Genode

A framework for building systems where each component can only do what it was explicitly granted permission for, on a microkernel. Sculpt OS is the desktop system built from it, released two or three times a year.