Install a Linux Environment

Run Misanthropic agents on a Debian/Ubuntu x64 host. The installer prepares Docker and the arsenal image, downloads the runtime, and starts the Environment service.

Before you start

Use a fresh host with systemd, a root terminal, curl and CA certificates.
Get a protected Infisical bootstrap file and Misanthropic enrollment key from the operator.
Get a username and password for registry.astrixion.ai:5443. Its current authentication grants push and pull, not read-only access.
Allow access to the control plane, Tailscale, Infisical, the registry and package downloads.

Infisical keys to provision for this host

Key	Value
`Environment__ApiToken`	Unique API token for this host.
`Environment__GottyCredential`	Terminal credential: `username:password`.
`Environment__ControlPlaneMcpToken`	Current control-plane MCP root.
`Environment__CertPassword`	Password for the generated TLS certificate.

Add Environment__Sonar__SonarPentestToken only when Sonar is configured. The installer reads the explicitly selected project, environment and folder; it does not create secrets.

Install

Download the script, review it, then run:

curl -fsSLo install-environment.sh https://docs.astrixion.ai/install-environment.sh
bash install-environment.sh install --release env-v0.4.3 --infisical-bootstrap-file /private/environment.json

Use the path to your protected bootstrap file. Enter the enrollment key and registry credentials at the hidden prompts; do not put secrets in shell history. Registry authentication stays on the host in a temporary Docker config removed after the pull, including on failure. It is not passed to the Environment runtime or Room member containers.

The release pins one full misanthropic-room-member image by digest. Browser/Burp selections use that same image; the installer does not build images locally.

If prompted to join Tailscale, run tailscale up, approve the host, then repeat the install command. Keep ports 5154 and 7799 reachable from the control plane over the private network only. The default control plane is https://misanthropic.astrixion.ai.

Verify

bash install-environment.sh status

Expect Host is healthy after installation and your hostname marked healthy under Console Environments. Create a disposable Room, select this host for an agent, and ask it to write a Room file. Confirm the file appears, then stop and delete the test Room.

If startup fails, inspect the service log:

journalctl -u misanthropic-environment -n 100 --no-pager

Update an installer-managed host

Download the current installer, then stage the desired release:

bash install-environment.sh prepare-update --release env-v0.4.3

Staging downloads the bundle and pinned image using temporary registry authentication; it does not interrupt work. Before activation, ensure protected Bootstrap/infisical.json exists. An existing BWS-backed host needs an operator-approved bootstrap migration first, preserving credential values. Stop all agents and Rooms using this host and confirm no managed tmux sessions or Room containers remain. Then activate:

systemctl stop misanthropic-environment
bash install-environment.sh activate --release env-v0.4.3 --confirm-idle-window
bash install-environment.sh status

Activation preserves credentials, certificate and data. Do not use fresh installation to update an existing or legacy host, or delete its directory to bypass an installer refusal.

Need help? For Infisical/enrollment errors, check the operator-provided credentials and scope. For registry errors, check image read access. For network errors, check Tailscale and private firewall rules.

Release files and checksums. Fresh-host runtime acceptance remains pending operator verification.

Install a Linux Environment

Before you start

Install

Verify

On this page