Install Device Protection for Linux

On Linux, Aikido Device Protection ships as a .deb package for Debian-family distributions and an .rpm package for Red Hat-family ones.

Most rollouts use the automated install, where the Aikido dashboard gives you a command that downloads, installs, and registers the agent in one step. Use the manual install when you want the package file itself, for example to push it through your own configuration management, to stage it on an internal mirror, or to install on a host that can't reach the download URL directly.

Linux devices need systemd and root access. See Supported Ecosystems for the distributions and versions Device Protection supports.

Install with one command

1

Get the install command

1. Go to Device Protection and open the Devices tab.
2. Click Connect Device in the top right.
3. Choose Manual install.
4. Select the user group the device should join, then copy the Linux install command.

2

Run it on the device

Run the command as root on the device. It picks the right package for the distribution and architecture, installs it, and registers the device against the token in the command.

Choose the install flavor

The command the dashboard shows installs the desktop flavor, which is what a developer's laptop or workstation needs. A machine without a desktop takes an extra flag, and the rest of the command stays the same.

Desktop

A laptop or workstation somebody works on. No flag.

curl -fsSL https://github.com/AikidoSec/safe-chain/raw/refs/heads/main/install-scripts/install-endpoint-linux.sh | sudo sh -s -- --token "$AIKIDO_TOKEN"

Server or VM

A machine with no desktop session: a build server, a CI runner, a Docker or Kubernetes host, a cloud VM developers SSH into.

curl -fsSL https://github.com/AikidoSec/safe-chain/raw/refs/heads/main/install-scripts/install-endpoint-linux.sh | sudo sh -s -- --token "$AIKIDO_TOKEN" --headless

Container image

The agent running inside a container, installed while the image is built.

curl -fsSL https://github.com/AikidoSec/safe-chain/raw/refs/heads/main/install-scripts/install-endpoint-linux.sh | sudo sh -s -- --token "$AIKIDO_TOKEN" --container

Container images need a few more pieces, such as the entrypoint that starts the agent. See Device Protection in Containers.

What each flavor changes:

Flavor	Flag	What changes
Desktop	none	Tray icon and the local dashboard, GTK and WebKit pulled in as recommended packages, transparent eBPF datapath. Complete after a new login shell or reboot
Server or VM	--headless	No tray icon, and GTK, WebKit, and the tray extensions are left out. Same transparent eBPF datapath. Still needs a reboot
Container image	--container	No tray icon or desktop packages, explicit proxy on 127.0.0.1:7654 instead of the eBPF datapath, CA held in memory instead of the OS keyring, no reboot

--container is for the agent running inside a container. A Docker, Kubernetes, or Jenkins host that builds and runs containers is a server, so use --headless there.

--ci-cd was the earlier name for --container. The install script still accepts it, but use --container in anything you write now.

Manual install

The manual install uses the same packages. The difference is that you download the file and supply the token yourself, through the AIKIDO_TOKEN environment variable that the package reads while it installs.

Before you start, collect:

• Your user group token. It's part of the install command shown under Connect Device.
• The device architecture. Run uname -m. x86_64 means amd64, aarch64 means arm64.
• The flavor, if the machine is not a desktop. There is no flag to pass here, so set it in the environment of the package manager: AIKIDO_HEADLESS=1 for a server or VM, AIKIDO_CONTAINER=1 together with AIKIDO_CI_CD=1 for a container image, because packages up to 1.8.2 read only the older name. Also tell the package manager to skip recommended packages, --no-install-recommends on the Debian family and --setopt=install_weak_deps=False on the Red Hat family, which is what keeps the tray and the desktop libraries off the machine.

Ubuntu / Debian

Download the package for your architecture:

Architecture	Package
amd64 (x86_64)	EndpointProtection-amd64.deb
arm64 (aarch64)	EndpointProtection-arm64.deb

Then install it:

curl -fLO https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.deb
sudo AIKIDO_TOKEN=<your-token> apt install ./EndpointProtection-amd64.deb

RHEL / Rocky Linux / CentOS

Download the package that matches your major version and architecture. Use the el9 build on version 9 and the el10 build on version 10.

Version	Architecture	Package
9	amd64 (x86_64)	EndpointProtection-amd64.el9.rpm
9	arm64 (aarch64)	EndpointProtection-arm64.el9.rpm
10	amd64 (x86_64)	EndpointProtection-amd64.el10.rpm
10	arm64 (aarch64)	EndpointProtection-arm64.el10.rpm

Then install it:

curl -fLO https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.el9.rpm
sudo AIKIDO_TOKEN=<your-token> dnf install ./EndpointProtection-amd64.el9.rpm

The package enables and starts the aikido-endpoint-protection service during installation, so there's no separate start step.

Installing sets system-wide environment variables (NODE_EXTRA_CA_CERTS, UV_SYSTEM_CERTS) that point Node.js and uv at the Aikido CA. Shells and services that were already running won't see them, so open a new login shell or reboot the device before you test package installs.

Tray Icon Support on Linux

Verify the install

Check that the service is running and the agent reports a healthy state:

systemctl status aikido-endpoint-protection
aikido-doctor version

The device then appears in your device list with an Active status. To confirm that blocking actually works, follow How to test if Device Protection is working.

aikido-doctor is installed on your PATH and gives you the same inspect, pause, and diagnostics commands as on macOS and Windows. See The aikido-doctor CLI.

Upgrading

Install the newer package over the existing one with the same command. The package restarts the service against the new binaries and keeps the device's registration and configuration, so you don't need to pass AIKIDO_TOKEN again.