What works on a filtered machine¶
KosherOS filters the whole computer, not one browser. This page says what that covers, in the words a release note or a support answer can point at. Where something is listed as supported, there is a test behind it in the repository; where a limit is stated, it is a real one.
Browsers and the web¶
| Software | On a filtered account | Notes |
|---|---|---|
| Firefox | supported | The filter's certificate is trusted through the enterprise-roots policy the image ships. |
| GNOME Web (Epiphany), Chromium and other browsers | supported | They read the system trust store, which holds the filter's certificate. |
| Any Flatpak app that fetches from the web | supported | Same system trust store; the app must be approved in the KosherOS Store first. |
| Sites behind a captive portal (hotel, airport Wi‑Fi) | supported | "Allow Wi‑Fi sign‑in" on the person's page opens a ten‑minute window; filtering resumes on its own. |
| Certificate pinning inside an app | not filtered, not broken | An app that pins its own certificate refuses the filter's; such traffic is blocked rather than passed through. |
Developer tools¶
In "Filtered internet" mode the machine reads HTTPS with its own
certificate authority. Tools that use the system trust store work as they
are; tools that carry their own certificate bundle are pointed at the
system bundle by environment the image sets for every account, in login
shells (/etc/profile.d/kosher-ca.sh) and in the desktop session
(/etc/environment.d/50-kosher-ca.conf). The registries they fetch from
are reachable from every account, including whitelist‑only ones.
| Tool | Made to work by | Registry reachable |
|---|---|---|
| npm, npx, yarn, pnpm | NODE_EXTRA_CA_CERTS |
registry.npmjs.org, registry.yarnpkg.com |
| bun | NODE_EXTRA_CA_CERTS |
bun.sh, registry.npmjs.org |
| pip | PIP_CERT, SSL_CERT_FILE |
pypi.org, files.pythonhosted.org |
| uv | UV_NATIVE_TLS=1, SSL_CERT_FILE |
astral.sh, pypi.org, GitHub releases (Python builds) |
Python requests, httpx, the ssl module |
REQUESTS_CA_BUNDLE, SSL_CERT_FILE |
whatever the program calls |
| gem, bundler | SSL_CERT_FILE |
rubygems.org |
| cargo, rustup | CARGO_HTTP_CAINFO, SSL_CERT_FILE |
crates.io, static.rust-lang.org |
| deno | DENO_TLS_CA_STORE=system |
deno.land, jsr.io |
| go | system store (no change needed) | proxy.golang.org, sum.golang.org, go.dev |
| git | system store; GIT_SSL_CAINFO for builds with a bundled OpenSSL |
github.com and its release hosts |
| curl, wget | system store (no change needed) | — |
| Java (Maven, Gradle) | not set automatically | Fedora extracts a Java keystore at /etc/pki/ca-trust/extracted/java/cacerts; JAVA_TOOL_OPTIONS was left out because it prints a line on every JVM start. |
The environment points at the system bundle
(/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem), which contains the KosherOS
authority once inspection is set up and is Fedora's ordinary bundle
otherwise, so it is harmless on an account that is not inspected.
Accounts and filtering¶
No presets ship. An account is in one of the family's own groups or in none; a group is saved from a tuned account and every account in it follows when the group changes. What an account gets by its kind of internet, before any group:
| Kind of internet | Web | Pictures | Language | YouTube | Apps |
|---|---|---|---|---|---|
| Filtered internet (the default for a new account) | adult, gambling, dating, social, video and more blocked | immodest hidden | replaced | strict; entertainment, gaming, music and Shorts blocked | chosen by the parent |
| Approved sites only | only an approved list of sites | none from the web | replaced | none | chosen by the parent |
| Basic protection | known bad sites blocked at DNS, safe search forced | shown | left alone | moderate | can install approved apps |
| No internet | nothing | none from the web | replaced | none | chosen by the parent |
| No filtering | open | shown | left alone | open | can install approved apps |
| The first administrator | adult, gambling, dating and filter bypasses blocked | shown | left alone | open | can install approved apps |
Approved-site lists. A Whitelist only account can switch on ready-made lists rather than typing domains: Torah study (Sefaria, YUTorah, TorahAnytime, the Daf Yomi sites, Chabad.org, HebrewBooks and more) and Email and files (Gmail, Outlook, OneDrive, Drive, Dropbox, Proton, iCloud). Both can be on at once, each brings the hosts those sites load from, and the family's own list is merged with them.
The guest account takes any of these by the kind of internet it gets, and is wiped at sign‑out. See content filtering and media filtering for what each layer does.
Time limits¶
| On a user account | Notes | |
|---|---|---|
| A daily limit ("2 hours a day") | supported | Counts active, signed‑in time; idle time is free. Kept across a restart; starts again at midnight. One‑click 30 min / 1 h / 2 h / 3 h / no limit, or any number of minutes. |
| Allowed hours, painted on a weekly calendar | supported | Presets: Always, After school, Not late at night, Weekdays only. Sign‑in outside the hours is refused at the login screen (pam_time). |
| Warnings before the time is up | supported | Desktop notifications at 15 and 5 minutes and when it ends; then the screen locks and the session is ended a minute later. |
| What the person sees | supported | My Filter shows their limit, what is left today and today's allowed hours. |
| Administrator accounts | never limited | A parent must always be able to sign in and change a setting. |
| The guest account | supported | Limited like any other account. |
Both settings are off until a parent sets them. See time limits.
Hardware¶
| Architecture | x86_64. |
| Firmware | UEFI and legacy BIOS; Secure Boot works out of the box through Fedora's signed shim. |
| Picture checking | About 50 ms per picture on a current laptop CPU, 200–300 ms on four cores, near the limit on two: the filter hides pictures instead of checking them when the machine cannot keep up, and says so. See media filtering. |
| The advanced (niri) desktop | needs a real GPU; it does not run in a VM without one. |
Updates¶
| Channel | Who | How it moves |
|---|---|---|
edge |
the maintainer's own machine | every push to the repository |
stable |
everyone else | a person promotes a version that has run well on edge |
A machine installed from a release ISO follows its channel automatically; if an update boots without the filter enforcing, it goes back to the previous version on its own. Admin → Updates shows both channels and moves the computer between them — the download happens straight away and the new version is used from the next restart, with accounts, settings and files untouched. Changing it asks for the guardian password when one is set. See deployment.