Skip to main content
Install the .deb or .rpm through your configuration management (Ansible, Salt, Puppet, etc.). The package installs the self-contained bundle to /usr/lib/runlayer/ and symlinks /usr/bin/runlayer.

​
Prerequisites

  • Configuration management tooling (Ansible, Salt, Puppet, etc.)
  • Linux x86_64 devices with glibc 2.35 or newer (for older distros, see Legacy distributions)
  • The .deb / .rpm and SHA256SUMS from your Runlayer downloads access

​
Legacy distributions (glibc 2.17)

Each release also ships a legacy build variant built against glibc 2.17 for x86_64 distros older than the standard floor — RHEL/CentOS 7+, Amazon Linux 2, Ubuntu 14.04+, and Debian 8+. The package name stays runlayer; only the filenames carry the tag:
  • runlayer_<version>_amd64.glibc2.17.deb
  • runlayer-<version>-1.x86_64.glibc2.17.rpm
  • SHA256SUMS-glibc2.17 — verify with sha256sum -c SHA256SUMS-glibc2.17
Install with the same commands as the standard package, substituting the glibc2.17 filenames. Legacy packages identify their variant, so runlayer update only ever offers matching glibc 2.17 builds on those devices. Check ldd --version if you are unsure which variant a distribution needs — use the standard package for glibc 2.35+ and the glibc2.17 variant for glibc 2.17–2.34.

​
Deployment Steps

1

Verify the artifacts

Verify package integrity with SHA256SUMS:
2

Install the package

The package installs the self-contained bundle to /usr/lib/runlayer/ and symlinks /usr/bin/runlayer.
3

Configure

Write the shared host configuration and root-only organization key:
The command preserves local non-policy settings in the world-readable config.json, removes backend-owned cached settings, and writes the key only to the 0600 credentials file. CLI versions before 0.30.8 require writing these files manually.
4

Verify

​
Automatic skill sync

The native .deb and .rpm packages install /etc/cron.d/runlayer-cli. At minute 23 of every hour, its root wrapper enumerates real login users (uid at or above the distro’s UID_MIN; service accounts are excluded) with an existing home and runs runlayer schedule as each user through runuser. Shared homes are synced once, overlapping ticks are skipped, and one user’s failure does not block the others. The raw .tar.gz does not install this cron entry. The wrapper uses the existing Linux managed-config files:
/etc/runlayer/aiwatch/config.json
/etc/runlayer/aiwatch/credentials
Keep config.json root-owned and readable (0644), but keep credentials root-only (0600). If AI Watch already manages these files, the CLI schedulers reuse its Host and RUNLAYER_API_KEY; no duplicate configuration is needed. A dedicated RUNLAYER_SKILL_SYNC_API_KEY can override the skill-sync key. Without a configured host and key, cron exits quietly. See Sync to devices.

​
Automatic updates

The same /etc/cron.d/runlayer-cli checks the Client Updates policy at minute 41 of every hour, offset from skill sync at minute 23. The root-only run-cli-update.sh wrapper waits for any active per-user schedule fan-out, then runs the packaged updater. Exact version equality is a no-op; a different backend target can advance or roll back the package. AutoUpdate defaults to enabled; set "AutoUpdate": false in config.json to opt out while keeping manual runlayer update available. The one-command Test Device installer triggers the first check after writing configuration. A manual package install can run it immediately with:
Existing installations need one ordinary package upgrade to 0.30.8 or newer before this wrapper and cron line exist. Automatic updates stay within the installed standard or glibc 2.17 variant.

​
Upgrades and removal

  • Upgrade — automatic checks install the version selected by your Runlayer tenant. Configuration management and explicit runlayer update remain available for bootstrap or manual control.
  • Remove — apt-get remove runlayer on Debian/Ubuntu, or dnf remove runlayer on RHEL/Fedora. Package removal also removes /etc/cron.d/runlayer-cli and both wrappers; externally managed config remains untouched.