Switching

Bring your Windows apps, and your domain.

The reason people cannot leave Windows is rarely the operating system. It is one application they need, and one login their employer controls. We are building for both.

Both of these are in the image now. The compatibility layer is installed and opening a Windows program runs it. Domain join is installed and disabled until an administrator explicitly joins a domain, because trusting a directory server is the owner's decision rather than our default.

What we have not done is test either against a wide range of real software. The limits further down this page are real and permanent; beyond those, treat this as working but not yet proven across everything you might throw at it, and tell us what breaks.

Windows applications

Translated, not emulated.

Windows programs run through a compatibility layer that translates the calls they make into the Linux equivalents. There is no Windows virtual machine underneath and no Microsoft code involved.

No second licenceNothing of Windows is being run, so there is nothing extra to buy.
FastThe application's instructions run directly on your processor. Only the calls into the operating system are translated, which is why this is quicker than a virtual machine.
ConfinedA Windows program runs with a read-only view of the system, its own private temporary folder, one directory it can write to, and no network unless you grant it. It cannot see your documents, the assistant's memory, or any other program running on the machine. If confinement is unavailable, Orynr refuses to run the program rather than running it unprotected.
Not a virtual machineWorth being precise: this is process-level confinement, the same mechanism Flatpak uses. A flaw in the Linux kernel itself could escape it. What it stops is the ordinary case, which is a malicious program reading your files or phoning home, and that is the overwhelming majority of what goes wrong.
Consent appliesThe same gate governs it. A Windows application asking for something privileged raises the same card as anything else.

What will not work

Being straight about this matters more than the marketing does.

For those cases a Windows virtual machine remains the honest answer, and Orynr can host one.

Active Directory

Sign in with your work account.

Orynr joins an Active Directory domain using the standard, long-established Linux path rather than anything bespoke.

AuthenticationKerberos, the same protocol Windows itself uses.
IdentitySSSD, so domain users and groups exist on the machine as they do elsewhere.
File sharesSMB, so the drives people expect mount where they expect them.
For administratorsMachines appear in the directory and can be managed through the tooling already in place.
Off unless you switch it on, and never in the hardened profile Joining a domain means trusting a domain controller and running extra authentication services that face the network. That is an entirely reasonable trade for a managed company laptop and the wrong default for a personal machine, so the choice is yours to make rather than ours to make for you. The Fortress profile does not offer it at all: a machine built for maximum isolation should not be reaching out to a directory server.

The rest of the machine

Alongside these, Orynr runs the Linux application ecosystem, a full Chromium browser with Chrome and Edge extensions, and local AI. That covers a great deal of what most people actually do.