> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux.md). # Deploying on Linux Device Protection ships as a plain `.deb` or `.rpm` package, so any tool that can copy a file and run a package manager can roll it out. Every method does the same thing: fetch the package for the host, install it with your user group token in the environment, and get users onto a fresh login shell afterwards. The guides below cover the tool-specific parts. Start with [Install Device Protection for Linux](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/install-device-protection-for-linux.md) for the token, the packages, and the install options they all share. The [Linux Rollout Reference](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md) has the detail behind the shared steps: token handling, reboots, repeat runs, device identity, and upgrades. ## Which guide to use | Situation | Use | | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A single machine, or one you're testing on | [Install Device Protection for Linux](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/install-device-protection-for-linux.md) | | Existing fleet, agent checks in on a schedule | [Chef](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-chef.md) or [Puppet](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-puppet.md) | | Existing fleet, you push over SSH | [Ansible](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-ansible.md) | | New cloud instances | [cloud-init](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-cloud-init.md) or [Terraform](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-terraform.md) | | Machines built from an image you control | [Packer and golden images](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-in-golden-images.md) | | Container images for CI or build jobs | [Device Protection in Containers](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-containers.md) | | Dev Containers and Codespaces | [Device Protection in Dev Containers](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-dev-containers.md) | | Buildkite agents and pipelines | [Device Protection in Buildkite](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-buildkite.md) | Every guide follows the same shape: the configuration for that tool, how to verify the rollout, and what to check when something breaks. If your MDM manages Linux devices, push the install command through it as a script. Otherwise, use the configuration management or provisioning tool you already run. {% hint style="info" %} Device Protection secures the machines your developers work on. To scan servers for vulnerable packages instead, use [VM Scanning](/virtual-machine-scanning/virtual-machines-overview.md). {% endhint %} ## Before you roll out * **Decide which version the fleet gets.** The download URL always resolves to the newest release. Mirror the package if you want the fleet to move on your schedule instead. See [Versions and upgrades](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md#versions-and-upgrades). * **Guard repeat runs.** Check whether the agent is already installed before downloading, so a second run does nothing. See [Make repeat runs cheap](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md#make-repeat-runs-cheap). * **Plan the reboot.** Protection is only complete after a new login shell, so don't restart machines people are working on from an automation run. See [When protection becomes active](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md#when-protection-becomes-active). * **Roll out to a pilot group first.** Each token belongs to one [user group](/aikido-device-protection/deploying-aikido-endpoint/user-groups-for-aikido-endpoint.md), so give your pilot hosts their own token and widen from there. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.