Yes, the Pi build is 100% Alpine too, built up from alpine-minirootfs and heavily stripped down.
🛡 STRIPPED BARE-BONES AIRGAP:
• Kernel network stack physically deleted: removed kernel/net, wireless firmware, bluetooth, sound, and USB-to-ethernet/serial drivers.
• Strace library whitelist: the builder traces exact .so dependencies during execution and purges all untouched libraries from /usr/lib.
• Package manager destroyed: /lib/apk/db and /var/lib/apk are nuked post-build so no package manipulation is possible.
• Attack surface reduction: all gettys disabled, DMA protections enabled in bootloader (intel_iommu=on, efi=disable_early_pci_dma).
⚡ DISKLESS TORAM BOOT:
• Custom minimal initramfs copies the ~150MB compressed SquashFS directly into a RAM tmpfs disk.
• Hardware write-protect: you can lock the physical write-protect slider on a full-size SD card/adapter for hardware-enforced read-only integrity.
• Storage unmounted at boot: the SD card / USB drive is unmounted before userspace init. You can physically pull the media once booted.
• Zero SD wear: the disk is never mounted writable during operation. Cold power-cycle wipes RAM instantly.
Repo with build scripts and release images:
https://github.com/bootlace-dev/subzero-keyosk Please review, audit, and comment. Thanks!