The operating system for physical AI.

No. Your autonomy stack, ROS 2 nodes, drivers, operator console and data pipeline stay yours and run unchanged inside your container image. Admiral owns the layer below that image: the kernel, the A/B update slots, device identity, remote access and the fleet console.

Very little. AdmiralOS is a minimal immutable image with no general-purpose distribution and no container daemon under your workload, so on a Jetson Orin it leaves most of the RAM and all of the GPU to your stack. Kernel modules are compiled in and the full device tree is passed through, so cameras, CAN, serial and CUDA behave as they did on bare Ubuntu.

Your workload is a standard OCI image built from your Dockerfile and stored in your own registry. It runs on plain Docker on any Linux machine today, and it still runs the day you stop paying us. Leaving is one command: admrl device exit, in early access, stages any disk image you choose at the tail of the disk, reboots into memory and writes it over the whole disk, for one robot or a whole fleet. A USB reflash works on every device today. What boots afterwards under Secure Boot is on the leaving-admiral page.

No. Put one spare robot on Admiral and run it beside the fleet you have. Nothing changes for the machines you have not flashed. Move the rest when the spare has earned it, or never.

You can build it, the same way you could run OpenFaaS on raw EC2 instead of using Cloudflare Workers. Almost every team starts on the silicon vendor's image, discovers it has not been patched in six months or six years, tries to move to mainline, and discovers the NPU, ISP, cameras or power management depend on out-of-tree vendor patches. Doing that bring-up, A/B rollback, hostile-site lockdown and weekly CVE patching takes about a senior engineer for a year on the first board and keeps taxing the roadmap at scale. The engineer-month bill is on the build-versus-buy page.

A machine in a customer's building sits where strangers can touch it, plug a USB stick into it or pull its drive, and people do try. Keeping a field Linux box locked down against physical access while kernels release weekly and CVEs land daily is a full-time job; Admiral is built for that and for the enterprise security review that checks it. Every device connection uses hybrid X25519 + ML-KEM-768 post-quantum key exchange over TLS 1.3 by default. The root filesystem is read-only and verified on every boot by a dm-verity Merkle tree, disk encryption is sealed to the TPM against Secure Boot state, each device has its own hardware identity with short-lived rotated credentials, and every system binary is compiled from source with no distribution packages. The full posture, including the security-questionnaire support, is on the security page.

Launch is US$500 a month for up to 10 devices, Growth is US$1,500 for up to 100, and Scale is US$2,500 for up to 250, each with kernel and CVE patching, A/B updates, remote access and every supported board included. Past 250 you keep the Scale base and pay a falling per-device rate down to US$1. Logs, bandwidth, registry fallback, AirDetect and AdmiralAI are usage-based on top. The first five devices on any account stay free for building.