GARRY / USB

SPACE EDITION · 2026.09.22

Your Garry USB,
ready to go.

Use a spare 32 GB or larger USB, a Windows PC, Rufus, and the Space Edition ISO (2.28 GB). This starts a full Debian 13 desktop on compatible Intel/AMD 64-bit PCs.

BIOS + UEFI virtual-machine tested. Normal BIOS/UEFI startup, local workspace, live-file checksums and saved work across reboot passed in isolated virtual machines. This does not verify a particular physical USB. Read the exact release checks and remaining limits.

Writing the USB erases the selected drive. Back up anything on that USB first. Check its model and capacity in Rufus. Do not select an internal disk or a device reporting No Media / 0 bytes.

1. Download and check the image

Save Garry-Desktop-Space-amd64.iso and compare its SHA-256 with SPACE_SHA256SUMS. In Windows PowerShell:

Get-FileHash "$HOME\Downloads\Garry-Desktop-Space-amd64.iso" -Algorithm SHA256

The hash must match exactly:

cd78c75fa9cc7fae94bd34bc3328f1336e3e39af439cc071d4ab4e9070109dcb

Double-clicking the ISO may open DVD Drive: GARRY_DESKTOP with folders such as live, boot and EFI. That is a mounted image. Close that Explorer window; use the original .iso file in Rufus.

2. Prepare the spare USB with Rufus

  1. Download Rufus from rufus.ie and run it. Use the site's actual download link.
  2. Under Device, select the spare USB by its name and size. Next to Boot selection, click SELECT and choose Garry-Desktop-Space-amd64.iso.
  3. Set Persistent partition size to at least 8 GB, preferably more. This creates the writable space for your files, settings, browser profiles and optional local model. Keep Rufus's suggested filesystem and compatible boot settings.
  4. Click START. If asked how to write it, choose ISO Image mode (Recommended) so Rufus can set up Debian persistence. Confirm erasing only that spare USB.
  5. Wait until Rufus says READY. Keep the USB connected and restart the PC. Open its one-time boot menu and select the USB.

If Windows asks to format the Linux partition afterward, click Cancel. If Rufus does not offer persistence, update Rufus and reselect the ISO; a simple file copy or ordinary DD-mode write does not create Rufus's persistent partition.

3. Choose your boot option

Menu optionWhen to use it
Garry Desktop — start normallyThe everyday starting option. Uses writable persistence when it is available.
Garry Desktop — basic graphicsTry this if normal boot has a graphics problem. It keeps Garry's user and persistence settings and adds basic graphics mode.
Garry Desktop — copy to RAM (8 GB+)Optional: reads the live image into memory first. It requires extra RAM and still needs readable media. It does not repair a damaged USB; saved changes still depend on the USB.

On the desktop, close the welcome tab whenever you want, or press Enter Garry to open the local workspace. Reopen the introduction with the Garry Launchpad icon.

If the unchanged live session locks, select Garry USB and use the initial password live, lowercase. The username is garry. Change the default password if you keep personal data on the USB.

4. Confirm your work survives a restart

  1. Open Garry USB Health. Check the writable persistence status. A temporary session does not preserve your new work.
  2. Save a small test document and add a test task in Garry.
  3. Use the desktop's Log Out → Shut Down. Wait for the computer to turn off, then boot the USB again and open both saved items.

Only rely on persistence after this check succeeds on your own USB. Persistence is not automatically encrypted or backed up. Keep a separate backup of important files.

Browsers, Garry and security tools

Firefox ESR is included. Use the panel's network icon for Wi-Fi or connect Ethernet. The Install Google Chrome shortcut downloads Chrome directly from Google after you accept its terms. Chrome is not preinstalled; saving its installation needs full-system persistence.

Local AI is optional. After the persistence check, open Garry → System → Set up local model to download the checksum-verified Qwen3 4B model (about 2.5 GB) and CPU engine. Space Edition does not replace this model with a larger one. Its speed depends on your PC. Local chat does not inherit cloud tools or automatically execute security programs.

Garry Security Desk provides manual access to Nmap, Wireshark, DNS/TLS checks and local system auditing. Nothing scans automatically. Choose an authorized target and review the action before running a tool. Wireshark's default use is opening saved captures; live capture requires the ordinary system permissions.

Your existing cloud operator is separate at GarryHQ. Sign in there for cloud history and connected accounts; those are not included in this image.

USB HQ Connection: pair your own device

This optional connection makes your USB visible in the private USB Devices page in GarryHQ. It is separate from native Codex Remote and the local chat model. An unpaired USB does not report to HQ.

  1. Confirm writable persistence in USB Health. Connect Ethernet or use the panel's network icon to join a trusted Wi-Fi network once inside Linux. Full-system persistence saves NetworkManager profiles so known networks can reconnect on later boots; home-only persistence cannot promise this. No Windows Wi-Fi passwords are imported.
  2. Sign in to GarryHQ → USB Devices and create a one-time pairing code.
  3. Open USB HQ Connection on the USB desktop and paste that code. A private identity is created for this device and saved on the USB. No owner login, pairing token or Wi-Fi password is included in the public ISO.
  4. Keep the PC awake and online, then check the device in HQ. Reporting normally runs about every two minutes; connection failures back off, so a status change is not instant. Reboot once and confirm both saved work and the connection resume.
In USB DevicesWhat it does
Status and healthShows the last received device report, with limited storage/memory health and network type. Offline or delayed data is not a live reading. Codex pairing may correctly remain unknown.
Health check / media checkQueues a bounded, read-only check for the paired device. Results return when it is online. A media check compares live files against their manifest; it does not repair or format a drive.
Pause / resumeHQ pause stops health and location reporting. The USB still makes minimal device-ID polls to receive Resume.
RevokeRevokes that device's token. It disables future connection attempts once the client receives the rejection.
DownloadFinds the current image for you to download and prepare manually. The HQ client does not download, install or flash updates remotely.

The local USB HQ Connection dialog also offers Stop, Resume and Forget. Forget removes the local token even when offline; if server revocation cannot be confirmed, use HQ's Revoke control when available.

Approximate IP location, not GPS. HQ estimates a city from the internet connection's IP. VPNs, mobile carriers and ISP routing can place it elsewhere. The USB sends no GPS position, Wi-Fi name, MAC address, raw logs, file contents or passwords. Health/media maintenance does not enable an arbitrary command shell, remote scan, disk change or reboot.

Native Codex Remote: owner setup

The image includes the official Codex CLI and a separate Codex Remote launcher. This is an experimental Linux host setup. It is separate from USB HQ Connection, the local Qwen model and the Cloud GarryHQ website.

  1. Boot with writable persistence and connect to the internet. Use a trusted PC; saved sign-in remains on the USB.
  2. Open Codex Remote on the desktop and choose 1 — Connect / sign in. Complete the official ChatGPT login with your own account/workspace. No login is included in the public ISO.
  3. Once enabled, its daemon starts on subsequent boots and retries after network interruptions. The host must stay awake and online. Choose 3 — Status to inspect local state.
  4. The launcher also offers 2 — Show pairing code for the experimental CLI pairing path. Phone pairing is not verified. Official mobile setup documents Mac/Windows desktop-app hosts and says it cannot be set up from the CLI. Do not treat a running daemon as a paired phone.

Choose 4 — Stop to stop the daemon and disable automatic reconnect; choose 5 — Re-enable to resume. Expired or revoked login requires sign-in again. This does not merge or move your existing cloud or Windows chats.

Official references: experimental CLI remote-control commands · supported mobile Remote setup.

If you see SQUASHFS or input/output errors

Those messages mean Linux could not read its live-system files. The cause can be damaged image contents, a failing flash drive, or an unstable USB connection. The message alone does not identify which one.

  1. Leave the boot USB connected. Shut down normally if the desktop responds. If frozen at a kernel panic, turn the computer off before reseating the drive.
  2. Try a direct USB port without a hub. If it boots, open Garry USB Health → Verify live files.
  3. Preserve readable personal files, compare the downloaded ISO against its published checksum, and use a different known-good spare USB if errors continue.

The live-file check detects some accidental damage. A pass is not a guarantee that a flash drive is healthy, genuine capacity, or reliable tomorrow. It does not repair the drive or validate every saved personal file.

Finish without losing work

Use the desktop's Log Out → Shut Down and wait until the PC is completely off before removing the USB. Closing Garry or Firefox does not shut down Linux. Choose Windows from your PC's normal boot menu to return to it.

This image is for compatible x86-64 Intel/AMD PCs, not phones, ARM PCs or Apple Silicon Macs. It runs Linux apps and websites, not ordinary Windows programs. Firmware, Secure Boot, graphics, Wi-Fi and other physical hardware need verification on your own machine.

Sources: Rufus · Rufus FAQ · Debian persistence implementation · Debian Live manual · Debian live-boot