membership in the `kvm` group; Waypipe adds desktop windows. `nsl doctor` checks each requirement. Install →
It is **pre-release**. v0.4.0 was the first release of the current design; v0.3.0 and earlier are a retired prototype. The tested host is Snow Linux 13 with systemd 261.2, QEMU 10.0.13, virtiofsd 1.13.2 and GNOME Wayland. Windows are Wayland only, host fi