Rethinking PHP: I Built a 30MB "Web Operating Environment" Inspired by OS Architecture ????

Introduction

Let's face it: when people talk about PHP, they usually think of traditional MVC frameworks like Laravel or monolithic CMS platforms like WordPress.

But what if we treated a PHP/Linux stack not just as an app server, but as a Web Operating Environment?

For the past few months, I've been working on Domain System—a lightweight, modular, and hyper-resilient web application platform built from the ground up under strict SOLID and Dependency Inversion (DIP) principles. It takes architecture cues from real Operating Systems (Micro-kernel, protection rings, process-like isolation) and packs it all into just ~30 MB uncompressed.

???? The Core Concept: OS Architecture for the Web

Domain System is completely agnostic of databases and environment setups. It functions by dividing privileges into two strict layers:

• Ring 0 (SystemApps): The core micro-kernel. It handles vital system infrastructure like dynamic routing, atomic persistence, capabilities-based security, telemetry, and contract diagnostics. The core never knows what the business logic does.
• Ring 3 (UserPlugins): Where your application actually lives. Plugins are injected entirely through Contracts (Interfaces). They run with limited privileges and cannot hijack Ring 0 core instances.

???? Key Features I'm Proud Of

????️ 1. Gatekeeper & Sandboxing

To prevent malicious code execution from third-party ZIP extensions, the installation engine extracts uploads into a quarantine zone, scans the source code for vulnerabilities (like Path Traversal/Zip-Slip), and blocks privilege escalation before moving anything to production.

???? 2. No-Break Shield & Atomic JSON Store

Say goodbye to the White Screen of Death (WSOD). The platform runs an intelligent Circuit Breaker combined with an atomic JSON storage engine (LOCK_EX + atomic writes), schema self-healing diagnostics (SchemaDoctorInterface), and a 1-Click Snapshot & Rollback mechanism inside the monitoring panel.

????️ 3. Flex Builder FSE (Full Site Editing) with Auto-Reflow

I built a frontend layout engine (src/Core/Theme/Parts) where the editor preview and live frontend share the exact same compiler and validation rules. It supports responsive visibility for 4 screen resolutions. If elements in a CSS Grid column are hidden on mobile, the layout engine collapses the column and automatically recalculates the template grid on the fly.

???? 4. Built for the "Vibe Coding" Era (AI-First DX)

I wanted this project to welcome AI-assisted development without turning into a spaghetti code nightmare. The repo comes with strict .cursorrules, .clinerules, and an AI_CONTRACT_GUIDE.md. AI coding agents (like Claude Code, Cursor, or Cline) instantly read these rules and generate 100% strictly-typed, contract-compliant Ring 3 plugins. There's also a CLI boilerplate generator (php os-cli.php make:plugin ).

???? Reliability

To sleep soundly at night, the platform's engine of Hooks (Event-Driven) and Contracts is currently validated by 433 automated tests (over 2,340 assertions) using PHPUnit.

????️ Tech Stack

• Language: PHP 8.2+ (Strict typing, pure DIP)
• Database: Agnostic (Built-in support for MySQL/MariaDB or SQLite via PDO, plus Atomic JSON)
• Architecture: Modular Micro-Kernel / Clean Architecture

???? I'd Love Your Feedback!

This project has been an incredible journey in push-to-the-limit software engineering using modern PHP.

I would absolutely love to hear the community's thoughts on this architecture:

1. What do you think about bringing the Ring 0 / Ring 3 security mindset into a web application platform?
2. How are you setting up your architecture rules to prevent AI coding tools from breaking your design patterns?

Check out the repository, read the docs, and feel free to roast or praise the code:

???? GitHub: hadelrachid/domain-system