Installation

Each installation needs a licence key and a machine that meets the requirements. The installer asks only for what it cannot work out: the licence key, and the first administrator's name and password. Everything else is shown as numbered steps with one line each; the details go to the install log.

Linux

Run this as your normal user (not root), on a terminal:

curl -fsSL https://license.cerberon.dev/install.sh | sh

The installer then:

Checks the machine: the system, Docker, free disk, the port, and the outbound addresses. If Docker Engine is missing it offers to install it from Docker's repository and asks for your sudo password.
Asks for your licence key (hidden as you type), activates this machine, downloads Cerberon and checks its signature.
Prepares the scanners. The scanner tools are built on the machine; this takes 10 to 25 minutes, and a timer shows it is still working.
Starts Cerberon, makes sure Docker starts when the machine does, and checks that Cerberon answers on the machine and at its address.
Asks for the first administrator's user name and password, and creates the account.

It ends with the address to open. Your browser warns about the certificate the first time: Cerberon uses its own certificate until you supply yours.

To install without a terminal (automation), set the key in the environment: CERBERON_LICENSE_KEY=CRB-… sh install.sh. Without a terminal the installer cannot ask for the administrator, so it prints a one-time setup token instead: open the address, enter the token and choose the administrator's name and password there.

Windows 11

Open PowerShell as Administrator (right-click PowerShell, Run as administrator) and run:

irm https://license.cerberon.dev/install.ps1 | iex

The installer:

Checks Windows, the processor and virtualisation.
Turns on WSL and installs Ubuntu 24.04. The first time, Windows may need a restart: the installer says so; restart, then run the same command again and it continues where it stopped.
Asks for a Linux user name and password for Cerberon's Ubuntu (it does not have to match your Windows name).
Sets up networking and the firewall for port 443. If your network is marked Public, it offers to mark it Private so other machines can connect.
Installs Docker Engine inside Ubuntu.
Registers a scheduled task, Cerberon, that starts Cerberon with Windows and keeps it running, with no window open.
Asks for your licence key and runs the Linux installer above inside Ubuntu.
Checks from Windows that Cerberon answers on https://localhost and on the PC's network address.

The installer changes these on the PC, all of them needed to run Cerberon:

Change	Where
WSL and Virtual Machine Platform turned on	Windows features
Ubuntu 24.04 with Docker Engine and Cerberon	WSL distribution `Ubuntu-24.04`
WSL networking and no idle shutdown	`%USERPROFILE%\.wslconfig`
Inbound TCP 443 allowed	Windows Defender firewall and Hyper-V firewall, rule "Cerberon (TCP 443)"
Port 443 forwarded to WSL	`netsh interface portproxy`
Start-up task	Task Scheduler, "Cerberon"
Install log and start-up script	`C:\ProgramData\Cerberon`

The first administrator

In a terminal, the installer creates the first administrator from the name and password you type (the password needs 10 or more characters). Otherwise it prints a setup token: open Cerberon, choose Create the first administrator, and enter the token. The token works once and is deleted when the account exists.

If you lose the token before using it, read it on the machine:

docker exec cerberon-core cat /data/bootstrap.token

The token exists only until the first administrator is created. If that command answers "No such file", the instance already has an administrator; if you cannot sign in, reset the password from the machine (see locked out).

Further accounts are added in Cerberon under Users.

Offline installation (no internet)

For a machine with no internet at all, prepare a bundle on a connected machine and carry it across.

On the offline machine, get its ID (a copy of install.sh is needed there):
```
sh install.sh --fingerprint
```
On a connected machine, download a release and a licence bound to that ID. --with-images also builds the scanner tools and packs every image, so the offline machine needs nothing else:
```
sh install.sh --fetch ./cerberon-bundle --key CRB-… --instance <ID from step 1> --with-images
```
Copy the whole folder to the offline machine, and install from it:
```
sh install.sh --bundle ./cerberon-bundle
```

Every file in the bundle is checked against Cerberon's signature before it is used. Updates work the same way: fetch a new bundle and run --bundle again.

Installation options

Option	Does
`--verbose`	Shows every detail on screen instead of only in the install log.
`--no-tools`	Skips the scanner tools (Cerberon starts, but scans cannot run). Add them later with `--tools`.
`--no-mobile`	Leaves out the mobile app analyser.
`--check`	Verifies the release and prints what would happen; changes nothing.
`--doctor`	Reports on the machine and the installation; changes nothing.