Embedded Linux
What is the Yocto Project?
The Yocto Project is an open-source build system for creating custom Linux distributions for embedded and IoT devices — on any processor architecture. It is one of the most widely used ways to build embedded Linux in the industry, across the world.
A build system, not a distribution
The Yocto Project is not a ready-made Linux you download and flash. It is a framework that compiles a Linux image tailored to your exact hardware and product: the kernel, the bootloader, the C library, the packages you choose and nothing you do not. It is a collaborative open-source project hosted by the Linux Foundation, backed by many silicon vendors and companies, and it runs on Arm, x86, RISC-V, PowerPC, MIPS and more.
- Builds a reproducible, from-source image for your board, not a generic one
- Any architecture: Arm, x86-64, RISC-V, PowerPC, MIPS
- Open source, vendor-neutral, hosted by the Linux Foundation
How it works: BitBake, recipes and layers
Yocto builds with the OpenEmbedded build system. BitBake, the task scheduler, reads recipes (.bb files) that each describe how to fetch, configure, compile and package one piece of software. Recipes are grouped into layers you stack on top of each other: a BSP layer for your board, a distro layer for your policy, your own layer for your application. Poky is the project's reference distribution that ties it together.
- Recipe (.bb): where the source is, its license, how to build and package it
- Layer: a set of recipes and configuration you add to the stack (meta-*)
- BitBake: resolves dependencies, cross-compiles, caches with shared state (sstate)
- Poky: the reference distribution and starting point
Why teams build with Yocto
A product that ships for ten or fifteen years needs a Linux it fully controls: the exact packages, the licenses, the security updates, reproducible from source. Yocto gives that control, which is why it became a de facto standard for professional embedded Linux.
- Full control of the image: size, packages, kernel configuration
- Reproducible builds you can rebuild years later
- License compliance and a software bill of materials (SBOM)
- Long-term maintenance and security updates (CVE tracking)
Where Yocto is used
Because it is architecture-independent and production-grade, Yocto is used to build the embedded Linux inside products across virtually every industry, worldwide — from a network router to a medical device to a car's infotainment system.
- Automotive and e-mobility
- Industrial automation and IoT gateways
- Networking and telecom (routers, 5G)
- Medical devices
- Aerospace and defense
- Consumer electronics and smart home
- Energy, metering and utilities
- Robotics and drones
The trade-off: power and complexity
That control comes at a cost. Yocto has a steep learning curve, builds can take hours, and a failure deep in a recipe often ends in a cryptic BitBake error and a long log. Diagnosing it means knowing where the data lives — the task log, the layers, the configuration, bitbake -e.
Where Yocman fits in
Yocman is an AI agent and a toolbox in your terminal, wired into your real Yocto Project builds. Fixing a failed task is only the start: most of what it does is help you understand, audit and ship the image. Every analysis reads the files BitBake already wrote, so the facts come from your build, not a guess.
- audit
- Ship it or not? One scored report: unpatched CVEs, embedded secrets, accounts, services, kernel hardening, licenses and the SPDX SBOM — the build-side evidence for the Cyber Resilience Act.
- cve · secrets
- The CVEs still unpatched in the image you ship, and private keys or tokens baked into the rootfs — reported by location, never displayed.
- why · size
- Why is this package in my image? What takes the space? size diff compares two builds package by package.
- buildtime · sstate
- Where the build hours go, the effective parallelism, and the recipes rebuilt from scratch every time.
- init · build · flash
- Start a kas project for a verified board, build it with live progress, and flash the card with a device check you cannot skip.
- fix · explain
- Diagnose a failed task and get a patch for your own layer, or just the diagnosis — applied only after you approve it.
- Runs against a build directory, not the source tree: point it at any build output with --build-dir (even a copied or archived one) — no need to be inside the checkout.
- One install for all your builds and Yocto trees: switch targets with --build-dir, compare two builds with size diff or cve diff.
- Your build stays on your machine; only masked excerpts reach the AI, and patches go to your layers, never upstream.
Frequently asked questions
- Is the Yocto Project a Linux distribution?
- No. It is a build system that produces a custom Linux distribution for your hardware. Poky is its reference distribution, meant as a starting point you adapt.
- What is the difference between Yocto and OpenEmbedded?
- OpenEmbedded is the build system and the shared set of recipes (metadata). The Yocto Project is the umbrella project, hosted by the Linux Foundation, that uses the OpenEmbedded build system, adds Poky, releases, tooling and testing, and coordinates the ecosystem.
- What is BitBake?
- BitBake is the task executor at the heart of the build. It parses recipes, resolves their dependencies and runs the tasks that fetch, configure, compile and package every component, cross-compiling for your target.
- What is a layer in Yocto?
- A layer (a meta-* directory) is a self-contained set of recipes and configuration you add to the build. Layers keep your board support, your distribution policy and your own application separate and reusable.
- Yocto or Buildroot?
- Both build embedded Linux from source. Buildroot is simpler and faster for small, fixed images; Yocto is more complex but far more scalable and maintainable for products with long lifecycles, package management and strict license and update requirements.
- Is the Yocto Project free to use?
- Yes. It is open source and free to use. The Yocto Project is a trademark of The Linux Foundation.
Official resources
Yocto Project® and the Yocto Project logo are registered trademarks of The Linux Foundation. Yocman is an independent tool and is not affiliated with, sponsored by, or endorsed by the Yocto Project or The Linux Foundation.