Deploy

Verify us, then run.

One clean Debian 13 VM is all it takes — the installer brings Docker, Compose and the signature tooling with it. Five commands instead of one, because you shouldn't pipe the internet into root.

Prefer a guided walkthrough? The Setup Guide covers everything on this page step by step — install, license and your first computers, with a screenshot for every step — and continues into scheduling, monitoring and alerts.

The verified install

One-time prep on a fresh Debian: apt install curl — Debian doesn't ship curl by default, and every command below uses it.

$ curl -fsSLO https://get.octotor.com/octotor-install-latest.tgz
$ curl -fsSLO https://get.octotor.com/octotor-install-latest.tgz.sig
$ curl -fsSLO https://www.octotor.com/octotor-release.pem   # publisher key — deliberately a separate origin
$ openssl dgst -sha256 -verify octotor-release.pem -signature octotor-install-latest.tgz.sig octotor-install-latest.tgz
Verified OK
$ tar xzf octotor-install-latest.tgz && sudo bash octotor-install.sh --token=<your-token> --customer=<your-name>

The bundle and its signature come from the deployment host; the publisher key comes from a separate origin, so a single compromised host is not enough to serve you a forged installer. The key's fingerprint is published on the security page — compare it before you trust the key. These commands always fetch the current release — the version on offer is published at latest.json, the installer prints the version it installs, and versioned artifacts stay published alongside if you want to pin or audit a specific release.

What the installer does

Checks the OS (Debian 13 — the only supported OS), then installs Docker, Docker Compose and Cosign at the versions we test against. Pinned means tested, not locked — normal host patching applies.
Writes the image-signing public key as a local trust anchor.
Pulls each container image and verifies its Cosign signature — the install refuses to continue on any mismatch. No unverified image ever runs.
Brings the stack up and serves the console over TLS with a self-signed certificate — your browser warns on first login; accept it once, or replace the certificate with your own any time.

The quick lab install, upgrades and uninstall have moved to their own page: Upgrade & Uninstall.

Before you start

A clean Debian 13 VM with curl installed (apt install curl), sized per the requirements page, your install token, and outbound reach to your assets. What the VM sends and receives is itemized on the security page.

After you register, we send you your install token and a ready-to-run install command with the token already filled in. Paste the token into the --token= flag above; --customer= is any short label for this install. The token is stable and reused for upgrades — we only reissue it if it's ever exposed.

Further detail on architecture, security design and deployment is available on request — security@octotor.com.