unrent home
Sign in Get started
Menu

Install the agent

Run curl -fsSL https://get.unrent.dev/install.sh | sudo sh -s -- --token <token> on the server with the one-time token from the console. The script checks the server, verifies the release’s SHA-256 twice, installs two systemd services and connects.

What the installer does

  1. 01

    Checks the server

    Root, Linux with systemd, amd64 or arm64, curl or wget, sha256sum or shasum, and 200 MB free in /var/lib. It refuses a server that is already enrolled and warns when Docker is missing.

  2. 02

    Downloads and verifies

    It downloads the release for your architecture and checks its SHA-256 against the release manifest and the release’s SHA256SUMS. Any mismatch stops it before anything is written.

  3. 03

    Installs

    Binaries go to /usr/local/lib/unrent/<version>/, with the previous version kept next to it. It creates the unrent system user and the unrentd and unrent-exec services.

  4. 04

    Enrolls and connects

    The token is passed on standard input, never printed. The script waits up to 30 seconds for the agent to connect and prints its id.

The script is plain POSIX sh, short enough to read before you run it, and does nothing until its last line, so a download cut short runs nothing.

Flags

Installer flags
FlagWhat it does
--token <t>The one-time enrollment token from the console
--version <v>Install this release instead of the newest (the last 3 are served)
--forceEnroll again over an existing enrollment; the old identity is moved aside, never deleted
--install-dockerInstall Docker from the distribution’s packages when it is missing (docker.io 27 or newer)
--uninstallStop and remove the services and binaries; keeps /var/lib/unrent and /etc/unrent
--purgeWith --uninstall: also delete the state and the unrent user
--download-only <dir>Download, verify and unpack into a folder; installs nothing and needs no root

Upgrade and uninstall

Run the same command without --token to upgrade to the newest release. It keeps the server’s identity and restarts the agent only if something changed.

Uninstall (add --purge to delete state too)
curl -fsSL https://get.unrent.dev/install.sh | sudo sh -s -- --uninstall

Containers, databases and their data are never touched. Remove the server in the console as well.

Coming One-click signed updates from the console, with automatic rollback if the new agent does not connect within 5 minutes. Until release signing is set up, upgrade by re-running the installer.

Without Docker

The agent installs, enrolls and reports inventory without Docker. Apps and databases fail with a clear error until Docker Engine 27 or newer runs; then restart unrent-exec and nothing else is needed.

Verify a release yourself

Download, check sums and provenance
sh install.sh --download-only ./unrent
cd unrent && sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify unrent-<v>-linux-amd64.tar.gz --repo PILOTAAI/unrent \
  --signer-workflow PILOTAAI/unrent/.github/workflows/agent-release.yml

Each release carries SLSA build provenance that binds every tarball to the workflow run that built it.

While the agent’s repository is private, gh attestation verify needs a GitHub login with read access to it. Anyone will be able to verify once the repository is public.

Updated . This page as Markdown.