// the find
ProvableHQ/snarkOS
A Decentralized Operating System for ZK Applications
snarkOS is the node software for the Aleo blockchain — a ZK-native L1 where all application state is stored encrypted on-chain and verified via zk-SNARKs. It handles consensus (AleoBFT, a Narwhal-based DAG BFT), P2P networking, block sync, and the REST API. Target audience is validator operators and developers building on Aleo, not people looking to learn ZK theory.
The workspace is cleanly decomposed into focused crates (bft, router, sync, tcp, rest, cdn) with clear separation of concerns — the TCP layer doesn't know about consensus, the BFT layer doesn't know about networking details. The local devnet story is genuinely good: `--dev N` mode with automatic peer wiring and tmux scripts means you can spin up a 4-validator testnet in under a minute. RocksDB checkpoint-based backups with hard-link deduplication (scripts/backup.sh) are production-grade and clearly documented. The storage migration path with `--auto-migrate-node-data` and explicit per-file instructions shows the team has actually operated this in production and thought about upgrade pain.
Hardware requirements are brutal and poorly acknowledged — validators need 64+ cores, 256GiB RAM, 4TB NVMe, 500Mbps symmetric. There's no guidance for anyone below that bar, and no explanation of what actually degrades gracefully vs. what causes consensus failures. CUDA support is present but explicitly described as 'unstable and experimental' with a comment admitting it's a leftover from a previous event — dead code that signals the prover economics story is unsettled. The REST API has JWT auth but `--nojwt` exists as a flag, which means operators will absolutely run validators without it and expose internal endpoints; the docs warn about firewall rules but don't push hard enough on this. The separation between `ledger` (public) and `node-data` (sensitive, required for consensus participation) is a real footgun — lose your node-data folder on a validator and you're ejected from consensus with no graceful recovery path documented.