Embedded Linux runtime

Pantavisor is PID 1 — and it owns the whole device update.

Base, kernel, app containers, and config ship as one signed, content-addressed revision. No image updater bolted on top — this is the runtime.

Quick startor browse the reference docs

state.json

{

"#spec": "pantavisor-service-system@1",

"bsp/pantavisor": "1e6561f75c…",

"bsp/kernel.img": "990f8b0fca…",

"webserver/run.json": "153d58588b…",

"webserver/root.squashfs": "e1ddabe573…"

}

signed · rev 028

Documentation​

• Pantavisor runtime — the on-device init process, container orchestration, and OTA agent
• meta-pantavisor — the Yocto layer for building BSP images, including start guide, install guides, migration guides, and more
• PVR CLI — device state management tool

Architecture at a glance​

Pantavisor is PID 1 on the device — not an app or a service. It boots straight into a container-based runtime where the kernel, bootloader, firmware and every app are all just versioned entries in one manifest, state.json.

• Layer 0 — Hardware: SoC, storage, board.
• Layer 1 — Bootloader: verifies and boots Pantavisor.
• Pantavisor (PID 1): reads/writes state.json; owns the BSP container (kernel, bootloader assets, firmware — versioned like any other container) and every app container (LXC-first, ring-3 isolation, near-bare-metal speed, each updating independently). Built-in subsystems: watchdog, xconnect, ipam, local control.
• Pantahub (optional): cloud backend over the local network for fleet push, logs, and device claim. Not required — Pantavisor updates fully standalone.

Update & rollback flow: new revision (changed objects only) → written to pending slot → switch & boot → health check → pass: stays / fail: automatic rollback. Containers with restart_policy: container update with zero reboot at all.

For the full breakdown of each piece shown above, see the Technical Overview: architecture, BSP, containers, updates & rollback, watchdog, xconnect, IPAM, local control, and remote control via Pantahub.

Why Pantavisor over an image updater​

Image updaters (Mender, RAUC, SWUpdate) update the image: every change — even a one-line app fix — is a full-image event. Pantavisor versions the device as content-addressed objects, so a change ships only what actually changed.

A traditional image bakes everything into one monolithic rootfs. Pantavisor keeps every layer as its own versioned, independently-updatable piece: each app in its own container → BSP container (kernel, bootloader assets, firmware — versioned like any app) → Pantavisor (PID 1), driven by the state.json manifest of content-addressed objects → bootloader → hardware. A failed revision rolls back automatically, no bolted-on updater required.

See architecture, BSP, and updates & rollback for how each layer above is actually versioned and swapped.

• Lifecycle decoupling. Patch a small container layer, not a 200 MB rootfs. Update an app without touching the certified base; swap the BSP without rebuilding apps. See the benchmarks for the numbers.
• Trust at PID 1. Because Pantavisor owns init, its atomicity and rollback guarantees are held to a higher bar than a deletable updater — and we prove it with published power-fail and atomicity evidence.
• Git-like device state. The whole device — kernel, every container, and config — is one signed, inspectable, diffable revision.
• Recertification moat. Freeze and certify the base once; iterate apps in containers without re-touching the certified image. See security and compliance.

Already running Mender, RAUC, or SWUpdate? Pantavisor is a replacement, not something you layer on top — see migrating to Pantavisor for a side-by-side comparison and a path off your current updater.

Pantahub​

This site documents Pantavisor, the on-device runtime. Pantahub (also branded Pantacor Hub) is the cloud service devices can register with: it stores device state, delivers OTA updates as object diffs, and aggregates logs across a fleet — claim a device, push a new revision, and watch it roll out.

Pantahub is optional. Pantavisor updates a device fully standalone over the local network; Pantahub adds remote, fleet-scale operations on top when you need them. To manage devices remotely, sign up at hub.pantacor.com. For the REST API reference and a guide to running your own Pantahub server, see the Pantahub docs.