# Install the agent

> Run `curl -fsSL https://get.unrent.dev/install.sh | sudo sh -s -- --token <token>` on the server with the one-time token from the console. The script checks the server, verifies the release’s SHA-256 twice, installs two systemd services and connects.

URL: https://unrent.dev/docs/install/

## What the installer does

1. **Checks the server.** Root, Linux with systemd, amd64 or arm64, `curl` or `wget`, `sha256sum` or `shasum`, and 200 MB free in `/var/lib`. It refuses a server that is already enrolled and warns when Docker is missing.
2. **Downloads and verifies.** It downloads the release for your architecture and checks its SHA-256 against the release manifest and the release’s `SHA256SUMS`. Any mismatch stops it before anything is written.
3. **Installs.** Binaries go to `/usr/local/lib/unrent/<version>/`, with the previous version kept next to it. It creates the `unrent` system user and the `unrentd` and `unrent-exec` services.
4. **Enrolls and connects.** The token is passed on standard input, never printed. The script waits up to 30 seconds for the agent to connect and prints its id.

The script is plain POSIX `sh`, short enough to read before you run it, and does nothing until its last line, so a download cut short runs nothing.

## Flags

Installer flags

| Flag | What it does |
| --- | --- |
| `--token <t>` | The one-time enrollment token from the console |
| `--version <v>` | Install this release instead of the newest (the last 3 are served) |
| `--force` | Enroll again over an existing enrollment; the old identity is moved aside, never deleted |
| `--install-docker` | Install Docker from the distribution’s packages when it is missing (`docker.io` 27 or newer) |
| `--uninstall` | Stop and remove the services and binaries; keeps `/var/lib/unrent` and `/etc/unrent` |
| `--purge` | With `--uninstall`: also delete the state and the `unrent` user |
| `--download-only <dir>` | Download, verify and unpack into a folder; installs nothing and needs no root |

## Upgrade and uninstall

Run the same command without `--token` to upgrade to the newest release. It keeps the server’s identity and restarts the agent only if something changed.

Uninstall (add --purge to delete state too):

```
curl -fsSL https://get.unrent.dev/install.sh | sudo sh -s -- --uninstall
```

Containers, databases and their data are never touched. Remove the server in the console as well.

> **Coming:** One-click signed updates from the console, with automatic rollback if the new agent does not connect within 5 minutes. Until release signing is set up, upgrade by re-running the installer.

## Without Docker

The agent installs, enrolls and reports inventory without Docker. Apps and databases fail with a clear error until Docker Engine 27 or newer runs; then restart `unrent-exec` and nothing else is needed.

## Verify a release yourself

Download, check sums and provenance:

```
sh install.sh --download-only ./unrent
cd unrent && sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify unrent-<v>-linux-amd64.tar.gz --repo PILOTAAI/unrent \
  --signer-workflow PILOTAAI/unrent/.github/workflows/agent-release.yml
```

Each release carries SLSA build provenance that binds every tarball to the workflow run that built it.

> While the agent’s repository is private, `gh attestation verify` needs a GitHub login with read access to it. Anyone will be able to verify once the repository is public.