Sidero Labs Talos Linux and Omni: On-Prem Kubernetes Ledger

Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: Challenger
Owner: Sidero Labs, Inc., acquired by Yardi (privately held, profitable) on 2026-09-14; before that venture-funded ($4.0M, Hiro Capital, 2024)
Licence model: Talos Linux MPL-2.0 (free); Omni under Business Source License 1.1 (production use needs a licence); Talos Enterprise Linux $1,000 per node per year, 10-node minimum, Omni included
Products scored: Talos Linux 1.14 with Omni 1.12 (SaaS or self-hosted); Talos Hypervisor, Director and Cupar counted as previews only
Latest release: Talos 1.14.0 (Kubernetes 1.37.0), 2026-09-03; patch 1.14.2 on 2026-09-29; Omni 1.12.0, 2026-09-11
Next signal: Talos Hypervisor GA December 2026; Talos Director GA January 2027; Talos Cupar GA March 2027; Talos 1.15 (alpha.0 tagged 2026-09-08)
Archetype: Immutable OS, new owner
Evidence grade: B. Release notes, advisories, docs, pricing and blog read directly this run; the 2019 baseline and older Omni history rest on unopened 0.2 notes, and no dated roadmap exists.

2. Scorecard

Dimension	Score	Direction
Capability today	62.4 / 100	higher is better
Momentum since end of 2022	+18.8 points	higher is better
Credibility	18.0 / 25	higher is better
Commercial risk	11.5 / 25	lower is better
Technical lock-in	9.0 / 25	lower is better
Integrator fit	12.0 / 20	higher is better
AI leverage	5.0 / 20	higher is better
Ledger Index	61.2 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Install, upgrade and lifecycle (12)	n/a	1.5	3	4
Bare metal, edge and on-prem infrastructure (10)	n/a	1.5	3.5	4.5
Multi-cluster and fleet management (10)	n/a	0.5	2	3.5
Networking (10)	n/a	2	3	3.5
Storage and data protection (10)	n/a	1	2	2.5
Security and compliance (12)	n/a	2.5	3.5	4.25
Developer platform (8)	n/a	0.5	0.5	1
Observability and day-2 operations (8)	n/a	1	2	2.5
VMs on Kubernetes (VMware exit) (10)	n/a	0	0	1
GPU and accelerator workloads (10)	n/a	0	1.5	3.5
Total / 100	not released	22.0	43.6	62.4

Year by year: 2019: 22.0 · 2020: 22.0 · 2021: 22.0 · 2022: 43.6 · 2023: 47.8 · 2024: 53.0 · 2025: 59.0 · 2026: 62.4

What moved the score

Year	Domain	Change	Points	Trigger
2022	Bare metal, edge and on-prem infrastructure	1.5 → 3.5	+4.0	1.3: bare metal, VMware, OpenStack, SBC images; Sidero Metal for provisioning
2022	GPU and accelerator workloads	0 → 1.5	+3.0	1.0 NVIDIA alpha, 1.2 (2022-09-01) beta with open kernel module extension
2022	Install, upgrade and lifecycle	1.5 → 3	+3.6	1.3 (2022-12-15): talosctl OS and Kubernetes upgrades, 7-day lag to Kubernetes 1.26
2022	Multi-cluster and fleet management	0.5 → 2	+3.0	1.3: Cluster API providers and Sidero Metal only
2022	Networking	2 → 3	+2.0	1.2/1.3: Flannel, KubeSpan WireGuard mesh, VLAN and bonding in machine config
2022	Observability and day-2 operations	1 → 2	+1.6	1.3: node metrics, talosctl health, Prometheus integration
2022	Security and compliance	2.5 → 3.5	+2.4	1.0 to 1.3: Pod Security admission config, audit policy, seccomp default, secretbox
2022	Storage and data protection	1 → 2	+2.0	1.3: CSI drivers run as workloads; etcd snapshots
2023	Multi-cluster and fleet management	2 → 3	+2.0	Omni SaaS and on-prem referenced by 2023-05-01; no GA date found
2023	Networking	3 → 3.5	+1.0	1.6 (2023-12-15) ingress firewall; 1.14 native BGP, VRF; Cilium and MetalLB guides; no bundled Gateway API or SR-IOV
2023	Security and compliance	3.5 → 4	+1.2	1.5 (2023-08-17) TPM and KMS disk encryption, Secure Boot; 1.7 CA rotation
2024	GPU and accelerator workloads	1.5 → 3	+3.0	1.8 (2024-09-23) NVIDIA LTS and production extensions with GPU Operator guide
2024	Install, upgrade and lifecycle	3 → 3.5	+1.2	Omni source public 2024-02-29 with fleet upgrade orchestration; still no LTS
2024	VMs on Kubernetes (VMware exit)	0 → 0.5	+1.0	KubeVirt install guide added 2024-11 (community add-on, half a step)
2025	Bare metal, edge and on-prem infrastructure	3.5 → 4.5	+2.0	Omni infrastructure providers 2025-03-20: bare metal (IPMI/Redfish), KubeVirt, vSphere, Proxmox; image cache for air-gap since 1.9
2025	Multi-cluster and fleet management	3 → 3.5	+1.0	Omni 1.0 (2025-07-25): templates, ACLs, SAML/OIDC, audit log, manifest sync, workload proxy; no fleet policy engine
2025	Observability and day-2 operations	2 → 2.5	+0.8	Omni audit log, support bundle, 1.12 persistent logs, Prometheus exporter; no bundled alerting stack
2025	Security and compliance	4 → 4.5	+1.2	1.10 SELinux enforcing, 1.11 SBOM, FIPS 140-3 builds 2025-09-02; 1.13 image signature verification; no STIG
2025	Storage and data protection	2 → 2.5	+1.0	1.10 user volumes and iSCSI initiator, Omni etcd backups to S3; Rook-Ceph and Longhorn guides only
2026	Developer platform	0.5 → 1	+0.8	Omni workload proxy and image factory; no registry, CI or portal
2026	GPU and accelerator workloads	3 → 3.5	+1.0	1.13 CDI by default, AMD ROCm operator guide; no MIG, sharing or DRA docs
2026	Install, upgrade and lifecycle	3.5 → 4	+1.2	1.13 staged OS upgrades, rollback, median lag 5 days; vendor support window about nine months, no LTS
2026	Security and compliance	4.5 → 4.25	-0.6	4.5 less 0.25 for critical flaw GHSA-rjwj-368c-f82r (CVSS 9.9) disclosed 2026-09-18, fixed in 1.13.10 on 2026-09-03; no KEV
2026	VMs on Kubernetes (VMware exit)	0.5 → 1	+1.0	Talos Director Limited Availability 2026-09-30 and Hypervisor alpha; GA planned January and December 2026-27

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2024-02	Omni source released under Business Source License	D11 Ecosystem openness	V
2024-09	Talos 1.8: NVIDIA LTS and production driver extensions	D13 Accelerators	C
2025-03	Omni infrastructure providers for bare metal, KubeVirt, vSphere and Proxmox	D2 Bare metal, edge and infrastructure	V
2025-04	Talos 1.10: SELinux enforcing mode	D9 Security	U
2025-09	FIPS 140-3 compliant Talos builds	D9 Security	C
2025-11	Talos Linux certified under CNCF Kubernetes AI Conformance	D13 Accelerators	M
2026-04	Talos 1.13: machine-wide image signature verification	D9 Security	C
2026-08	Cluster API providers moved to community maintenance	D11 Ecosystem openness	P
2026-09	Talos 1.14: native BGP and sandboxd workload isolation	D4 Networking	C
2026-09	Talos Director Limited Availability as a VMware alternative	D10 VMs on Kubernetes	M
2026-09	Talos Enterprise Linux at $1,000 per node per year with Omni included	D12 Packaging and licensing	P
2026-09	Yardi acquires Sidero Labs and Talos Hypervisor is announced	D10 VMs on Kubernetes	P
2026-10	Talos Linux for AI and Talos Cupar announced	D13 Accelerators	M

Centre of gravity: Accelerators (3), Security (3), Ecosystem openness (2)
Driver mix: Vision 15%, Customer need 31%, Market window 23%, Upstream 8%, Portfolio 23%

5. Credibility: 18.0 / 25

Criterion	Score	Basis
Cadence	4.5	A Talos minor every four to five months since 1.3, within 10 days of Kubernetes except 1.31; no published schedule
Roadmap transparency	3	Detailed release notes and open GitHub issues; milestones carry no dates, no written roadmap
Say-do	3	Few dated promises: FIPS options took about 12 months, image signature verification 4 months; three new products pending
Velocity	4.5	SELinux, image signature verification, native BGP, LVM and sandboxd in successive minors; Omni releases monthly
Lifecycle stability	3	Support about nine months with no LTS; Sidero Metal and Cluster API providers ended; sold to Yardi in 2026

Say-do record, 2023 to 2026: 8 items 2023-2026: 4 shipped (image signature verification in 4 months, FIPS variant in 12.8, FIPS options in about 12, native BGP in 15), 3 pending (Hypervisor December 2026, Director January 2027, Cupar March 2027), 1 dropped (Cluster API providers handed to the community 2026-08-19). Most items are tracker requests without a vendor date.

6. Commercial risk: 11.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	3	Omni moved to Business Source License 2024-02-29; Omni Enterprise folded into $1,000 per node Talos Enterprise Linux 2026-09-15
Purchase constraints	2	Free OS and $10 hobby tier; enterprise 10-node minimum; production Omni needs a licence
Channel and access	1	Open downloads and docs; partner programme with reseller, solution and technology tiers
Owner stability	3	Acquired by Yardi 2026-09-14, a profitable private owner; strategy now includes hypervisor, Director and AI products
Cost of staying supported	2.5	Self-hosted Omni users told to update monthly with no backports; FIPS, SBOM and VEX only in the paid tier

Security record of the product itself: One critical flaw in Talos's own API, GHSA-rjwj-368c-f82r (CVSS 9.9, role-less certificate to os:admin), fixed in 1.13.10 on 2026-09-03 and disclosed 2026-09-18, so 0.25 is deducted; Omni highs (CVE-2025-61688, CVE-2026-45720, CVE-2026-45726) are below 9.0. Linux kernel Copy Fail CVE-2026-31431 entered KEV on 2026-05-01 but is upstream and was fixed in 1.12.7 on 2026-04-24, so no deduction (the security record).

7. Technical lock-in: 9.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	Conformant Kubernetes; workloads use upstream APIs and no proprietary CRDs
Export path	1.5	Standard manifests and Velero move off; hosts must be reprovisioned onto another OS
Stack coupling	3	Talos is the only OS and has no shell; CNI and CSI remain open
Hardware / cloud coupling	1	Any x86 or Arm hardware, air-gapped Omni available; hosted Omni optional
Skills and tooling coupling	3	talosctl and machine-config skills, not SSH or Linux administration

8. Integrator fit: 12 / 20

Criterion	Score	Basis
Partner programme openness	3	Reseller, solution provider and technology tiers; CDW and European partners listed
Multi-tenancy and self-service	3	Omni roles, ACLs and SAML/OIDC; no hosted control planes
API and infrastructure-as-code	4	Terraform provider with 5.6M downloads, Omni provider, omnictl; Cluster API providers moved to community
Skills and certification	2	Training and readiness reviews sold as services; no certification found

9. AI leverage: 5.0 / 20

Strand	Today	Latest step
AI workload support	3	2025: CNCF Kubernetes AI Conformance certification 2025-11-11; 1.13 CDI and GPU Operator path in 2026
AI platform stack	0.5	2026: Talos Cupar Limited Availability 2026-10-01, GA planned March 2027
AI-assisted operations	0	none
Agent openness	1.5	2019: Documented gRPC machine API and omnictl; only a documentation MCP and llms.txt, no control MCP server

AI say-do: 2 announced (Cupar, Talos Linux for AI), 0 GA, 2 preview or undated, 0 pending beyond them, 0 dropped; the real AI work is GPU driver and operator support, with a commercial AI platform one month old.

10. Reading

Sidero builds toward a full data-centre stack on one immutable OS, adding a hypervisor, Director and an AI platform after Yardi bought it in September 2026. The record is a Talos minor every four to five months within days of Kubernetes, steady security hardening and few dated promises; three new products are one month old. A buyer gets a lean, strict OS and fast Kubernetes uptake, but accepts one OS, a nine-month support window and Omni under a source-available licence.

11. Open questions and evidence caveats

Talos Hypervisor, Director and Cupar are unreleased or in Limited Availability; virt and AI stack scores count previews at half a step.
Yardi acquired Sidero on 2026-09-14; the effect on pricing and roadmap is not yet visible.
Talos 2019 baseline and Omni GA date rest on unopened or missing sources.
No Talos folder for Kubernetes 1.30 in the conformance repository; 1.36 and 1.37 were certified on 2026-09-11 after a long delay.