Introducing WorkSuite OS: a Debian-based desktop where the business platform is the point
Most business computers run an operating system from one company, business software from another, and a device-management tool from a third. The three know almost nothing about each other. A new starter needs an account in each. A lost laptop means three separate phone calls. And when the line drops, half of it stops working.
WorkSuite OS is our answer to that: a desktop operating system, built on Debian 13, where the business platform is not an application you install but the thing the computer is for.
What it actually is
It is a full Linux desktop. Staff sign in once and land on their WorkSuite desktop — mail, calendar, chat, Drive, tasks and whichever modules the organisation has switched on — alongside the ordinary Linux applications they already use. Firefox and WhatsApp are one click from Start, the same as everything else.
The difference from "a Linux laptop with our web app on it" is in the plumbing. The shell, the application windows and the sync service share one secure token broker, so signing in to the computer is signing in to WorkSuite. Modules a person has no permission for never appear in Start at all. And worksuite:// links in mail or chat open the right record directly, rather than a browser tab that asks you to log in again.
It keeps working when the connection does not
This is the part that matters most in practice, and it is the reason we built it rather than buying something.
A power cut, a weak mobile signal, a site visit with no Wi-Fi — none of these should stop work. On WorkSuite OS, someone who has signed in before can sign in again with no network at all. Cached records and files open from the device. Every change is written locally first, stored with its place in a queue, and delivered to WorkSuite exactly once when the link returns. Repeated deliveries are ignored, and when two people have edited the same thing, both versions are kept rather than one silently overwriting the other.
Each app states plainly whether it works fully offline, offers a cached read, or genuinely needs a connection — so people know where they stand before they rely on it.
One App Center, with the permissions shown first
Software installation is where most desktop fleets quietly go wrong. WorkSuite OS puts four sources behind one store — Debian packages, Flatpak, AppImage and Livezen's own signed WorkSuite apps — and shows what an application is asking for before it installs, not afterwards.
Permissions are graded rather than listed as a wall of jargon — "Open files you choose" is marked safe; "Run as an older X11 app" is marked broad, because it is. IT decides which applications and sources are allowed, and a blocked app explains why it was blocked. The desktop, login and lock screen cannot be removed by accident. Windows .exe files are explained, never executed.
Three walls between an app and the system
The security model is worth stating plainly, because "secure by design" usually is not.
- The interface can only ask. The shell is sandboxed; it cannot touch files or run commands directly. It calls a short list of named, checked functions.
- Your services act with your rights. Sync, files, search and sign-in run as you — not as root — and verify every caller.
- Only two system services can change the computer, and only after an administrator approves.
Around that: LUKS2 full-disk encryption with TPM unlock, AppArmor, signed repositories, a real secure lock screen, an SBOM published with each release, and no remote shell. An administrator can ask a device to do a bounded list of things — refresh policy, install an approved app, schedule an update, lock, restart in the maintenance window — and every command is signed, expires, and cannot be replayed. A remote wipe needs one admin to request it with a reason and a second to approve.
The management console also distinguishes between what was requested and what a device has actually confirmed. "Lock requested, not yet received" is never displayed as "locked", which sounds like a small thing until the day it matters.
An AI assistant with no network access
There is an on-device AI assistant for summarising, rewriting and explaining. The notable part is what it cannot do: the inference engine is sandboxed with networking blocked outright, so questions and documents cannot leave the machine. Models run from roughly 0.8B to 9B parameters on the CPU or a Vulkan GPU, verified before each use, and IT can disable it or restrict which models are allowed. It is never enabled on kiosks.
For organisations handling client data under confidentiality obligations — the same ones we discuss in our pieces on self-hosted remote access and running your own VPN — "the AI physically cannot phone home" is a much easier sentence to defend than a vendor's privacy policy.
Specifications
| Foundation | Debian 13 "trixie", with package versions pinned and tested for each release |
|---|---|
| Architectures | x86-64 (Intel, AMD); ARM64 from the same release, in qualification |
| Firmware and boot | UEFI; Debian-signed shim, GRUB and kernel for Secure Boot on qualified models |
| Desktop | Labwc on Wayland; WorkSuite shell (React 19, Electron); XWayland for older X11 apps |
| Applications | Debian packages (APT), Flatpak, AppImage and WorkSuite apps in one App Center |
| Sign-in | Local accounts, Active Directory, LDAP / FreeIPA, WorkSuite OneAuth; authenticator codes; smart card optional |
| Security | LUKS2 encryption with TPM unlock, AppArmor, sandboxed interface, signed repositories, SBOM per release |
| Management | WorkSuite enrollment, signed policy, inventory, bounded remote commands, two-person remote wipe |
| Updates | Dev, pilot and stable rings; offline USB bundles for sites without a connection |
| Connectivity | Wi-Fi, Ethernet, WireGuard and OpenVPN, captive-portal sign-in, Bluetooth |
| Printing | CUPS with driverless IPP printers |
| Installer | Graphical and fully offline; whole-disk, encrypted or not; enroll by code or QR |
| Languages | English interface; Sinhala and Tamil input; Sinhala and Tamil interface in review |
Full specifications, installation steps and day-to-day guidance are in the WorkSuite OS user documentation.
Minimum hardware is a dual-core x86-64 processor, 4 GB of memory and 32 GB of storage; we recommend four cores, 8 GB and a 64 GB SSD. Certification starts with selected Intel and AMD models — NVIDIA graphics, uncommon docks and specialist peripherals are supported after qualification, so check your hardware with us before standardising on it.
Updates you can undo
Releases move through three rings: dev for IT's own test machines, pilot for a small group using it in daily work, then stable in stages for everyone else. Updates install only inside your maintenance window, and only with enough power and disk space. A bad release can be paused or pulled in one step.
If something does break, the recovery paths are specific rather than aspirational: a crashed desktop restarts in seconds with your applications still running; an interrupted update is detected at the next boot and repaired before login; a kernel that fails can be swapped for the previous one from the boot menu; and a machine that will not start at all boots into WorkSuite Recovery for startup repair, snapshots, or a reinstall that keeps your files.
Who it is for
WorkSuite OS makes sense if you are already running WorkSuite, you manage a fleet of desktops or laptops, and the gap between "the business system" and "the computer" is costing you time — in onboarding, in licensing, in devices nobody can account for. It is a particularly good fit for branch offices and field teams on unreliable connections, and for front desks that should be locked to a single application.
It is a weaker fit if your work depends on Windows-only software. Windows programs are explained, not run, and we would rather tell you that now than during a migration.
More on the product, including current release notes, is at worksuitecloud.com/products/os, and the user documentation is at worksuitecloud.com/docs.
WorkSuite OS 1.0 is built by Livezen Technologies in Sri Lanka. If you are weighing up a desktop refresh, or want to pilot it on a handful of machines before committing, get in touch and we will talk through whether it fits your environment — including the cases where it does not.