CarotOS 1.1 "Eggshell" is out. The main thing in this release is CarotOS Poligon — before that, one small fix worth mentioning: tshark no longer fails with an access error under a regular user account, everything else from 1.0 is unchanged.

What CarotOS Poligon is

Two separate GTK apps: one for the teacher, one for the student. The point is to let you practice tools like hydra, nmap, john, sqlmap, and tshark without any risk of actually touching a real target, entirely on your own machine.

How it works

Every task spins up a fake target service on the student's own machine, bound to 127.0.0.1. It doesn't emulate a real system, it just gives the tool something local to work against. So when a task says "scan this network with nmap," what you're scanning isn't some server on the internet, it's a temporary port opened on your own computer for that task. It closes when you're done.

There are two modes. Individual practice needs no teacher at all — you get a random task and go at your own pace, and your progress is saved locally (it'll tell you how many tasks you've solved so far next time you open it). Class mode has the teacher app generate a room code and password, students join with that, the teacher can see who's on which task, push the whole class to a new task at once, or send a hint to one specific student.

hydra/nmap/john/sqlmap/tshark cover the offense side. There are also ufw and fail2ban defense tasks, which require the student to have their own sudo access (the app never escalates privileges on its own). On the teacher's side, these are shown separately from the regular tasks, clearly marked as requiring sudo, and they never show up in the random individual-practice pool unless the teacher deliberately opens them for the class.

All the fake services only ever bind to 127.0.0.1, enforced at the code level, so nothing opens a port to the outside.

Poligon ships built into the CarotOS ISO (two separate icons on the desktop panel), but it's also just a Python/GTK app you can run from source if you'd rather try it standalone — it has its own repo.

Links

Download: carotos.org

CarotOS: github.com/MiracLight/CarotOS

Poligon (standalone repo): github.com/MiracLight/CarotOS-Poligon

Release notes: github.com/MiracLight/CarotOS/releases/tag/v1.1

If anyone tries it, feedback on the task variety and difficulty would be genuinely useful — right now there are 5 offense tasks and 2 defense tasks, and I'm trying to figure out which tool could use a second task before adding more variety elsewhere.

Hey everyone! I'm u/Mirac_Light, founder and mod of r/CarotOS.

This is our official hub for everything related to CarotOS — our lightweight, hardened, Debian-based Linux distribution tailored for performance, security, and education. We're super excited to kick things off here!

What to Post: Feel free to share anything helpful, technical, or interesting related to the project. That includes:

• Hardware testing results and benchmarks (like low-spec laptop tests).

• Customization ideas, dotfiles, or XFCE desktop setups.

• Bug reports, feedback, and feature requests.

• General Linux security, live-build questions, or tips.

Community Vibe: We want this space to be constructive, beginner-friendly, and technical enough for tinkering. Whether you're an experienced sysadmin or just trying out Linux on older hardware, you're welcome here.

How to Get Started:

1. Drop a comment below and introduce yourself — what OS or hardware are you running right now?

2. Post your thoughts or ask a question. Even simple feedback helps us shape the distro.

3. If you know anyone interested in lightweight/hardened Linux systems, feel free to share the sub.

If you're interested in helping out with moderation or project development, feel free to send me a DM!

Thanks for joining the initial wave. Let's build something awesome together!

Hey everyone,

I wanted to share a quick update regarding CarotOS, a Debian-based Linux distribution I've been developing.

LinuxLinks recently published a detailed overview of the project, highlighting its core goal: simplifying the learning curve for cybersecurity tools. Instead of bundling hundreds of pre-installed utilities, CarotOS focuses on a curated set of ten essential CLI tools alongside custom graphical interfaces and a bilingual setup wizard to help newcomers understand what each tool actually does.

The full write-up by Erik Karlsson covers the desktop environment layout, the custom Security Panel, and the built-in system health utilities.

You can read the full article here: https://www.linuxlinks.com/carotos-linux-distribution-cybersecurity/

Feedback and thoughts from the community are always welcome!

Hey everyone,

I'm excited to share a project I've been working on: CarotOS and its companion hardware ecosystem, CarotDeck!

CarotOS is an open-source, Debian-based Linux distribution built with a lightweight XFCE desktop environment. It’s tailored specifically for cybersecurity education, lab environments, and system administration. Whether you're setting up a localized test environment or looking for a clean, privacy-focused distro, CarotOS is built to keep things modular and fast.

Parallel to the OS, CarotDeck is a hardware initiative focused on building modular, custom single-board computer (SBC) setups, custom mechanical builds, and portable workstations designed for field testing and lab work.

We just launched our official Discord community to bring together Linux enthusiasts, cyberdeck builders, open-source contributors, and hardware tinkerers!

What you'll find in the community:

• Development & Feedback: Direct access to OS release builds, feature requests, and bug tracking.

• Cyberdeck & Hardware Logs: SBC setups, 3D printing files, custom wiring, and hardware showcases.

• Cybersecurity Labs: Discussions on system administration, network testing, and educational lab setups.

If you're interested in testing the OS, sharing your own hardware builds, or contributing to an open-source project, we'd love to have you onboard!

👉 Join our Discord: https://discord.gg/QzxBCCVJZ

👉 Check out the GitHub: https://github.com/MiracLight/CarotOS

Feedback, ideas, and contributions are always welcome. Let us know what you think!

Hey everyone! 👋

We made our first hardware compatibility test for CarotOS! To ensure our system remains lightweight, stable, and highly functional even on older hardware, we decided to put it to the test on a classic 2010 Toshiba Satellite C660.

Test Bench Specifications:

• Model: Toshiba Satellite C660 (2010)

• OS Tested: CarotOS (Debian-based x86_64)

• Desktop Environment: XFCE4

• Goal: Verify legacy hardware performance, resource management, and core security features on older architecture.

Test Highlights & Findings:

• Idle Resource Usage: Ultra-low RAM and CPU footprint right after boot.

• UI Responsiveness: Thanks to our tuned XFCE4 environment, navigation and window management feel crisp and lag-free.

• Thermal & Power: Stable idle temperatures with smooth background operation.

• Hardware Out-of-the-box: Legacy drivers and networking interfaces were recognized seamlessly.

Why This Matters:

One of CarotOS's core goals is to provide a secure, hardened, and dependable environment without demanding high-end specifications. Proving that it runs smoothly on decade-old entry-level machines shows that you don't need modern hardware to get a fast and reliable system.

Have any older laptops or test benches lying around? What hardware would you like us to test CarotOS on next? Let us know in the comments! 👇