Talos Linux System Extensions

This repo serves as a central place for publishing extensions to Talos Linux. Extensions enable additional functionality beyond the default Talos Linux capabilities. Things like gVisor, GPU support, etc. are good candidates for extensions.

Using Extensions

Extensions in this repo are published as container images. These images can be added to Talos Linux boot asset to produce a final boot asset containing a base Talos initramfs and a set of system extensions appended to it.

The extension image is composed of a manifest.yaml file that provides information and compatibility information, as well as a rootfs that contains things like compiled binaries that are bind-mounted into the system.

Installing Extensions

In order to find a container reference for a system extension compatible with your Talos Linux version, you can use the following command:

crane export ghcr.io/siderolabs/extensions:v<talos-version> | tar x -O image-digests | grep <extension-name>

For example, to find a compatible version of the gasket-driver extension for Talos v1.5.3, you can run:

$ crane export ghcr.io/siderolabs/extensions:v1.5.3 | tar x -O image-digests | grep gasket-driver
ghcr.io/siderolabs/gasket-driver:97aeba58-v1.5.3@sha256:c786edb356edae3b451cb82d5322f94e54ea0710195181b93ae37ccc8e7ba908

Please always use the pinned digest when referencing an extension image.

All extensions are signed with Google Accounts OIDC issuer matching @siderolabs.com domain, so the image signatures can be verified, for example:

cosign verify --certificate-identity-regexp '@siderolabs\.com$' --certificate-oidc-issuer https://accounts.google.com ghcr.io/siderolabs/extensions:v1.5.3
cosign verify --certificate-identity-regexp '@siderolabs\.com$' --certificate-oidc-issuer https://accounts.google.com ghcr.io/siderolabs/gasket-driver:97aeba58-v1.5.3@sha256:c786edb356edae3b451cb82d5322f94e54ea0710195181b93ae37ccc8e7ba908

Extension Catalog

Official Extension Tiers

Talos Linux provides several official system extensions, which are split into the following tiers based on support level:

Tier	:green_square: core	:yellow_square: extra	:white_large_square: contrib
Description	Extensions fully supported by Sidero Labs	Some level of support, might vary per extension	Supported by the community
Supported by Sidero Labs	🟢	✔️ (best effort)	❌
Support Channel	GitHub Issues, Discussions, Sidero Labs commercial support	GitHub Issues and Discussions	GitHub Discussions in “contrib” section
Updates managed by Sidero Labs	🟢	🟢	✔️ (best effort)
Documentation	🟢	✔️ (best effort)	❌
Automated tests	🟢 (or no automated tests required, e.g. firmware)	✔️ (best effort)	❌
SBOMs	🟢 (or not required, e.g. firmware)	✔️ (best effort)	❌ (community might provide some, but not required)
CVE Scan	🟢	✔️ (scan is done, but CVEs don’t block the release)	❌
Compatibility/Build issues	🟢	✔️ (best effort)	❌ (extension will be disabled if it fails to build)

Container Runtimes

Name	Tier	Image	Version	Description
crun	:yellow_square: extra	ghcr.io/siderolabs/crun	1.28	This system extension provides crun using containerd's runtime handler.
ecr-credential-provider	:yellow_square: extra	ghcr.io/siderolabs/ecr-credential-provider	v1.36.1	This system extension provides a binary which implements Kubelet's CredentialProvider API to authenticate against AWS' Elastic Container Registry and pull images.
gvisor	:green_square: core	ghcr.io/siderolabs/gvisor	20260714.0	This system extension provides gVisor using containerd's runtime handler.
gvisor-debug	:yellow_square: extra	ghcr.io/siderolabs/gvisor-debug	v1.0.0	This system extension enables gVisor debug logging.
harbor-credential-provider	:yellow_square: extra	ghcr.io/siderolabs/harbor-credential-provider	v0.0.1	This system extension provides a binary which implements Kubelet's CredentialProvider API to authenticate against Harbor / 8gears Container Registry via Workload Identity Federation using short-lived Service Account tokens instead of static pull secrets.
kata-containers	:yellow_square: extra	ghcr.io/siderolabs/kata-containers	3.32.0	This system extension provides kata-container using containerd's runtime handler.
kata-containers-snp	:yellow_square: extra	ghcr.io/siderolabs/kata-containers-snp	3.32.0	This system extension provides AMD SEV-SNP confidential VMs for Kata Containers (Confidential Containers), using containerd's runtime handlers kata-qemu-snp and kata-qemu-coco-dev. Requires the kata-containers extension.
soci-snapshotter	:yellow_square: extra	ghcr.io/siderolabs/soci-snapshotter	v0.14.1	This system extension provides AWS SOCI Snapshotter using containerd's runtime handler.
spin	:yellow_square: extra	ghcr.io/siderolabs/spin	v0.25.1	This system extension provides support for spin runtime (WebAssembly) containers.
stargz-snapshotter	:green_square: core	ghcr.io/siderolabs/stargz-snapshotter	v0.18.2	This system extension provides Stargz Snapshotter using containerd's runtime handler.
wasmedge	:yellow_square: extra	ghcr.io/siderolabs/wasmedge	v0.6.1	This system extension provides support for WasmEdge runtime (WebAssembly) containers.
youki	:white_large_square: contrib	ghcr.io/siderolabs/youki	0.6.0	This system extension provides youki using containerd's runtime handler.

Firmware

Name	Tier	Image	Version	Description
amd-ucode	:green_square: core	ghcr.io/siderolabs/amd-ucode	20260622	This system extension provides AMD microcode binaries.
bnx2-bnx2x	:green_square: core	ghcr.io/siderolabs/bnx2-bnx2x	20260622	This system extension provides bnx2 and bnx2x binaries.
chelsio-firmware	:white_large_square: contrib	ghcr.io/siderolabs/chelsio-firmware	20260622	This system extension provides Chelsio NIC firmware binaries.
intel-ice-firmware	:green_square: core	ghcr.io/siderolabs/intel-ice-firmware	20260622	This system extension provides Intel Ice firmware binaries.
intel-ucode	:green_square: core	ghcr.io/siderolabs/intel-ucode	20260512	This system extension provides Intel microcode binaries.
qlogic-firmware	:green_square: core	ghcr.io/siderolabs/qlogic-firmware	20260622	This system extension provides firmware for QLogic devices.
realtek-firmware	:green_square: core	ghcr.io/siderolabs/realtek-firmware	20260622	This system extension provides realtek firmware binaries.
revpi-firmware	:white_large_square: contrib	ghcr.io/siderolabs/revpi-firmware	v1.0.0	This system extension provides tools e.g. udev rules for the RevolutionPi platform.

Direct Rendering Manager (DRM)

Name	Tier	Image	Version	Description
amdgpu	:green_square: core	ghcr.io/siderolabs/amdgpu	20260622-VERSION	This system extension provides AMDGPU firmware binaries and kernel modules.
i915	:green_square: core	ghcr.io/siderolabs/i915	20260622-VERSION	This system extension provides Intel GPU microcode binaries and kernel modules.
intel-npu	:white_large_square: contrib	ghcr.io/siderolabs/intel-npu	20260622-VERSION	This system extension provides Intel NPU firmware binaries and kernel modules.
panfrost	:white_large_square: contrib	ghcr.io/siderolabs/panfrost	20260622-VERSION	This system extension provides ARM Mali Midgard, Bifrost, and Valhall firmware binaries and kernel modules.
rockchip-rknn	:white_large_square: contrib	ghcr.io/siderolabs/rockchip-rknn	VERSION	This system extension provides kernel modules for the RKNN NPU found in Rockchip SBCs like the RK3588.
vc4	:yellow_square: extra	ghcr.io/siderolabs/vc4	VERSION	This system extension provides kernel modules for Broadcom VideoCore GPU.
xe	:green_square: core	ghcr.io/siderolabs/xe	20260622-VERSION	This system extension provides Intel GPU microcode binaries and kernel modules.

Drivers

Name	Tier	Image	Version	Description
amazon-ena	:green_square: core	ghcr.io/siderolabs/amazon-ena	2.17.0-VERSION	This system extension provides Amazon ENA kernel modules built against a specific Talos version. ENA is a networking interface designed to make good use of modern CPU features and system architectures.
chelsio-drivers	:yellow_square: extra	ghcr.io/siderolabs/chelsio-drivers	VERSION	This system extension provides Chelsio network drivers.
gasket-driver	:yellow_square: extra	ghcr.io/siderolabs/gasket-driver	5815ee3-VERSION	This system extension provides google gasket driver kernel modules built against a specific Talos version. This driver is required for PCIe and M.2 Google Coral accelerators. There are 2 kernel modules ("gasket" and "apex") required to enable this driver.
gpio-pinctrl	:yellow_square: extra	ghcr.io/siderolabs/gpio-pinctrl	VERSION	Intel Apollo Lake GPIO/Pinctrl drivers. Provides pinctrl-intel and pinctrl-broxton kernel modules for GPIO access on Intel Apollo Lake platforms (INT3452 ACPI device).
hailort	:yellow_square: extra	ghcr.io/siderolabs/hailort	4.23.0	Driver for HailoRT family of AI hardware (eg. Hailo-8L) and is required for PCIe and M.2 Hailo accelerators.
joydev	:yellow_square: extra	ghcr.io/siderolabs/joydev	VERSION	This system extension provides the joydev kernel module built against a specific Talos version. This kernel module provides the Linux joystick interface (/dev/input/js*) for the Gamepad API. It is required for game streaming software like Sunshine to expose gamepad input to applications that use the legacy joystick API or the browser Gamepad API via evdev-to-joydev translation.
mei	:green_square: core	ghcr.io/siderolabs/mei	VERSION	This system extension provides Intel Management Engine drivers kernel modules built against a specific Talos version. This driver enables the Intel Management Engine, a prerequisite for Intel Arc discrete GPUs.
mellanox-mstflint	:white_large_square: contrib	ghcr.io/siderolabs/mellanox-mstflint	4.34.1-4-VERSION	This system extension provides mstflint.
tenstorrent	:yellow_square: extra	ghcr.io/siderolabs/tenstorrent	2.10.0	Driver for Tenstorrent AI processing hardware
thunderbolt	:yellow_square: extra	ghcr.io/siderolabs/thunderbolt	VERSION	This system extension provides Thunderbolt/USB4 drivers kernel modules built against a specific Talos version. It enables support for Thunderbolt/USB4 devices, including those used for networking. WARNING: This extension automatically authorizes all Thunderbolt devices during system boot, which poses potential security risks. Use at your own discretion.
uhid	:yellow_square: extra	ghcr.io/siderolabs/uhid	VERSION	This system extension provides the uhid kernel module built against a specific Talos version. This kernel module provides user-space HID device support. Applications can create virtual HID devices (such as gamepads and controllers) via /dev/uhid, which is required for game streaming software like Sunshine to emulate gamepad input from Moonlight clients.
uinput	:yellow_square: extra	ghcr.io/siderolabs/uinput	VERSION	This system extension provides the uinput kernel module built against a specific Talos version. This kernel module makes it possible to emulate input devices from userspace. By writing to /dev/uinput (or /dev/input/uinput) device, a process can create a virtual input device with specific capabilities. Once this virtual device is created, the process can send events through it, that will be delivered to userspace and in-kernel consumers.
usb-audio-drivers	:white_large_square: contrib	ghcr.io/siderolabs/usb-audio-drivers	VERSION	This system extension provides ALSA USB Audio kernel modules built against a specific Talos version. This enables USB audio interfaces (class-compliant sound cards, headsets, DACs) on Talos Linux.
usb-modem-drivers	:yellow_square: extra	ghcr.io/siderolabs/usb-modem-drivers	VERSION	This system extension provides USB modem drivers kernel modules built against a specific Talos version. This driver is required for USB modems to function. This extension includes all the drivers needed to operate any USB modem under Linux, but your device might not require all of them. Read your device's docs to learn which drivers you need, or just enable them all as a starting point.
v4l-uvc-drivers	:yellow_square: extra	ghcr.io/siderolabs/v4l-uvc-drivers	VERSION	This system extension provides the Video4Linux kernel modules required for USB Video Class devices built against a specific Talos version. This driver enables Video4Linux devices such as webcams.
xdma-driver	:yellow_square: extra	ghcr.io/siderolabs/xdma-driver	8721136-VERSION	Xilinx DMA Driver

Digital Video Broadcasting (DVB)

Name	Tier	Image	Version	Description
dvb-cx23885	:white_large_square: contrib	ghcr.io/siderolabs/dvb-cx23885	VERSION	This system extension provides the dvb kernel modules required for Hauppage WinTV-quadHD PCIe tuner built against a specific Talos version. Includes the firmware required.
dvb-m88ds3103	:white_large_square: contrib	ghcr.io/siderolabs/dvb-m88ds3103	VERSION	This system extension provides the dvb-demod-m88ds3103.fw firmware for DVB-S/S2 PCIe cards like DVBSky S952. It is intended to be used as a dependency on existing DVB driver extension dvb-cx23885 that provides the necessary kernel modules.

Miscellaneous

Name	Tier	Image	Version	Description
binfmt-misc	:yellow_square: extra	ghcr.io/siderolabs/binfmt-misc	VERSION	This system extension provides kernel module driver for binfmt-misc built against a specific Talos version.
glibc	:green_square: core	ghcr.io/siderolabs/glibc	2.43	This system extension provides glibc.

Network

Name	Tier	Image	Version	Description
bird2	:white_large_square: contrib	ghcr.io/siderolabs/bird2	2.18	bird2 routing daemon for Talos. bird2cl can be used to interface with the daemon (lightweight CLI only!). More info: https://bird.network.cz/
cloudflared	:white_large_square: contrib	ghcr.io/siderolabs/cloudflared	2026.7.2	Cloudflare Tunnel securely connects resources to Cloudflare without a public IP. A lightweight daemon (cloudflared) creates outbound-only connections to Cloudflare, allowing safe access to services like HTTP, SSH, remote desktops, and other protocols. More info: https://github.com/cloudflare/cloudflared/
lldpd	:yellow_square: extra	ghcr.io/siderolabs/lldpd	1.0.22	LLDP adds a LLDP discovery service to Talos. LLDP cli can be used to interface with the daemon.
nebula	:white_large_square: contrib	ghcr.io/siderolabs/nebula	1.10.3	A scalable overlay networking tool with a focus on performance, simplicity and security
netbird	:white_large_square: contrib	ghcr.io/siderolabs/netbird	0.74.7	NetBird combines a WireGuard®-based overlay network with Zero Trust Network Access, providing a unified open source platform for reliable and secure connectivity.
newt	:white_large_square: contrib	ghcr.io/siderolabs/newt	1.15.0	Newt is a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. By using Newt, you don't need to manage complex WireGuard tunnels and NATing. More info: https://github.com/fosrl/newt
tailscale	:yellow_square: extra	ghcr.io/siderolabs/tailscale	1.98.9	Tailscale connects your team's devices and development environments for easy access to remote resources.
zerotier	:white_large_square: contrib	ghcr.io/siderolabs/zerotier	1.16.2	Connect your Talos cluster into a zerotier network

Storage

Name	Tier	Image	Version	Description
btrfs	:yellow_square: extra	ghcr.io/siderolabs/btrfs	VERSION	This system extension provides kernel module driver and userspace tools for BTRFS built against a specific Talos version.
drbd	:yellow_square: extra	ghcr.io/siderolabs/drbd	9.3.3-VERSION	This system extension provides kernel module driver for DRBD built against a specific Talos version.
fuse3	:green_square: core	ghcr.io/siderolabs/fuse3	3.18.2	This system extension provides fuse3 functionality.
iscsi-tools	:green_square: core	ghcr.io/siderolabs/iscsi-tools	v0.2.0	This system extension provides iscsi-tools.
mdadm	:warning: deprecated	ghcr.io/siderolabs/mdadm	v4.6	This system extension is no-op, for backward compatibility.
multipath-tools	:yellow_square: extra	ghcr.io/siderolabs/multipath-tools	v0.1.0	This system extension provides multipath-tools.
nfs-utils	:white_large_square: contrib	ghcr.io/siderolabs/nfs-utils	v0.1.1	This system extension provides rpcbind and rpc.statd for NFSv3 file locking support. rpcbind is a server that converts RPC program numbers into universal addresses. rpc.statd is the NSM (Network Status Monitor) service daemon that notifies NFS peers of restarts. These services are required for NFSv3 mounts with file locking support.
nfsd	:yellow_square: extra	ghcr.io/siderolabs/nfsd	VERSION	This system extension provides kernel module driver for NFSD built against a specific Talos version.
nfsrahead	:white_large_square: contrib	ghcr.io/siderolabs/nfsrahead	2.8.3	This system extension provides nfsrahead, a tool to configure the readahead for NFS mounts.
px-fuse	:yellow_square: extra	ghcr.io/siderolabs/px-fuse	8b52ef67d261369cbc93f132db299e5dcf64ad7c-VERSION	This system extension provides kernel module driver for Portworx px-fuse built against a specific Talos version.
trident-iscsi-tools	:white_large_square: contrib	ghcr.io/siderolabs/trident-iscsi-tools	v0.0.1	This system extension provides the tools and binaries used by the NetApp Trident CSI for iSCSI. It contains lsscsi, ls, free, pgrep, cat and dd.
zfs	:yellow_square: extra	ghcr.io/siderolabs/zfs	2.4.3-VERSION	This system extension provides the ZFS kernel module, the ZFS utilities, and a service to import all ZFS pools on start and unmount all pools on stop.

Power

Name	Tier	Image	Version	Description
nut-client	:white_large_square: contrib	ghcr.io/siderolabs/nut-client	2.8.5	This system extension provides the network-ups-tools upsmon service.

Guest Agents

Name	Tier	Image	Version	Description
hyperv-guest-agent	:yellow_square: extra	ghcr.io/siderolabs/hyperv-guest-agent	6.18.39	This system extension provides the Hyper-V guest integration daemons: hv_kvp_daemon, which reports the guest IP, hostname, and OS to the host (populating Get-VMNetworkAdapter), and hv_vss_daemon, for application-consistent checkpoints.
metal-agent	:green_square: core	ghcr.io/siderolabs/metal-agent	v0.1.6	This system extension provides talos-metal-agent
qemu-guest-agent	:yellow_square: extra	ghcr.io/siderolabs/qemu-guest-agent	11.0.2	This system extension provides the QEMU Guest Agent service.
vmtoolsd-guest-agent	:yellow_square: extra	ghcr.io/siderolabs/vmtoolsd-guest-agent	v1.5.0	This system extension provides talos-vmtoolsd
xen-guest-agent	:yellow_square: extra	ghcr.io/siderolabs/xen-guest-agent	0.4.0-g5c274e6	xen-guest-agent communicates information and metrics with the Xen host.

NVIDIA GPU

Name	Tier	Image	Version	Description
nonfree-kmod-nvidia-lts	:green_square: core	ghcr.io/siderolabs/nonfree-kmod-nvidia-lts	580.173.02-VERSION	This system extension provides nvidia proprietary kernel modules built against a specific Talos version.
nonfree-kmod-nvidia-production	:green_square: core	ghcr.io/siderolabs/nonfree-kmod-nvidia-production	595.71.05-VERSION	This system extension provides nvidia proprietary kernel modules built against a specific Talos version.
nvidia-container-toolkit-lts	:green_square: core	ghcr.io/siderolabs/nvidia-container-toolkit-lts	580.173.02-v1.19.1	This system extension provides nvidia runtime and its dependencies using NVIDIA's runtime handler.
nvidia-container-toolkit-production	:green_square: core	ghcr.io/siderolabs/nvidia-container-toolkit-production	595.71.05-v1.19.1	This system extension provides nvidia runtime and its dependencies using NVIDIA's runtime handler.
nvidia-fabricmanager-lts	:green_square: core	ghcr.io/siderolabs/nvidia-fabricmanager-lts	580.173.02	This system extension provides the Nvidia fabricmanager for GPUs that need NVLink support.
nvidia-fabricmanager-production	:green_square: core	ghcr.io/siderolabs/nvidia-fabricmanager-production	595.71.05	This system extension provides the Nvidia fabricmanager for GPUs that need NVLink support.
nvidia-gdrdrv-device	:yellow_square: extra	ghcr.io/siderolabs/nvidia-gdrdrv-device	v2.5.2	This system extension provides NVIDIA GPUDirect RDMA (gdrcopy) device file. The gdrdrv kernel module enables low-latency GPU memory access for RDMA operations.
nvidia-open-gpu-kernel-modules-lts	:green_square: core	ghcr.io/siderolabs/nvidia-open-gpu-kernel-modules-lts	580.173.02-VERSION	This system extension provides nvidia open source driver kernel modules built against a specific Talos version.
nvidia-open-gpu-kernel-modules-production	:green_square: core	ghcr.io/siderolabs/nvidia-open-gpu-kernel-modules-production	595.71.05-VERSION	This system extension provides nvidia open source driver kernel modules built against a specific Talos version.

Tools

Name	Tier	Image	Version	Description
ctr	:green_square: core	ghcr.io/siderolabs/ctr	v2.3.3	This extension provides ctr containerd helper binary
nvme-cli	:white_large_square: contrib	ghcr.io/siderolabs/nvme-cli	v2.14	This system extension provides the NVMe command line interface.
util-linux-tools	:white_large_square: contrib	ghcr.io/siderolabs/util-linux-tools	2.42.2	This system extension provides a minimal util-linux package.

Building Extensions

In the current form, building extensions requires the use of our bldr tool. It is highly recommended to take a look at an existing extension as a template for building your own. The rough flow should look like the following:

• Create a manifest.yaml file that contains information about your system extension. See instructions below for this file.
• Create a pkg.yaml file that details the full flow of downloading, building, and installing your application.
• Once you have these, add your extension to the TARGETS list in the Makefile.
• You can now build your extension using make like make <extension-name> PLATFORM=linux/amd64
• If you wish to output the contents of the image and validate your install, you can issue make local-<extension-name> PLATFORM=linux/amd64 DEST=_out. The contents will then be present in the _out directory.

Local testing and development

macOS: some targets (e.g. descriptions.yaml) need GNU tar.

To build and push an extension to a local registry use:

make <extension-name> PUSH=true REGISTRY=127.0.0.1:5005 USERNAME=<username> PUSH=true

Instructions on how to set up the builder can be found here

Building the Extensions Catalog Locally

The extensions target builds the catalog image (the image-digests and descriptions.yaml of all TARGETS).

You can build the catalog scoping it with TARGETS/NONFREE_TARGETS with:

make extensions PUSH=true REGISTRY=host.docker.internal:5005 USERNAME=<your-name> \
  TARGETS="<extension-name>" NONFREE_TARGETS= PUSH=true TAG=<target-talos-version>

Creating manifest.yaml

The manifest.yaml file should match the following format:

version: v1alpha1
metadata:
  name: <extension name>
  version: <version of the package the extension installs>-<version of the extensions repo (tracks with talos version)>
  author: Andrew Rynhard
  description: |
    <detailed description of the extension/package>
  ## The compatibility section is "optional" but highly recommended to specify a Talos version that
  ## has been tested and known working for this extension.
  compatibility:
    talos:
      version: ">= v1.0.0"

Creating pkg.yaml

Creating a pkg.yaml file is the normal process from bldr. See instructions here for details and examples on this format. Using other existing extensions in this repo for tips is also highly recommended. One important note is that the final directory tree of the generated package should look like this example from the gvisor package:

├── manifest.yaml
└── rootfs
    ├── etc
    │   └── cri
    │       └── conf.d
    │           └── gvisor.part
    └── usr
        └── local
            └── bin
                ├── containerd-shim-runsc-v1
                └── runsc

Note that the manifest.yaml file lives at the root, while all installed files live under /rootfs with the full tree of where they should live on the eventual Talos Linux install.

rootfs Restrictions

The following restrictions are applied to the contents of the rootfs of the system extension:

• no special files (FIFOs, devices, etc.)
• no world-writeable files or directories

Any paths in the rootfs should be contained within the following hierarchies:

• /etc/cri/conf.d/
• /usr/lib/firmware/
• /usr/lib/modules/
• /usr/lib/ld-linux-x86-64.so.2 (glibc)
• /usr/lib/ld-linux-aarch64.so.1 (glibc)
• /usr/bin/ldconfig (glibc)
• /etc/ld.so.conf (glibc)
• /etc/ld.so.cache (glibc)
• /usr/bin/nvidia-modprobe (nvidia)
• /usr/bin/nvidia-pcc (nvidia)
• /usr/bin/nvidia-smi (nvidia)
• /usr/bin/nvidia-ctk (nvidia)
• /usr/bin/nvidia-cdi-hook (nvidia)
• /usr/bin/nvme (standard path tools expect this)
• /usr/lib/udev/rules.d/
• /usr/local/
• /usr/share/glvnd/
• /usr/share/egl/
• /etc/vulkan/

Dependency Diagram