Baryon Systems is a desktop application that hosts a growing line of independent security products. Today it ships two: Gluon, the eBPF host-defence stack, and Tachyon, the runaway-process autopilot. More products in the same shell are in private beta.
— early users on the public preview
MIT core · Windows desktop · Linux ≥ 5.10 servers · zero vendor accounts
Baryon Systems is the shell. The products inside are independent of each other — different problems, different audiences, separate licenses. Pick the one you need.
eBPF firewall, hardware-bound identity, hash-chained WORM audit ledger, private Postgres tied to your tunnel, and a chat panel where kernel events become messages. Three independent layers, one console.
For the 3 a.m. pages where one Python script forks 40,000 times or a customer’s ML job saturates a shared box. Tachyon throttles the offender by itself, sub-second, so on-call wakes up to a logged incident instead of a fire.
Query encrypted customer datasets inside TEEs without ever decrypting them in userspace. SQL-shaped, attestation-first.
mTLS-everywhere fronting, per-partner attestation, policy as code. Drop-in between your edge and your services.
GDPR, BSI C5, ISO 27001 evidence collection. Pulls from whichever Baryon products you run; never their dependency.
This is Gluon’s internal architecture — nothing about Tachyon or any other Baryon product. Five layers that verify each other, shipped together.
Real C source, compiled by clang on your server, attached via ip link set xdp. SSH whitelist baked into the generator — you can't lock yourself out.
Per-host HMAC-SHA256 challenge-response and full systemd-sandbox snapshots. Pinned fingerprint on first pair.
Layer 2 docs →Append-only JSONL. Every line's hash is prev on the next. verify() walks the chain and reports the first break.
Vanilla postgres:16 + PostgREST + Realtime in Docker, bound to 127.0.0.1, reached only through SSH.
Realtime + LISTEN/NOTIFY channels. Kernel firewall events post into #kernel-alerts automatically.
2FA enrolment with QR + manual secret, ±1-step skew window, full owner / member / guest role gating.
Trust model →Install Baryon Systems on your Windows desktop. Sign in. Open the Products panel. Each product runs on its own — different installer flow, different Linux footprint, different audit trail.
install.sh — creates the gluon user,
installs clang + kernel headers, starts
gluon-agent.service.ip link set xdp attaches it to the NIC.# On your laptop: $ BaryonSystems # Sign-in panel → create account → Products panel opens. # Two tiles are unlocked today: Gluon and Tachyon. # Pick Gluon, pair a host: ssh root@vps.example.com bash install.sh # gluon-agent GLUON_INSTALL_OK # Pick Tachyon, pair the same (or a different) host: ssh root@host2 bash tachyon-install.sh # tachyon only TACHYON_INSTALL_OK
The same problems. Two very different deals. (This table compares Gluon, the host-defence product, against the SaaS stack most teams cobble together.)
Every Baryon Systems product is written so one engineer can read the whole thing in an afternoon. Plain Python, plain SQL, plain Electron.