A backend programming language built in Europe.
European. Cloud‑native.
Verifiable all the way down.
The backend language where GDPR, DORA and NIS2 are compiler errors, not compliance theatre. Capability-secure core, reproducible builds gated per commit, zero US dependencies. 1,649 tests at 100% pass.
# Authority is explicit. Only main can mint it.
from std.cap_net import net_root, net_http_serve
from std.cap_ai import ai_root, ai_complete
from std.untrusted import untrusted_sanitize_html
fn summarise(ai: Cap<Ai>, doc: str) -> str:
out = ai_complete(ai, "mistral", doc)
# out is Untrusted<str>. To a sink raw: E0303.
return untrusted_sanitize_html(out)
fn main():
net = net_root()
ai = ai_root()
# No cap, no IO. That is E0404.
net_http_serve(net, 8080)Sovereignty has a stack.
We started where Europe can win.
Sovereignty is not a budget line. It is a build. A computer is a stack of layers, each inheriting the one beneath it. The real question was never "can Europe build everything?" It was: which layer can Europe own first, and is that enough to protect people?
At the bottom are the chips and the machines. Sovereign European silicon is real, necessary work, but it is a decade away, maybe two. The operating system sits on that hardware, bound so tightly it inherits whatever the hardware decides. You would expect that to be where you start. It is not. You cannot wait two decades for your data to be safe.
So we asked a different question: which layer can we own today? The language, the layer above the operating system, where the applications live. That is something we can build now, in the core, with the software written on top of it.
Take the network, where a cloud-native language lives. kern is built for the cloud: your software runs as services talking to other services and clients constantly, over networks and infrastructure you do not own. The cables and undersea fibre your data crosses are foreign-owned, and will be for a generation. But you do not need to own the wire if you own the encryption that rides over it. Encrypt before the data leaves the machine and it no longer matters whose network carries it.
That is the pattern everywhere. The language is where data is shaped, encrypted, and moved, so owning it means owning the security and privacy that reach the user. That is kern: not a promise to out-build the world's chip foundries, but the layer we can build today that walls off your data, so no foreign party, and no foreign nation, can follow your citizens, your patients, or your state.
We started at the language and kept going. The compiler self-hosts. The container engine runs real OCI images with no Docker beneath it. The hypervisor boots a Linux guest with a disk and a network card it emulates itself. The Bluetooth Mesh stack reaches the device in a patient's home. Every layer of that is written in Kern, and the part you have to take on trust is about 36,000 named lines of C with a written ledger. We wrote the stack, and you can check it. That is what sovereignty has to mean if it is going to mean anything.
What v1.0.0-rc3 actually means.
Twelve claims, each carrying its own status. Shipped is in the box today; gated means a CI job blocks the build if that property ever regresses.
Compliance is a type, not a checklist
GDPR, DORA, NIS2 and the EU AI Act are enforced at compile time and verified at runtime, mapped down to GDPR Art. 5 to 44, DORA Art. 5/9/10/11 and NIS2 Art. 21/23. Personal data reaching an LLM, a log or a database is a compile error.
1.0-grade, precisely labelled
It self-hosts, the full suite is green, the concurrency model is race-free and the build is reproducible byte-for-byte. The release-candidate label is deliberate: the headline goal, verifiable trust, is most of the way through its eleven-step roadmap.
Ten of eleven trust steps, gated
Deterministic IR, reproducible binary, independent bootstrap, diverse double-compilation and the verifiable supply chain are per-commit CI gates. Capability enforcement, lexer bisimulation and flow-analysis soundness are machine-checked in Rocq with zero admits. Open: model-to-compiler correspondence and independent external audit.
Capability-secure to the syscall
Every authority-bearing entry point requires an explicit Cap<T>, enforced by compile error E0404, down to the raw syscall intrinsic. A revocable capability cannot be stashed past its frame, so revocation gates the lifetime.
Whole categories fail to compile
SQL, shell, URL, regex and template injection are compile errors rather than runtime checks. So are secrets reaching a log (E0316), timing-unsafe secret comparison (E0317) and data races on shared globals (E0309).
Containers and VMs, self-contained
The container engine runs real OCI images with no docker, podman or runc. A hypervisor written in Kern boots a distro rootfs on KVM with multi-vCPU SMP, block-image volumes and a copy-on-write rootfs, running tenants one process each, every one gated by Cap<Vm> and bounded by seccomp, Landlock and cgroups.
Generics, async and channels
Generics by selective monomorphization. Async on cooperative kern routines with libuv-backed IO (spawn / await) and select over channels. Secure<T, State> IO governance, CapTP object-capabilities and kern-pkg, ported to Kern.
A toolchain a machine can drive
kern build --json, kern check --json and kern fix make the whole build path machine-readable. MCP tool arguments and results are typed Untrusted<str>, so feeding model output to a sink unvalidated is a compile error.
Faster every release, measured
The compiler self-bootstraps in about 14 seconds. Generational GC, zero-copy string splits, in-place list append, single-pass code emission and an HTTP thread pool with GC lock elision each landed with before/after numbers in the commit log.
Batteries genuinely included
414 modules and 4,280 public functions, no third-party packages required: TLS on every transport, PostgreSQL, gRPC and HTTP/2, OAuth2, SSE, Redis, OCI, SMTP, SIEM sinks, EU-sovereign cloud KMS, post-quantum ML-KEM, SPIFFE workload identity and a cloud control plane.
All the way down to the radio
A complete BLE Mesh stack written in pure Kern and verified on real hardware, with P-256 ECDH checked against OpenSSL and constant-time scalar multiplication. It adds no C at all, so the audited trusted computing base is unchanged.
One binary, nothing to install beside it
kern new api scaffolds a working HTTP service that compiles to a native binary of about 115 KB and answers curl immediately. Six cross-compilation targets, CycloneDX and SPDX SBOMs, and every binary records which compiler built it.
Compliance, cloud, AI. One compile.
Compliance is a type system problem. Infrastructure is a sovereignty problem. AI is a privacy problem. kern solves all three at compile time.
No US dependency.
Not today. Not in 2040.
Not a pledge to build European infrastructure one day. Every byte of kern's supply chain is European today. No CLOUD Act exposure. No executive order risk. GDPR is enforced at compile time. std.compliance maps every operation (collect, store, transfer, delete, encrypt) to its specific GDPR Art. 5–44, DORA Art. 5/9/10/11, and NIS2 Art. 21/23 obligation, auditor-readable. net.tls classifies cipher suites against BSI TR-02102-2. PersonalData<T> can't reach analytics, logs, or AI without consent. user.forget() implements Article 17 directly.
- Compile-time GDPR, DORA, NIS2 & EU CRA enforcement
- Zero CLOUD Act / US jurisdiction exposure
- Secure<T> — graduated protection with mlock & zero-on-drop
- Built for public sector, defense & critical infrastructure
Easier than Rust.
Deploys like Go.
kern sits in the sweet spot: Python's readability, Go's deployment model, Rust's safety guarantees, and more opinionated than all three on security and privacy. gRPC with real protobuf, HTTP/2 via nghttp2, SSH, NATS, S3 — all in the stdlib. Green threads at 100K concurrent routines. Static binaries under a millisecond cold start.
- gRPC, HTTP/2, SSH, NATS, S3 in stdlib
- OAuth2, migrations, cron, Prometheus metrics
- Sub-millisecond cold starts, static binaries
- TLS via mbedTLS, PostgreSQL, JWT in stdlib
AI that cannot leak.
Because it will not compile.
PersonalData<T> reaching any LLM call is a compile error (E0302), and the taint follows it across assignments, struct fields and string interpolation. Model output comes back Untrusted<str>, so feeding a reply into SQL, a shell or a file without validating it is E0303: prompt injection stops at the type system. Underneath sits a multi-provider proxy (Claude, OpenAI, Mistral, Ollama), an MCP server and client held to the same rule, a Qdrant client for RAG, and EU AI Act audit logging that is automatic and cannot be switched off.
- Claude, OpenAI, Mistral, Ollama in the stdlib
- Qdrant vector DB & RAG pipelines built in
- PersonalData taint propagation — PII to LLM = compile error
- Keyed HMAC-SHA256 audit logs & EU AI Act compliance
Designed after the requirements existed.
Go, Rust, Python, and Node are governed by US corporations or foundations. They were designed before GDPR fines exceeded €4 billion, before the EU AI Act, before NIS2 made supply chain sovereignty a legal obligation. They bolt compliance on. kern compiles it in.
| Feature | Python | Go | Node.js | Rust | Kern |
|---|---|---|---|---|---|
| Readable syntax | Yes | Verbose | JS baggage | Complex | Yes |
| Single binary | No | Yes | No | Yes | Yes |
| Native async | Bolted on | Goroutines | Yes | Complex | Yes |
| Null safety | No | No | No | Yes | Yes |
| GDPR built in | No | No | No | No | Yes |
| AI native stdlib | No | No | No | No | Yes |
| Container native | No | No | No | No | Yes |
| AI agent framework | No | No | No | No | Yes |
| WASM target | No | Limited | No | Yes | Yes |
| European governed | No | No | No | No | Yes |
| Error handling | Exceptions | Values | Exceptions | Values | Values |
| Learning curve | Low | Medium | Medium | Very high | Low |
Best of Go, Rust, Python.
None of the baggage.
Type-Safe by Default
The type checker runs on every build. Traits carry Rust-model static vtables alongside dynamic dispatch, and Secure<T> zeroes on drop, mlocks confidential data and blocks plaintext logging, so a secret cannot reach a log by accident.
Traits & Algebraic Types
Trait definitions with impl blocks and static vtables for dynamic dispatch, plus nine standard traits (Display, Debug, Eq, Hash, Ord, Clone, Default, Serialize, Deserialize). Result<T> and Option<T> are first-class unions with match guards and range patterns.
Concurrent Async Runtime
spawn and await on cooperative kern routines with guard-paged stacks, while spawn_thread routes CPU-bound work onto the libuv pool. IO is routine-aware, so await parks the routine and never an OS thread. select multiplexes over channels.
Fully Bootstrapped Compiler
All 13 compiler source files self-host: 51,903 lines of Kern, through LLVM. Generics by selective monomorphization on stdlib hot paths with @monomorphize opt-in for user code, module visibility, auto-derive, DWARF debug info and “did you mean?” suggestions.
Integrated Toolchain
A 15-feature LSP with go-to-definition, references, rename, semantic tokens and inlay hints. Five libFuzzer targets plus a structure-aware parser fuzzer, and ASAN, UBSAN and TSAN wired into CI. kern doctor diagnoses a broken toolchain in one command.
Pipe-First & String Interpolation
Data flows left to right, readable like Python. "Hello ${name}" interpolation now accepts any expression rather than bare identifiers, and int() / float() conversions plus default field values keep code concise without costing clarity.
Expressive by nature.
kern's syntax reads as easily as it's written. See for yourself.
# In Python, this compiles and ships:
# analytics.track(user.email) -- GDPR violation
# send_to_ml(user.email) -- GDPR violation
# In Kern, it's a compile error:
fn send_email(user: User):
analytics.track(user.email.value)
# ERROR E0302: PersonalData<str> cannot reach a
# sink that does not declare PersonalData
# The only way to use personal data:
fn send_email_safe(user: User):
email = user.email.access(
reason: "send welcome email",
consent: user.consent_record
)
analytics.track_event("signup") # OK
send(email, "Welcome!") # OKGDPR enforced by the compiler
No other language enforces GDPR at the type system level. PersonalData<T> cannot be passed to analytics, logging, or AI models without explicit consent and a documented reason. Violations are compile errors, not fines.
- PersonalData<T> tracks consent at the type level
- Every access is logged with reason and consent
- Passing PII to AI models is a compile error
- user.forget() implements GDPR Article 17
import net.http
import std.cloud.health
import std.cloud.telemetry
# A cloud-native HTTP service in 15 lines
async fn handle_user(req: http.Request) -> http.Response:
id = req.params.get("id")?
user = await db.find_user(id)?
return http.ok(user)
fn main():
server = http.Server(port: 8080)
server.get("/users/:id", handle_user)
server.with(telemetry.middleware())
server.with(health.check("/healthz"))
server.listen()Cloud-native by default
Health checks, structured logging, and distributed tracing are part of the standard library — not afterthoughts bolted on via third-party packages.
- Built-in OpenTelemetry tracing
- Kubernetes-ready health probes
- Pipe-friendly middleware composition
from std.cap_ai import ai_root, ai_complete
from std.untrusted import untrusted_validate_length
# Model output is Untrusted<str> at the source.
# EU AI Act audit logging is automatic.
fn answer(ai: Cap<Ai>, question: str) -> Result<str>:
reply = ai_complete(ai, "mistral", question)
# Straight to a sink would be E0303.
return untrusted_validate_length(reply, 1, 4000)
fn main():
ai = ai_root() # only main mints it
print(answer(ai, "How do I deploy?"))Multi-provider LLM with audit trail
Anything a model returns is Untrusted<str> at the source, so feeding a reply into SQL, a shell or a file without validating it is a compile error, and prompt injection stops at the type system. Personal data reaching an LLM is rejected the same way. Claude, OpenAI, Mistral and Ollama sit behind one proxy, with Qdrant for RAG.
- Claude, OpenAI, Mistral, Ollama in stdlib
- Qdrant vector DB & RAG pipelines
- PersonalData taint propagation
- Keyed HMAC-SHA256 audit logs & EU AI Act compliance
from std.cap_container import container_root,
cc_pull, cc_run, cc_wait_ready, cc_logs, cc_stop
# Nothing on the host but this binary,
# a 5.15 kernel and libc.
fn main():
c = container_root() # only main mints it
cc_pull(c, "debian:bookworm-slim")
id = cc_run(c, "debian:bookworm-slim")
cc_wait_ready(c, id)
print(cc_logs(c, id))
cc_stop(c, id)
# A module without Cap<Container> cannot
# start a container at all: E0404.Real OCI images, no Docker underneath
The container engine is compiled into the language. It pulls and runs real images using namespaces, cgroup v2, overlayfs and pivot_root, with hand-rolled netlink for networking, so there is no docker, podman, runc, skopeo or iptables on the host to install, patch or trust.
- Pulls and runs
debianandalpineimages directly - Signature verification and digest pinning on pull
- Rootless mode, with published ports and compose service DNS
kern audit-dockerproves a build takes no Docker dependency
from std.cap_process import process_root
from std.cap_fs import fs_root
from sys.microvm_orchestrate import vm_spawn,
vm_publish_port, vm_stats, vm_wait, vm_audit_verify
fn main():
p = process_root()
fs = fs_root()
# One OS process per tenant, each with its own
# cgroup, Landlock scope and seccomp jailer.
t = vm_spawn(p, fs, "vm_runner", [], "tenant-a",
512 * 1024 * 1024, 100, 128,
"/var/log/vm.audit")
vm_publish_port(p, "172.16.0.2", 8080, 80)
print(vm_stats(fs, t))
vm_wait(p, fs, t, "/var/log/vm.audit")
vm_audit_verify("/var/log/vm.audit")A hypervisor you can read
The monitor is written in Kern rather than borrowed, so the multi-tenant isolation boundary is auditable in one language. It boots an unmodified Linux kernel on KVM from a distro rootfs, with a virtio-blk disk and a virtio-net NIC it emulates itself.
- Authority split by capability: only the runner mints
Cap<Vm> - Every guest address proven inside guest RAM before use
- Minting
Cap<Vm>derives a seccomp filter for the VM host - Created, booted, stopped and reaped all land in a hash-chained audit log
1.0-grade implementation.
Independently verifiable.
A real backend toolbox.
Not a language demo.
Backends need TLS, a database, an auth scheme, metrics, compliance evidence and a way to ship, not a roadmap promising them. kern's standard library carries all of it, with no third-party packages and no US-hosted service in the path. Here is what landed most recently, and then the shelf itself.
The implementation is 1.0-grade: self-hosting, 1,649 tests at 100% pass, race-free (ThreadSanitizer-verified, ASan/UBSan-gated), reproducible byte-for-byte. The RC label is deliberate: ten of eleven trust-roadmap steps are done and gated.
- Deterministic IR, reproducible binary, independent bootstrap and diverse double-compilation are all per-commit CI gates
- Capability enforcement, lexer bisimulation and flow-analysis soundness machine-checked in Rocq with zero admits
- Supply chain closed 2026-09-02: fail-closed signature verification, pinned publisher keys
- The installer builds from source: no prebuilt binary to download, no trust placed in an artefact we shipped
- Still open: model-to-compiler correspondence (proofs cover the rules, not the compiler that implements them) and independent external audit
PersonalData<T>to any sink (AI, log, database, HTTP, display) is a compile error
rc3 closes every finding from the rc2 security scan (H-1 through H-9, M-1 through M-15) and adds three CI gates that did not exist: AddressSanitizer, UndefinedBehaviorSanitizer and ThreadSanitizer.
- Installer builds from source: no prebuilt binary, the adopter's own clang compiles the seed IR, and the trust gates run on their machine
- Container host sealed (H-1): seccomp filters compose monotonically, so the host seal installs on top of the workload seal
- Handle lifetime (H-3/H-5): Channel, Mutex, RwLock and thread-pool handles are now GC objects with trace and destroy hooks. 163 MB retained after 500K channels, now 22 MB flat
chan_selectrace (H-4): two selectors woken by one send both returned the same index; one took the value, the other hung. Reservation protocol settles itpd_anonymizedeleted (M-3): returned the first byte plus asterisks, not anonymisation.pseudonymise(key, data)is the named primitive- Fuzzer found an OOB write in the GC collector on its first real run (the harnesses had been running a unit test)
Four threads of work in one week: isolation, confinement, performance, hardening.
- Multi-vCPU SMP for microVM guests: Intel MP table, per-vCPU CPUID topology, block-image volumes, copy-on-write rootfs, ext4 image writer in pure Kern
- Scoped
Cap<Fs>: confine a filesystem capability to one directory viaopenat, device+inode pinning, nested scopes - Performance: HTTP thread pool, GC lock elision, in-place list append, zero-copy
str.split, bootstrap 35s to 14s. (The generational GC nursery shipped in this wave but was later found to lose reachable objects; it is now refused.) - Fail-closed sweep: every "succeed on error" C leaf in HTTP, TLS, KMS, Redis, MQTT, WebSocket converted; W0003 SSRF lint added
Four modules turn kern from a language you deploy onto a cloud into one you build a cloud out of. Every core is pure and deterministic: unit-testable without a socket, disk or running fleet.
net.s3_server: answers the S3 API with traversal-safe bucket and key validationnet.lb: round-robin, least-connections and weighted strategies; all-down fails fastsys.volume: block-volume state machine (at-most-one attach, snapshot protection)sys.fleet: self-healing reconciliation, desired vs observed state to ordered actions
The monitor is written from scratch in Kern rather than orchestrating Firecracker, because a sovereignty boundary that is someone else's binary is where sovereignty stops.
Cap<Vm>gates all KVM access; ambient calls are compile error E0404- Boots an unmodified Ubuntu kernel with virtio-blk ext4 disk, virtio-net NIC, nftables port publishing
- One OS process per tenant (the Firecracker/Fly.io boundary) with cgroup, Landlock and seccomp
- Every lifecycle transition in the SHA-256-chained audit log;
microvm_audit_verifychecks independently - Hardening: guest RAM bounds checks, DMA size gating,
killrejects pid ≤ 0
A doc-versus-code audit surfaced one critical bug and narrowed a batch of overclaimed guarantees. Findings are named, not hidden.
- WebAuthn verified challenges but never checked the signature: total auth bypass. Now fail-closed pending a binary-safe verifier
pseudonymisewas an unkeyed hash (dictionary-reversible): now keyed HMAC-SHA256 with domain separation- Event-log chain was documented as BLAKE2b but uses HMAC-SHA256; corrected everywhere
- Six more claims narrowed:
cert_is_self_signed, mTLS version enforcement, SIEM tamper-evidence, SSRF control, nonce tracking, SQL error code inllms.txt
A parallel bug hunt found nine expression positions where the typechecker never called check_expr. The most critical: a while condition bypassed the entire type and security model, so while db_query(...) compiled without Cap<Db> and while personal_data leaked without consent. Eight more positions followed (default parameters, struct and union field defaults, assignment target indices, spawn lambda bodies, match patterns). All are now enforced, and make check-enforcement-positions gates 26 expression positions per commit. Alongside the fixes, three trust-critical properties became machine-checked in Rocq with zero admits: capability enforcement (every ambient authority in the model is a provable error), lexer bisimulation (both directions, including the comment token class), and flow-analysis soundness (tainted data reaching a sink is provably detected). All three re-check per commit. The honest open item: these proofs cover the rules, and nothing yet proves the compiler implements them. The correspondence grid is empirical evidence, not a formal link.
Two capabilities that move kern from language to platform. Cloud control plane. A multi-tenant platform with HA standby failover, SSO/OIDC authentication, org-scoped tenants, WAF policies, an S3-compatible object store, load balancers, cordon/drain/fence operations, metered usage derived from the tamper-evident audit chain, scheduled workloads, capacity admission, and a typed client behind kern cloud. Every core is pure and deterministic, unit-testable without a socket or a running fleet. VM device passthrough. VFIO device passthrough held behind an IOMMU, with a guest PCI bus, interrupt emulation proven in two halves, and virtio-rng so a guest's CRNG is seeded by the VMM and not by a CPU feature. Live migration: snapshot and restore an SMP guest (all vCPU register state, dirty memory, device state), transport it, resume. Five adversarial security criticals from the rc2 scan were closed in the same wave.
TLS & HTTPS
HTTPS without a reverse proxy in front of it. serve_tls_managed serves from managed cert and key files and hot-reloads them after a renewal, with an ACME v2 client in net.acme. Every transport rides one TLS 1.2/1.3 floor with forward secrecy pinned on.
PostgreSQL
Talk to Postgres directly instead of bridging through a Python service. Real libpq connections, parameterised queries, transaction batches, LISTEN/NOTIFY, and a pool that publishes its own saturation. Your SQL is checked against your schema before it ever runs.
JWT & libsodium crypto
The primitives Signal uses, in the standard library: Argon2, ChaCha20-Poly1305, Ed25519, X25519 and BLAKE2b through libsodium, plus HS256 JWT and base64url. Post-quantum ML-KEM sits alongside them, for when that timeline stops being theoretical.
Prometheus metrics
Counters, gauges and histograms in OpenMetrics, scrape-ready from any kern server with a single import. The database pool publishes its own size, in-use, idle and waiting gauges, so saturation shows up on a dashboard instead of in a postmortem.
gRPC & HTTP/2
Real gRPC over the protobuf wire format, verified against grpcbin, with an HTTP/2 client on nghttp2. SSH, NATS and S3 with AWS Sig V4 sit beside it. Service-to-service work needs no third-party package.
Ed25519 signed releases
Every release binary is signed with Ed25519, ed25519_sign and ed25519_verify are in the stdlib so you can sign your own artifacts, and kern-pkg verify now fails closed against a publisher key you pin yourself.
Kern routines (green threads)
100,000 concurrent routines in 133 ms, on assembly context switching with guard pages and stack pools. Lighter than goroutines, safer than raw threads, and select multiplexes over channels the way you would expect it to.
OAuth2, migrations & cron
OAuth2 flows, database migrations, background jobs, cron and a query builder with pagination, all in the standard library. The unglamorous half of a backend, without assembling it from five separate dependencies.
Keyed HMAC audit log & DORA/NIS2
An append-only HMAC-SHA256 chain, keyed to the machine so a log writer cannot re-forge its own history, with an exclusive lock per append and full re-verification on open. This is the artifact a DORA Art. 17 or NIS2 Art. 23 examiner asks to see.
CycloneDX SBOM & EU CRA
kern sbom emits CycloneDX 1.5 and SPDX 2.3 listing every runtime dependency, ready for a Cyber Resilience Act scanner. Four dependencies to declare, not four hundred, and a stack protector on every binary you ship.
Decimal, exact base-10
IEEE-754 floats are not acceptable for money, tax or regulatory reporting, so std.decimal gives you real base-10 arithmetic: six rounding modes, locale formatting for en, de, nl and fr, euro, dollar and pound currency, and JSON round-trip.
LLM & Qdrant resilience
A provider outage should not take your service down with it. Per-provider circuit breakers open after five consecutive failures and probe back gently, retries are bounded with exponential backoff and jitter, and every response is sanity-checked before you see it.
Event log durability
The log refuses to open at all if its chain has been tampered with. Every append takes an exclusive lock, fsync runs on an interval you choose, and the whole thing is multi-process and crash safe. Durability you can point an auditor at.
SSE production polish
Server-Sent Events that survive real networks. Heartbeat comment frames keep idle connections alive through reverse proxies, and event ids let a client reconnect with Last-Event-ID instead of silently losing its place.
net.tls passive audit
The German BSI's cipher-suite recommendations (TR-02102-2), codified in the standard library. Validate TLS versions, classify suites by forward secrecy and AEAD, produce a connection audit report, and enforce a strict policy when you have to prove one.
std.compliance article mapping
Every operation you perform, collect, store, process, transfer, delete, maps to the specific article it answers to: GDPR Art. 5 to 44, DORA Art. 5/9/10/11, NIS2 Art. 21/23. Consent validation, data classification and adequacy checks come with it.
kern-pkg, written in Kern
The package manager is Kern now, not a Python shim: init, build, run, test, add, remove, verify, install, publish, search, update. Lockfiles carry a fail-closed integrity chain, and a dependency that escalates past its declared capabilities is refused.
EU-sovereign cloud KMS
Your keys stay in Europe. Secure<T, State> routes to Scaleway (fr-par, nl-ams) or Azure Key Vault by environment variable, with local AES-256-GCM as the default, and the compiler rejects a plaintext secret reaching an IO sink.
Self-contained container engine
Pull and run real OCI images with nothing on the host but the kern binary, a 5.15 kernel and libc. No docker, podman, runc, skopeo, iptables or iproute2. Namespaces, cgroup v2, overlayfs and hand-rolled netlink do the work themselves.
Thirteen capability modules
Thirteen modules cover the authority a backend actually needs: cap_net, cap_fs, cap_db, cap_process, cap_ai, cap_container, cap_container_ro, cap_vm, cap_kms, cap_config, cap_random, cap_time and cap_unsafe. Only your entry module mints one.
CapTP, capabilities across the network
Capability security that survives the network boundary. Seven modules cover the codec, transports, framing, promise pipelining, vat state and Ed25519-signed gift tokens, so authority can be handed to another process without ever becoming ambient.
Hypervisor and microVMs
Boot Linux from your own code. On macOS a guest runs on Apple's Virtualization.framework; on Linux a microVM monitor written in Kern drives KVM directly with multi-vCPU SMP, block-image volumes, a copy-on-write rootfs and one OS process per tenant.
Chain-hashed AI audit log
Every AI Act record links to the one before it by hash, and the verifier replays the file on open and refuses new appends if a single link fails. Proving what your model was asked, and what it answered, stops being a spreadsheet exercise.
Generics without the code-size tax
Hot stdlib paths (List<T>, Map<K,V>, Result<T>, Option<T>, Decimal) emit monomorphized accessors that compilation units share without link conflicts, and @monomorphize opts your own types in.
Async that parks routines, not threads
spawn, await and spawn_thread on cooperative routines with 16 KB guard-paged stacks. Awaiting parks the routine and never an OS thread, so libuv-backed file, DNS and TCP work keeps the pool free for everyone else.
Fuzzed before it reaches you
Five mutators run structure-aware fuzzing over the conformance corpus, next to five libFuzzer targets and ASAN, UBSAN and TSAN in CI. You inherit the result: a compiler that has been actively attacked before it ever touches your code.
Nothing waits forever
Socket timeouts on the LLM and vector paths, readiness and liveness probes, WebSocket reconnect with backoff, and a total request deadline plus a connection admission cap on the HTTP server, so one slow peer cannot pile up behind your service.
Fastest where a backend lives.
Honest about the rest.
Five backend workloads, same algorithm and same data sizes on every side, using only each language's standard library. No JIT pre-warming, no micro-tuning, Go as a native binary. kern is faster than Go on Fibonacci, JSON encoding and sorting, and level with it on file I/O. It loses on hashing (Go links hardware-accelerated SHA-256; kern uses libsodium's portable implementation). The loss is stated below rather than framed away. Methodology and the runner are in the repo.
| Workload | kern | vs Go | vs Node.js | vs Python |
|---|---|---|---|---|
| File I/O 10k write+read cycles | 723 ms | on par | 1.3× faster | 1.3× faster |
| Fibonacci recursive, n=35 | 29 ms | 1.2× faster | startup-bounded | 32× faster |
| JSON encode 100k iterations | 40 ms | 1.5× faster | startup-bounded | 5.5× faster |
| Sort 1M pseudo-random integers | 44 ms | 1.4× faster | 11× faster | 5.5× faster |
| Hash 1M iterations, SHA-256 on every side | 302 ms | 1.4× slower | 5.7× faster | 2.0× faster |
~9,000 requests/second sustained at 100-way concurrency, with zero failures across 50,000 requests (measured with ab). Backed by libuv, the same event loop that powers Node.js.
Median of five runs (first discarded) on the project reference box (Ubuntu 24.04, x86-64, i9-10900K) with CI paused, wall-clock milliseconds, release builds. Go 1.24, Node 22, Python 3.12. All rows are single-process, single-core. Run-to-run spread is under 6% on every cell except the file I/O row (9 to 20%, kern the noisiest) and kern's Fibonacci (12%). That is why a 1.05× file I/O lead is called on par rather than a win; the Fibonacci lead stands, because kern's slowest run still beats Go's fastest. File I/O times sit higher than in earlier runs for every language alike, so compare ratios, not milliseconds, across runs. "Startup-bounded" means the workload ran in under 3× the language's startup floor, so it measures process start, not work. On the hash row: kern hashes with libsodium's portable software SHA-256, while Go links a hardware-accelerated implementation. Same algorithm, same input, different use of the silicon. kern's own default hash, BLAKE2b, runs the same workload faster. Hardware-accelerated SHA-256 sits on the hot path for JWT, TLS and every audit chain, and closing this gap is a named work item. Micro-benchmarks are not real workloads; these numbers are signals, not proof. The suite, method and fairness rules are in the repo. Last measured 2026-09-25.
Built from source, on your machine.
Install kern
$ curl -fsSL https://kern-lang.eu/install.sh | shScaffold a working service
$ kern new api my-service
Created api project: my-service
$ cd my-serviceRun it
$ kern build src/main.kern -o my-service && ./my-service
Binary written to my-service
Build complete.
my-service listening on http://localhost:8080
# in another shell
$ curl localhost:8080/health
{"status": "ok"}European infrastructure.
No US jurisdiction. Period.
Every component of kern's toolchain is hosted, governed, and operated in Europe. No CLOUD Act. No FISA 702. No executive order can compel access to your supply chain. None of this waits on a policy cycle, a funding round or anyone else's roadmap. It is built, it is running, and you can check every layer of it yourself.
| Component | Provider | Country |
|---|---|---|
| Source code | Codeberg | Germany |
| Package registry | pkg.kern-lang.eu (OVH/Scaleway) | France |
| CI/CD | Woodpecker | Germany |
| Domain & DNS | TransIP | Netherlands |
| Static hosting | Codeberg Pages | Germany |
| Default cloud LLM | Mistral | France |
| Default vector DB | Qdrant | Germany |
| Default local LLM | Ollama | Open source |
Built for the institutions
that define Europe's future.
Kern is for
- EU institutions and member state agencies building sovereign digital infrastructure
- Critical infrastructure operators under NIS2 — energy, transport, health, water
- Central banks, financial market infrastructure, and DORA-regulated institutions
- Defense and intelligence services requiring sovereign, auditable tech stacks
- Enterprise teams deploying AI agents where PII leakage is a regulatory risk
Kern is not for
- Data scientists who need NumPy and pandas — use Python
- Systems programmers building operating systems — use Rust
- Teams with ten years of Go investment — switching has a cost
- Projects that need Windows support — kern targets Linux and macOS
Sovereign infrastructure
for the next decades.
If your institution needs software that no foreign jurisdiction can compel, surveil or shut down, that is not something to wait for. Sovereignty is not a budget line, it is a build, and this one runs today: a backend language where European independence is compiled in rather than promised, and verifiable rather than asserted.
Please Donate
kern is open source and community-funded. Your donation helps keep development independent and European.
3HcHaeq9gYrxxLqzbpBSuy3e6cGAw6GwZc
