> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux.md). # Deploying on Linux Device Protection ships as a plain `.deb` or `.rpm` package, so any tool that can copy a file and run a package manager can roll it out. Every method does the same thing: fetch the package for the host, install it with your user group token in the environment, and get users onto a fresh login shell afterwards. The guides below cover the tool-specific parts. Start with [Install Device Protection for Linux](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/install-device-protection-for-linux.md) for the token, the packages, and the install options they all share. The [Linux Rollout Reference](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md) has the detail behind the shared steps: token handling, reboots, repeat runs, device identity, and upgrades. ## Which guide to use | Situation | Use | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A single machine, or one you're testing on | [Install Device Protection for Linux](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/install-device-protection-for-linux.md) | | Existing fleet, agent checks in on a schedule | [Chef](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-chef.md) or [Puppet](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-puppet.md) | | Existing fleet, you push over SSH | [Ansible](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-ansible.md) | | New cloud instances | [cloud-init](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-cloud-init.md) or [Terraform](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-terraform.md) | | Machines built from an image you control | [Packer and golden images](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-in-golden-images.md) | | Container images for CI or build jobs | [Device Protection in Containers](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-containers.md) | | Dev Containers and Codespaces | [Device Protection in Dev Containers](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-dev-containers.md) | | CI/CD runners and pipelines | [GitHub Actions](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-github-actions.md), [GitLab CI/CD](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-gitlab-ci.md), [Jenkins](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-jenkins.md), [CircleCI](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-circleci.md), [Azure Pipelines](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-azure-pipelines.md), [Bitbucket Pipelines](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-bitbucket-pipelines.md), or [Buildkite](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-buildkite.md) | Every guide follows the same shape: the configuration for that tool, how to verify the rollout, and what to check when something breaks. If your MDM manages Linux devices, push the install command through it as a script. Otherwise, use the configuration management or provisioning tool you already run. {% hint style="info" %} Device Protection secures the machines your developers work on. To scan servers for vulnerable packages instead, use [VM Scanning](/virtual-machine-scanning/virtual-machines-overview.md). {% endhint %} ## Before you roll out * **Decide which version the fleet gets.** The download URL always resolves to the newest release. Mirror the package if you want the fleet to move on your schedule instead. See [Versions and upgrades](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md#versions-and-upgrades). * **Guard repeat runs.** Check whether the agent is already installed before downloading, so a second run does nothing. See [Make repeat runs cheap](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md#make-repeat-runs-cheap). * **Plan the reboot.** Protection is only complete after a new login shell, so don't restart machines people are working on from an automation run. See [When protection becomes active](/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference.md#when-protection-becomes-active). * **Roll out to a pilot group first.** Each token belongs to one [user group](/aikido-device-protection/deploying-aikido-endpoint/user-groups-for-aikido-endpoint.md), so give your pilot hosts their own token and widen from there. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.