Try kern in five minutes

Zero to a service that answers

No runtime to install, no container to build, nothing to configure. One binary in, one binary out.

$ curl -fsSL https://kern-lang.eu/install.sh | bash
$ kern new api my-service && cd my-service
$ kern run

  my-service listening on :8080

$ curl localhost:8080/health
  {"status": "ok"}

That is a real HTTP service, not a hello stub. It compiles to a native binary of about 115 KB that you can copy to a scratch container or a bare VM and run. There is no interpreter, no VM, and no node_modules. Builds got about five times faster this cycle, so the loop stays tight while you are exploring.

Then the part people re-read

Every language has a linter that warns about the following. In kern they are compile errors, which means they cannot reach production, cannot be suppressed in a hurry, and cannot survive a distracted code review.

A query built from user input does not compile. Not "is flagged". Does not compile. The shape an attacker needs does not exist in valid source, and the same rule covers shell, URL, regex and template strings.

Personal data reaching the wrong place does not compile. Tag a field as personal once and the compiler follows it, through assignments, struct fields and string interpolation, into every sink: a log line, a file, a database row, an LLM call. You do not have to remember. That is the point.

Model output reaching a sink does not compile. Anything an LLM returns comes back marked untrusted, so feeding a reply straight into SQL or a shell is rejected until you validate it. Prompt injection stops at the type system rather than at your incident channel.

There is a fourth that surprises people more than it should: a module that was never handed the authority to touch the network simply cannot open a socket. Not by policy, not by sandbox configuration. It does not compile. Authority is an argument you pass, so an audit reads the grants instead of the whole codebase.

The weekend project

Here is the part that is hard to say without sounding like a pitch, so here it is plainly: the same language you just wrote that API in also boots Linux.

kern ships a hypervisor written in kern. It starts an unmodified Linux kernel on KVM, gives it a disk and a network card that kern itself emulates, and drops you at an interactive shell. It runs containers too, pulling real OCI images with no Docker, Podman or runc underneath. It talks to Bluetooth radios. All of it is the same language, the same type system, and the same capability rules as your web handler.

You are unlikely to need a hypervisor this week. It is worth knowing it is there, because it is the honest test of whether a language is actually general-purpose or just comfortable in one lane.

What we are not going to pretend

Two things, kept short.

On speed: kern is the fastest of kern, Go, Node and Python at serving HTTP and at file I/O, and it is Go-class on raw recursion. It loses to Go on JSON encoding, and on SHA-256 hashing it is roughly ten times slower, because ours is a software implementation while theirs uses the CPU's hardware instructions. That is a known work item, not a mystery, and the numbers are on the home page with the losses styled as losses.

On maturity: the version is a release candidate on purpose. The implementation is 1.0-grade, it self-hosts, the suite is green and the build is reproducible byte for byte on every commit. The goal beyond that is verifiable trust, most of which is now enforced by CI rather than asserted, and the remaining gap, including an external audit we have not yet commissioned, is written down in the open.

We also publish the bugs we find in our own code, including an authentication bypass we found and closed in our own WebAuthn module. If that reads as a strange thing to advertise, it is the whole argument: a trust claim you cannot check is marketing, and the register of what we got wrong is the part that makes the rest worth anything.

Where to start

Run the three commands at the top. If you want to see what the compiler refuses before you write anything, the home page has the errors side by side with the code that triggers them, and the engineering log has every change with what it cost us.

curl -fsSL https://kern-lang.eu/install.sh | bash