Supported Operating Systems & Environments

StateWarden is engineered for mission-critical infrastructure. Our architecture rejects the lowest common denominator approach. Instead, we provide native, low-level agents compiled specifically for the platforms that power modern enterprise and edge environments.

We do not rely on fragile scripts or heavy runtimes. The StateWarden Agent (sw) is a statically linked Rust binary delivering Zero-Trust security, cryptographic immutability, and hardware-accelerated deduplication directly at the block level.

Below is the definitive matrix of operating systems fully supported by the StateWarden ecosystem for both Bare Metal Recovery (BMR) and Vulnerability/Patch Management (Vigil).

🛡️ Linux Ecosystem (Tier 1 Support)

StateWarden provides absolute dominance over the Linux landscape. Whether you are running legacy enterprise servers or modern edge containers, our agent integrates seamlessly with the native package managers and block storage subsystems (LVM, ext4, xfs, btrfs).

Supported Distributions & Package Managers

The Vigil Active Defense and Patch Management modules natively interface with the following environments:

• Debian & Ubuntu (LTS & Current)
  • Manager: apt / dpkg
  • Engine Logic: Secure deployment utilizing standard upgrade paths. StateWarden actively respects Canonical's "Phased Updates" rollouts to guarantee LTS system stability, ensuring packages are only deployed when cryptographically and architecturally safe.
• Red Hat Enterprise Linux (RHEL), Rocky Linux, AlmaLinux, CentOS, Fedora
  • Manager: dnf (and legacy yum for older CentOS 7 / SLES 12 environments)
  • Engine Logic: Native metadata caching and silent background evaluation.
• Arch Linux & Manjaro
  • Manager: pacman
  • Engine Logic: Rolling release mitigation with automatic database synchronization (-Sy) and non-interactive upgrades.
• openSUSE & SUSE Linux Enterprise Server (SLES)
  • Manager: zypper
  • Engine Logic: Intelligent parsing of list-updates and automated patch application.
• Alpine Linux
  • Manager: apk
  • Engine Logic: accurate for edge deployments and Docker hosts. Utilizes musl libc compatibility and cache-bypassing upgrades (--no-cache) for minimal footprint.

Immutable & Declarative Systems (Intentional Exclusion)

StateWarden does not provide active Patch Management for NixOS, Flatcar, or Fedora CoreOS.

The Architectural Mandate: We respect the fundamental principles of GitOps and declarative infrastructure. Forcing imperative updates (e.g., nixos-rebuild switch) via a centralized dashboard breaks the immutability promise of these systems. For such environments, StateWarden operates strictly in a Read-Only / Vulnerability Management capacity—detecting CVEs and providing cryptographic backups, but leaving the state mutability to your CI/CD pipelines.

🪟 Windows Server & Desktop

StateWarden delivers uncompromising kernel-level integration for the Windows NT ecosystem. We bypass the abstraction layers to interface directly with the NTFS Master File Table (MFT) and Volume Shadow Copy Service (VSS).

• Windows Server (2016, 2019, 2022, 2025)
• Windows 10 & Windows 11 (Pro, Enterprise)

Core Capabilities on Windows

• Native COM/WMI Integration: Active, asynchronous polling of the Win32_QuickFixEngineering subsystem for precise, real-time patch evaluation.
• Smart NTFS BMR: Automatic detection of EFI, MSR, and Recovery partitions, streaming them alongside the primary system drive (C:\) to guarantee an instantly bootable Bare Metal Recovery on fresh hardware.
• BitLocker Awareness: Native detection of Win32_EncryptableVolume states to ensure backups remain secure and accessible regardless of pre-boot authentication requirements.

Technical Constraints & Requirements

To achieve this level of integration, the StateWarden Agent requires the following conditions on the target host:

1. Architecture: x86_64 (AMD64) architecture is currently the primary supported target. (ARM64 support is in active development for edge mobility).
2. Privileges: root (Linux) or SYSTEM / Administrator (Windows) access is mandatory. The agent must interact directly with block devices (/dev/sda, \\.\PhysicalDrive0) to enforce Changed Block Tracking (CBT) and bare-metal captures.
3. Network Protocol: Outbound HTTPS (Port 443) to the Artemis Control Plane, secured via rigorous mTLS (Mutual TLS) certificate pinning. We do not support offline, air-gapped operations for the Control Plane.

StateWarden is not just a backup tool; it is an immune system for your infrastructure. Deploy the agent on any of the supported platforms above and instantly inherit enterprise-grade resilience.