platform

veil on linux

supported

First-class. Every check the app runs works at full depth here — this is the platform veil was built against first. OpenRC, runit, s6, dinit, and systemd are all detected, never assumed.

the honest ceiling

what full support actually means here

Every check in the table below reads "full" for linux — the app answers the real question, not a narrower one. That's not marketing; it's the same claim the support matrix makes, read straight off it.

Encrypted DNS

Reads your active resolver config directly — full depth, free tier.

VPN tunnel

Detects an active tunnel interface and its routing — full depth, plus tier.

Traffic egress

Confirms traffic actually leaves through the tunnel — full depth, plus tier.

Firewall

Reads nftables/iptables ruleset state directly — full depth, plus tier.

IPv6 leak guard

Checks for an active, unrouted IPv6 address past the tunnel — full depth, plus tier.

MAC randomization

Reads NetworkManager's per-network randomization policy — full depth, free tier.

Encrypted messaging

Detects an installed end-to-end messenger — full depth, free tier.

Disk encryption

Reads LUKS status on the root volume — full depth, plus tier.

install

getting it running

  1. download the AppImage

    Grab the .AppImage from the download page. Checksums are published alongside it — verify before running anything you downloaded.

  2. mark it executable

    AppImages don't install anywhere — they run in place. From a terminal: chmod +x veil-*.AppImage

  3. run it

    Double-click it in a file manager, or run ./veil-*.AppImage from the terminal. No installer, no root prompt, no package manager involved at this step.

  4. first scan

    veil probes your init system (systemd, OpenRC, runit, s6, dinit) and package manager (apt, dnf, pacman, emerge, zypper, apk, xbps, nix) before it suggests a single command — this is why the fix commands it shows you are specific to your machine, not a generic guess.

verify

confirming it actually did something

Every check is read-only until you explicitly run a fix. After you apply one, the same check re-runs so you can watch the pill change from fail/warn to ok — no separate verification tool needed, the app is its own proof.

  • a VPN fix flips from fail to ok only once the tunnel interface exists and traffic egress confirms it's actually carrying traffic — not just that the service started.
  • a firewall fix re-reads the live nftables/iptables ruleset — it doesn't cache the result from before you ran the command.
  • disk encryption reads LUKS status directly off the block device — an unencrypted disk with a passphrase set somewhere else still reads as unencrypted.