Alibaba Cloud Linux 4 Agentic Edition (ANOLISA) is the first agent-first operating system designed for AI agents. It provides natural language interaction, structured skill manifests, and a four-layer defense-in-depth security architecture to optimize the efficiency and security of agent workloads. - Alibaba Cloud Linux

Alibaba Cloud Linux 4 Agentic Edition (ANOLISA) is an Agent-first operating system from Alibaba Cloud designed for AI Agents.

Image overview

ANOLISA is built on Alibaba Cloud Linux and fully compatible with Alinux4 capabilities (kernel optimizations, cloud-native support). It introduces an OS architecture centered on Agent cognitive and operational patterns.

Layer	Component	Description
Interaction Layer	Copilot Shell (cosh)	Replaces the default shell and supports dual-mode interaction with natural language and bash.
Interaction Layer	OS Skills	Built-in skill package mechanism. Agents use Skill manifests to perform deployment, O&M, diagnostics, and observability through the runtime and base system layers.
Runtime Layer	AgentSecCore	AgentSecCore is a security product built for AI Agents. It addresses core threats across the Agent lifecycle, including prompt injection, dynamic code execution, Skill security, intent deviation, and system environment risks through defense-in-depth mechanisms. Integrates non-intrusively with Agent frameworks such as Cosh and OPENCLAW.
	AgentSight	eBPF-based observability tool that monitors AI Agents in real time without code modifications, capturing LLM API calls, Token consumption, and process behavior.
	Tokenless	Token optimization component that compresses tool definitions and model responses to reduce LLM inference Token consumption without intruding on business logic.
	ws-ckpt	File-level snapshot and rollback tool for AI Agent workspaces. Supports manual snapshots before critical operations, auto-snapshots per conversation round, and one-click rollback to any historical state.
	Skill Optimizer	Intelligent Skill optimization engine using environment-aware loading and offline pre-compilation to reduce irrelevant Skill interference, improve task completion rates, and lower Token consumption.
Base System Layer	Alinux4	Fully compatible with all Alinux4 capabilities, including kernel optimizations and cloud-native support.

Applicability

Notes on the applicability of ANOLISA:

Compatible with various instance families, including elastic bare metal servers.
- Only the x86 CPU architecture is supported.
- Minimum recommended instance memory: 2 GB.
Supports mainstream Agent frameworks including OpenClaw, CoPaw, and Claude Code.

Billing

ANOLISA is a free operating system image. However, you will be charged for other resources that you use with the image, such as LLM calls, vCPUs, memory, storage, public bandwidth, and snapshots.

Key advantages

Optimized for Token economy
Encapsulates OS expertise into standardized Skills, reducing Token overhead from environment comprehension and trial-and-error. Achieves a zero-latency, closed-loop process from intent to execution.
Natural language interaction
cosh (Copilot Shell) replaces bash as the default shell. Use natural language to perform O&M tasks such as environment deployment and tool installation—no command-line syntax required.
Intrinsic security with end-to-end Skill encryption
Each Skill is digitally signed and encrypted. The system enforces identity authentication and integrity verification before invocation. Hardware-level sandboxing isolates abnormal behavior, ensuring from the OS kernel level up that Agents operate in a controlled, auditable, least-privilege environment.

Core components

ANOLISA includes four core components: Copilot Shell, AgentSecCore, AgentSight, and OS Skills, all open source at https://github.com/alibaba/anolisa.

Cosh (Copilot Shell)

Copilot Shell (cosh) is the default interactive shell in ANOLISA, replacing bash as the primary entry point after login.

cosh supports dual-mode interaction. In natural language mode, describe your intent in Chinese or English and the system translates it into executable operations via LLM. In command mode, use the ! prefix for shell commands or /bash for full interactive bash. Both modes mix freely.

Beyond full bash compatibility, cosh adds natural language understanding, Skill invocation, MCP tool integration, and multi-level approval controls. By integrating OS Skills manifests, cosh enables both human users and AI Agents to drive the OS through natural language.

OS Skills

OS Skills are operating system manuals within ANOLISA designed for AI Agents.

Traditional OS documentation targets humans with natural language descriptions and implicit knowledge, requiring many Tokens for Agents to parse. OS Skills manifests restructure this knowledge into a structured format called a SKILL that Agents can directly understand and execute—eliminating the "read then operate" overhead.

OS Skills manifests currently cover two domains:

Manifest domain	Knowledge area	Content
system-admin	System administration	Basic system administration tasks such as user and permission management, system service management, and kernel upgrades.
security	System security	System security baseline checks, vulnerability scanning, and remediation.
system-ops	System operations	Provides diagnostic capabilities for common performance and stability issues in Linux.

When an Agent receives a user's intent, it automatically matches and executes the corresponding Skill without manual path specification.

AgentSecCore

AgentSecCore is an OS-level security kernel for AI Agent runtimes. As Agents gain file I/O, network access, and process management capabilities, traditional application security boundaries are insufficient. AgentSecCore provides defense-in-depth at the OS level, ensuring Agents run in a controlled, auditable, least-privilege environment.

AgentSecCore builds a three-layer defense system around intent security and system-level containment. Even if one layer is breached, subsequent layers still provide protection. The architecture from bottom to top:

Layer	Protection capability	Technical implementation
Layer 1: Pre-execution boundary (Prevention)	Prompt Scanner Code Scanner Skill Ledger	Prompt injection and jailbreak detection engine (three progressive layers: rules + ML + AISearch) Pre-execution code security interceptor (28 detection rules, supporting Shell/Python) Skill integrity anti-tampering engine (snapshot signing + append-only version chain + four-stage security scanning)
Layer 2: Runtime awareness (Detection)	Security observability	Covers sandbox isolation, system hardening, and asset integrity domains. Persists structured security events and generates security summary reports on demand.
Layer 3: Low-level containment (Containment)	Security baseline inspection OS-level isolation and monitoring	Automated scanning with an OS-level security hardening rule library. Detects Agent-caused degradation of the system security posture and generates deviation reports with remediation recommendations. Leverages Linux kernel security primitives (Namespace/Cgroup/seccomp/Capability) to provide process-level sandbox isolation, system call monitoring and interception, and fine-grained permission control.

AgentSight

AgentSight is an OS-level observability component for AI Agent runtimes. It non-intrusively collects fine-grained data and performs correlation analysis across the Agent execution chain, helping trace unexpected Token consumption.

AgentSight provides three capabilities:

Token consumption analysis: Measures and attributes Token consumption during Agent execution. Query by time range or last N hours, with breakdowns by Agent, task, and role down to individual LLM calls.
Behavior audit: Records full-chain Agent LLM calls and process execution behavior. Retains call metadata (provider, model version) and process command-line arguments. Supports filtering by time, session, and other dimensions with visual statistics.
Dashboard visualization: Web-based interface accessible from a local browser after remote deployment. Provides real-time Token consumption trends, Agent process monitoring with anomaly restart, and drill-down into the complete Trace chain per Session (user input, prompts, reasoning, and per-step Token distribution).

ws-ckpt

ws-ckpt (AI Agent Workspace Checkpoint) is a file-level snapshot and rollback tool for Agent workspaces in ANOLISA.

AI Agents modify workspace files extensively during task execution, making recovery difficult when operations fail. ws-ckpt provides lightweight snapshot management: create snapshots manually before critical operations, enable auto-snapshots per conversation round, or restore to any historical state with one click.

ws-ckpt automatically initializes on first snapshot creation—no additional configuration required.

ws-ckpt capabilities:

Capability	Description
Manual snapshot	Users can manually create workspace snapshots through natural language or CLI before critical operations.
Auto snapshot	Users can enable the auto-snapshot switch that triggers at the end of each conversation round for file-intensive modification tasks (currently supports OpenClaw and Hermes).
One-click rollback	Supports rolling back to any historical snapshot to restore workspace files to their complete state at a specified point in time.
Snapshot management	Provides snapshot listing and deletion capabilities, with user-defined snapshot identifiers and descriptions.
Dual-mode interaction	Supports both natural language interaction (through Agent conversations) and CLI command operation modes.

Skill Optimizer

Skill Optimizer improves Agent Skill usage efficiency from both loading and execution dimensions.

Agents face two scaling challenges: loading the full Skill list introduces irrelevant context that increases Tokens and interferes with decisions; and different models vary in their execution of the same Skill. Skill Optimizer addresses both: intelligent filtering surfaces only relevant Skills, while pre-compilation adapts high-frequency Skills to target model profiles.

On the loading side, the system identifies the runtime environment and workspace type to present only relevant Skills. On the execution side, high-frequency community Skills are offline-compiled and pre-installed in the image for higher task completion rates.

Skill Optimizer capabilities:

Capability	Description
Intelligent filtering	Automatically filters and presents the most relevant Skill subset for the current task based on the runtime environment and workspace type, blocking irrelevant Skills.
Pre-compilation optimization	Includes multiple offline-compiled high-frequency Skill variants adapted to the capability profile of target models, improving execution success rates.
Transparent integration	Fully transparent to upstream Agent frameworks. No code modifications required. Enabled through configuration or conversation.

Tokenless

Tokenless reduces Token consumption in Agent-LLM interactions through context compression and command filtering.

As tasks grow complex, tool definition bloat, response redundancy, and command output noise fill the context window. Tokenless builds an optimization pipeline: streamlining tool definitions, filtering low-value response fields, applying compact encoding to structured data, and filtering command output noise—all without altering Agent behavioral semantics.

The optimization applies automatically through plugin and Hook mechanisms, fully transparent to Agent frameworks with no code modifications. All compression results are recorded for ROI assessment.

Tokenless capabilities:

Capability	Description
Context compression	Streamlines Function Calling tool definitions, filters noise from CLI command responses, and applies compact encoding to compress structured data.
Statistics tracking	Automatically records before-and-after compression comparisons and summarizes savings by type.
Transparent integration	Automatically applied through plugins and Hooks with zero intrusion to Agent frameworks.