Deploying on Linux

Device Protection ships as a plain .deb or .rpm package, so any tool that can copy a file and run a package manager can roll it out. Every method does the same thing: fetch the package for the host, install it with your user group token in the environment, and get users onto a fresh login shell afterwards. The guides below cover the tool-specific parts.

Start with Install Device Protection for Linux for the token, the packages, and the install options they all share. The Linux Rollout Reference has the detail behind the shared steps: token handling, reboots, repeat runs, device identity, and upgrades.

Which guide to use

Situation	Use
A single machine, or one you're testing on	Install Device Protection for Linux
Existing fleet, agent checks in on a schedule	Chef or Puppet
Existing fleet, you push over SSH	Ansible
New cloud instances	cloud-init or Terraform
Machines built from an image you control	Packer and golden images
Container images for CI or build jobs	Device Protection in Containers
Dev Containers and Codespaces	Device Protection in Dev Containers
Buildkite agents and pipelines	Device Protection in Buildkite

Every guide follows the same shape: the configuration for that tool, how to verify the rollout, and what to check when something breaks.

If your MDM manages Linux devices, push the install command through it as a script. Otherwise, use the configuration management or provisioning tool you already run.

Device Protection secures the machines your developers work on. To scan servers for vulnerable packages instead, use VM Scanning.

Before you roll out

• Decide which version the fleet gets. The download URL always resolves to the newest release. Mirror the package if you want the fleet to move on your schedule instead. See Versions and upgrades.
• Guard repeat runs. Check whether the agent is already installed before downloading, so a second run does nothing. See Make repeat runs cheap.
• Plan the reboot. Protection is only complete after a new login shell, so don't restart machines people are working on from an automation run. See When protection becomes active.
• Roll out to a pilot group first. Each token belongs to one user group, so give your pilot hosts their own token and widen from there.