Infrastructure
you build on.
A general-purpose high-density compute platform with a hardened, atomic operating system — designed for workloads that cannot fail.
What Is Bedrock?
Bedrock is a server platform running HeapOS — a purpose-built, atomic, immutable operating system for critical infrastructure.
The hardware and the OS were designed for each other. Bedrock is optimized for HeapOS workloads. HeapOS is configured and certified for Bedrock hardware. The security posture is baked in, not bolted on — and it stays that way across updates, reboots, and node replacements.
"You build on bedrock. It's the thing you can't dig past, can't shake, can't ignore. Every culture knows what bedrock means."
192 threads on a single EPYC 9655 (Turin). Real-time inspection, analytics, and encrypted traffic processing — without leaving 2U.
12 channels × 256 GB RDIMM. In-memory databases, threat correlation, and full-packet capture buffers.
Broadcom P2100G with RoCEv2, SR-IOV, and TruFlow offload. Plus dual onboard 10GbE for management.
Security infrastructure is compute-hungry and storage-hungry. Real-time inspection, encrypted traffic analysis, log retention, forensic archives — they all demand cores, memory, and fast storage. Bedrock puts all of it in one sled.
The Demo Unit
Additional configurations — 1U, 4U, performance and entry tiers, and OCP ORv3 variants — available on request.
HeapOS
TCS's hardened IncusOS distribution
HeapOS is an atomic, immutable operating system — a TCS-hardened fork of IncusOS by the Linux Containers team. It boots with UEFI Secure Boot and TPM 2.0, encrypts all disks by default, applies updates atomically through an A/B partition scheme, and exposes no shell — only an authenticated REST API.
TCS builds on this foundation. Every Bedrock unit ships with HeapOS, adding compliance, operational, and security layers that the upstream project doesn't include.
Secure
- ◆ FIPS 140-3 compliant crypto (targeting CMVP)
- ◆ CIS hardened (Level 1 + Level 2)
- ◆ Read-only root — no package manager
- ◆ TPM PCR integrity on every boot
- ◆ Signed chain: UEFI → TCS KEK → kernel
- ◆ Atomic A/B updates with rollback
Enterprise
Everything in Secure, plus:
- ◆ HA clustering & live migration
- ◆ Enterprise storage (ZFS, Ceph, LVM)
- ◆ Advanced networking (BGP, OVN, SR-IOV)
- ◆ Fleet management via Ops Center
Advanced
Everything in Enterprise, plus:
- ◆ GPU passthrough & accelerators
- ◆ Compliance modules (OeGAF, NIST, GCC)
- ◆ Air-gap updates — no internet required
- ◆ Classified-network mode
One OS. Three tiers. No à-la-carte confusion.
Security-First by Design
Every Bedrock unit ships with a unique Device ID burned into FRU EEPROM at manufacturing. On boot, HeapOS reads the FRU EEPROM via BMC (Redfish) and validates the hardware identity. The Device ID is permanent — it cannot be changed after manufacturing.
Three sources of truth — one identity
FRU EEPROM
Burned into BMC EEPROM / SPI flash at manufacturing. Written once, locked. Read by BMC, Redfish API, and HeapOS on every boot.
Chassis Label
Physical sticker or engraving on the sled. Readable by humans, asset tracking systems, and RMA processes.
Device Registry
TCS backend database, auto-created at manufacturing. Used by sales, support, and firmware update systems.
Air-Gap Ready
For classified and isolated networks, the Device Registry ships as a local signed cache — no internet connection required for identity verification. The entire update lifecycle works offline.
Signed boot chain
Request Early Access
Bedrock is launching with the BR1-2U-C-GL-01 — our 2U general-purpose high-density compute configuration. If you need secure compute infrastructure that doesn't compromise, we'd like to hear from you.
Request received
We'll be in touch at the email you provided. Thank you for your interest in Bedrock.