Deploy

Verify us, then run.

One clean Debian 13 VM is all it takes — the installer brings Docker, Compose and the signature tooling with it. Five commands instead of one, because you shouldn't pipe the internet into root.

Prefer a guided walkthrough? The Setup Guide covers everything on this page step by step — install, license and your first computers, with a screenshot for every step — and continues into scheduling, monitoring and alerts.

The verified install

One-time preparation on a fresh Debian: it ships without sudo and without curl, and the commands below need both. As root (su -), run apt install sudo curl, then usermod -aG sudo <your-user>, then log out and log in again as your user. Step 1 of the Setup Guide shows it command by command.

$ curl -fsSLO https://get.octotor.com/octotor-install-latest.tgz
$ curl -fsSLO https://get.octotor.com/octotor-install-latest.tgz.sig
$ curl -fsSLO https://www.octotor.com/octotor-release.pem   # publisher key — deliberately a separate origin
$ openssl dgst -sha256 -verify octotor-release.pem -signature octotor-install-latest.tgz.sig octotor-install-latest.tgz
Verified OK
$ tar xzf octotor-install-latest.tgz && sudo bash octotor-install.sh --token=<your-token> --customer=<your-name>

The bundle and its signature come from the deployment host; the publisher key comes from a separate origin, so a single compromised host is not enough to serve you a forged installer. The key's fingerprint is published on the security page — compare it before you trust the key. These commands always fetch the current release — the version on offer is published at latest.json, the installer prints the version it installs, and versioned artifacts stay published alongside if you want to pin or audit a specific release.

The quick path

$ curl -fsSL https://get.octotor.com/install | sudo bash -s -- --token=<your-token> --customer=<your-name>

The same installer in one command. The email you received after registering contains this command with your own values filled in: copy it, paste it into the VM's terminal and press Enter. What it does not do is verify our signature with the key from the separate origin above. Fine for a lab or a first look; for a production install, spend the extra four commands.

What the installer does

Checks the OS (Debian 13 — the only supported OS), then installs Docker, Docker Compose and Cosign at the versions we test against. Pinned means tested, not locked — normal host patching applies.
Writes the image-signing public key as a local trust anchor.
Pulls each container image and verifies its Cosign signature — the install refuses to continue on any mismatch. No unverified image ever runs.
Brings the stack up and serves the console over TLS with a self-signed certificate — your browser warns on first login; accept it once, or replace the certificate with your own any time.

The quick lab install, upgrades and uninstall have moved to their own page: Upgrade & Uninstall.

Before you start

You can also try Octotor without installing it: the evaluation virtual machine has Octotor already installed.

A clean Debian 13 VM with sudo and curl installed and your user allowed to run sudo (Step 1 of the Setup Guide), sized per the requirements page, your install token, and outbound reach to your assets. What the VM sends and receives is itemized on the security page.

After you register, we send you your install token and a ready-to-run install command with the token already filled in. Paste the token into the --token= flag above; --customer= is any short label for this install. The token is stable and reused for upgrades — we only reissue it if it's ever exposed.

Further detail on architecture, security design and deployment is available on request — security@octotor.com.