ANOLISA: Deep Technical Analysis of Alibaba's Agentic OS

An in-depth exploration of Alibaba's ANOLISA (Agentic Nexus Operating Layer & Interface System Architecture), examining how it provides server-side operating system-level support for AI Agent workloads.

作者 铂傲智能团队
英文版本稍后补充。
#ANOLISA #Agentic OS #AI Agent #Alibaba #Anolis OS #eBPF #Security Kernel

ANOLISA: Deep Technical Analysis of Alibaba’s Agentic OS

Overview

ANOLISA (Agentic Nexus Operating Layer & Interface System Architecture) is Alibaba’s Agentic evolution of Anolis OS, designed to deliver the best-practice implementation of an Agentic OS — a server-side operating system purpose-built for AI Agent workloads.

GitHub: https://github.com/alibaba/ANOLISA

Unlike traditional operating systems, ANOLISA treats AI Agents as first-class citizens, providing comprehensive OS-level support including code comprehension, task automation, system management, security isolation, and observability.

Core Component Architecture

ANOLISA consists of four core components working in concert:

┌──────────────────────────────────────┐
│           Agent Application           │
├──────────────────────────────────────┤
│         Copilot Shell (cosh)         │  AI-powered terminal assistant
├──────────────────────────────────────┤
│         Agent Sec Core               │  OS-level security kernel
├──────────────────────────────────────┤
│         AgentSight                   │  eBPF-based observability
├──────────────────────────────────────┤
│         OS Skills                    │  Operational skill library
├──────────────────────────────────────┤
│           Linux Kernel               │
└──────────────────────────────────────┘

Copilot Shell: AI-Powered Terminal Assistant

Copilot Shell is ANOLISA’s interactive entry point, built on Alibaba’s Qwen Code (v0.9.0), providing a natural language-driven coding and operations experience.

Key Features

Technical Architecture

Copilot Shell uses an npm workspaces monorepo layout:

PackageDescription
packages/cliTerminal UI layer — input handling, command parsing, Ink/React rendering
packages/coreBackend core — AI model communication, prompt building, tool orchestration
packages/test-utilsShared test utilities

Quick Installation

# Install via RPM
sudo yum install copilot-shell

# Build
cd src/copilot-shell
make build

# Start interactive mode
cosh

# Or use aliases
co
copilot

Agent Sec Core: OS-Level Security Kernel

As AI Agents progressively gain OS-level execution capabilities (file I/O, network access, process management, etc.), traditional application security boundaries no longer apply. Agent Sec Core builds a defense-in-depth system at the OS layer, ensuring Agents operate in a controlled, auditable, least-privilege environment.

Design Principles

Three-Phase Security Check

┌─────────────────────────────────────────────┐
│ Agent Application                           │
├─────────────────────────────────────────────┤
│ Security Decision (Risk Classification)     │
├─────────────────────────────────────────────┤
│ Phase 3: Final Security Confirmation        │
├─────────────────────────────────────────────┤
│ Phase 2: Asset Protection (GPG + SHA-256)  │
├─────────────────────────────────────────────┤
│ Phase 1: System Hardening (loongshield)     │
├─────────────────────────────────────────────┤
│ Linux Kernel                                │
└─────────────────────────────────────────────┘

Risk Classification

LevelExample OperationsAction
LowFile reads, info queries, text processingAllow (sandboxed)
MediumCode execution, package install, external API callsSandbox isolation + user confirmation
HighReading .env/SSH keys, data exfiltration, modifying system configBlock unless explicitly approved
CriticalPrompt injection, secret leakage, disabling security policiesImmediate block + audit log + notify user

Sandbox Policy Templates

linux-sandbox provides 3 built-in policy templates:

TemplateFilesystemNetworkUse Case
read-onlyEntire filesystem read-onlyDeniedRead-only operations: ls, cat, grep, git status
workspace-writecwd + /tmp writable, rest read-onlyDeniedBuild, script execution requiring file writes
danger-full-accessUnrestrictedAllowed⚠️ Reserved, special scenarios only

Prohibited Sensitive Paths

Agents are never allowed to access or exfiltrate:

AgentSight: eBPF-Based AI Agent Observability

AgentSight is a Linux eBPF (Extended Berkeley Packet Filter)-based observability tool for AI Agents, providing zero-intrusion monitoring of LLM API calls, token consumption, process behavior, and SSL/TLS traffic.

Key Features

Data Processing Pipeline

┌──────────┐ ┌────────┐ ┌────────────┐ ┌──────────┐ ┌───────┐ ┌─────────┐
│  Probes  │──▶│ Parser │──▶│ Aggregator│──▶│ Analyzer│──▶│ GenAI  │──▶│ Storage │
└──────────┘ └────────┘ └────────────┘ └──────────┘ └───────┘ └─────────┘
  eBPF events  HTTP/SSE  Req-Resp   Token/Audit  Semantic  SQLite/
  (kernel)     extraction correlation extraction events    SLS export

eBPF Probes

ProbeSource FileDescription
sslsniffsrc/bpf/sslsniff.bpf.cuprobe on SSL_read/SSL_write to capture plaintext from encrypted connections
proctracesrc/bpf/proctrace.bpf.cTraces execve syscalls, captures command-line args, builds process tree
procmonsrc/bpf/procmon.bpf.cLightweight process monitor for creation/exit events (agent discovery)

Quick Usage

# Foreground tracing mode
sudo agentsight trace

# Daemon mode with SLS export
sudo agentsight trace --daemon \
 --sls-endpoint <endpoint> \
 --sls-project <project> \
 --sls-logstore <logstore>

# Query token consumption
agentsight token

# Query audit events
agentsight audit --summary

# Discover AI agents
agentsight discover

OS Skills: Operational Skill Library

OS Skills is ANOLISA’s curated skill library, covering system administration, monitoring, security, DevOps, and cloud integration. Skills are installed to /usr/share/anolisa/skills/ and auto-discovered by Copilot Shell.

Skill Categories

CategoryDirectoryDescription
AI Toolsai/AI programming tool integration (Claude Code, OpenClaw, CoPaw, MCP)
System Adminsystem-admin/Package management, storage, networking, kernel, shell scripting
DevOpsdevops/Git workflows, CI/CD, kernel development, diagnostics
Alibaba Cloudaliyun/ECS instance management, cloud networking, GPU/AI deployment
Securitysecurity/CVE queries, compliance checks, system hardening
Monitoring & Perfmonitor-perf/sysAK diagnostics, keentune tuning, sysctl management

Installation

# Install all skills via RPM
sudo yum install anolisa-skills

# Skill installation path
/usr/share/anolisa/skills/

One-Command Installation

ANOLISA supports installing all components via RPM:

# Install all components
sudo yum install copilot-shell agent-sec-core agentsight anolisa-skills

# Launch Copilot Shell
cosh

Technical Highlights

  1. Agentic OS Philosophy: ANOLISA is the first OS to incorporate AI Agent requirements into its fundamental design, providing native OS-level support
  2. Defense-in-Depth Security: Agent Sec Core implements a three-layer security architecture: system hardening → asset integrity verification → security decision-making
  3. eBPF Observability: AgentSight leverages eBPF technology for truly zero-intrusion AI Agent monitoring without impacting business performance
  4. Rich Skill Ecosystem: OS Skills provides production-ready operational skills spanning AI, cloud, security, and more
  5. Open Source: Licensed under Apache 2.0, integrable with Agent OS platforms including ANOLISA and OpenClaw

References

ANOLISA represents Alibaba’s significant exploration in the Agentic OS domain, providing operating system-level infrastructure for the secure and reliable operation of AI Agents. It stands as a notable practice in the convergence of AI and operating system innovation.