# Concept — Two-drive model

Bare OS splits the world into two **Hyperdrives** so you can **replicate the OS image** without forking everyone’s private state.

## System drive

- Holds the **stock tree**: `/boot`, `/bin`, kernel bundles, `man` JSON, optional `/lib/bare` bundles.
- Treated as **image policy** — you replicate it from peers like a read-mostly artifact.

## Personal drive

- Holds **per-machine mutable state**: your **`$HOME`**, **`/.bare`** (identity, policy blobs guests may not see), session-scoped **`/tmp`**, **`/var/log`**, history, and anything that should not be overwritten when the system image updates.
- In account-prefix mode (**`BARE_OS_PERSONAL_ACCT_PREFIX=1`**), user state is routed under **`/.bare-os/acct/<principal>/...`** so multiple principals can share one personal drive without path collisions.

## VFS routing (mental model)

The booter-backed VFS **mounts both** and **routes paths**: home + account-prefixed state, **`/.bare`**, session **`/tmp`**, and **`/var/log`** land on the personal drive; the rest of the POSIX-shaped tree comes from the system image. Exact policy and edge cases live in the booter reference and handbook.

```mermaid
flowchart LR
  subgraph routes [Path classes]
    H["$HOME and account prefixes /.bare-os/acct/<principal>/home"]
    B["/.bare and account metadata"]
    T["/tmp and /var/log"]
    R["Rest of tree e.g. /bin /boot /etc"]
  end
  subgraph drives [Drives]
    P[Personal Hyperdrive]
    S[System Hyperdrive]
  end
  H --> P
  B --> P
  T --> P
  R --> S
```

## Read next

- **Handbook** — [Chapter 5 — Identity, vault, HDMS](../../handbook/05-identity-vault-and-hdms.md) (how `/.bare` behaves for guests vs users).
- **Reference** — [package-bare-os-booter.md](../reference/package-bare-os-booter.md) (VFS, guest `/.bare` policy, env gates).
- **Security** — [Vault threat model](../security/vault-threat-model.md).