# Deploying on Linux

Device Protection ships as a plain `.deb` or `.rpm` package, so any tool that can copy a file and run a package manager can roll it out. Every method does the same thing: fetch the package for the host, install it with your user group token in the environment, and get users onto a fresh login shell afterwards. The guides below cover the tool-specific parts.

Start with [Install Device Protection for Linux](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/install-device-protection-for-linux) for the token, the packages, and the install options they all share. The [Linux Rollout Reference](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference) has the detail behind the shared steps: token handling, reboots, repeat runs, device identity, and upgrades.

## Which guide to use

| Situation                                     | Use                                                                                                                  |
| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| A single machine, or one you're testing on    | [Install Device Protection for Linux](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/install-device-protection-for-linux)                                          |
| Existing fleet, agent checks in on a schedule | [Chef](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-chef) or [Puppet](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-puppet)                   |
| Existing fleet, you push over SSH             | [Ansible](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-ansible)                                                                  |
| New cloud instances                           | [cloud-init](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-cloud-init) or [Terraform](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-with-terraform) |
| Existing fleet on AWS, managed by Systems Manager | [AWS Systems Manager](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/deploy-device-protection-with-aws-systems-manager) |
| Machines built from an image you control      | [Packer and golden images](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/deploy-device-protection-in-golden-images)                                             |
| Container images for CI or build jobs         | [Device Protection in Containers](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-containers)                                                |
| Dev Containers and Codespaces                 | [Device Protection in Dev Containers](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-dev-containers)                                        |
| CI/CD runners and pipelines                   | [GitHub Actions](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-github-actions), [GitLab CI/CD](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-gitlab-ci), [Jenkins](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-jenkins), [CircleCI](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-circleci), [Azure Pipelines](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-azure-pipelines), [Bitbucket Pipelines](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-bitbucket-pipelines), or [Buildkite](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/device-protection-in-buildkite) |

Every guide follows the same shape: the configuration for that tool, how to verify the rollout, and what to check when something breaks.

If your MDM manages Linux devices, push the install command through it as a script. Otherwise, use the configuration management or provisioning tool you already run.

{% hint style="info" %}
Device Protection secures the machines your developers work on. To scan servers for vulnerable packages instead, use [VM Scanning](https://help.aikidogov.us/virtual-machine-scanning/virtual-machines-overview).
{% endhint %}

## Before you roll out

* **Decide which version the fleet gets.** The download URL always resolves to the newest release. Mirror the package if you want the fleet to move on your schedule instead. See [Versions and upgrades](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference#versions-and-upgrades).
* **Guard repeat runs.** Check whether the agent is already installed before downloading, so a second run does nothing. See [Make repeat runs cheap](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference#make-repeat-runs-cheap).
* **Plan the reboot.** Protection is only complete after a new login shell, so don't restart machines people are working on from an automation run. See [When protection becomes active](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/linux/linux-rollout-reference#when-protection-becomes-active).
* **Roll out to a pilot group first.** Each token belongs to one [user group](https://help.aikidogov.us/aikido-device-protection/deploying-aikido-endpoint/user-groups-for-aikido-endpoint), so give your pilot hosts their own token and widen from there.