> ## Documentation Index
> Fetch the complete documentation index at: https://devlookout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Lookout

> Deploy Lookout in fleet or single-host mode.

> For the complete documentation index, see [llms.txt](https://devlookout.com/llms.txt). Markdown versions are available by appending `.md` to page URLs.

The supported Linux installer performs discovery, secure configuration, deployment, service startup, and health verification. It is safe to rerun and does not require manual rule selection.

## Requirements

* x86-64 or ARM64 Linux with systemd for the central service and supported collectors
* An identity-pinned administrative transport for each remote Linux endpoint
* Noninteractive `sudo` on remote endpoints
* Existing authenticated cloud or provider CLIs when using hosted discovery

## Hosted installer endpoints

Start from the authenticated [Lookout Setup page](https://app.devlookout.com/setup). It creates the short-lived, account-bound command and passes the setup token through an owner-only file.

| Orchestration host   | Official installer                                                                 |
| -------------------- | ---------------------------------------------------------------------------------- |
| macOS or Linux shell | [`https://app.devlookout.com/install.sh`](https://app.devlookout.com/install.sh)   |
| Windows PowerShell   | [`https://app.devlookout.com/install.ps1`](https://app.devlookout.com/install.ps1) |

Both installers use the current terminal as the orchestration host and deploy Lookout only to supported Linux targets. The PowerShell installer does not install a collector on the Windows orchestration host.

<Warning>
  Never put a setup token in an installer URL, command argument, chat, source control, or cloud-init data. Run the complete token-file command generated by the Setup page.
</Warning>

## Fleet installation from a checkout

```sh theme={null}
./install.sh
```

Fleet mode discovers available inventory sources, selects one supported central host deterministically, and installs collectors only where administrative access is already authorized. Unsupported or unreachable assets remain visible as explicit coverage gaps.

## Hosted onboarding

The authenticated Setup page at `https://app.devlookout.com/setup` creates a short-lived, account-bound setup command. Run that generated command in the terminal where your provider CLIs are already authenticated.

## Single-host installation

Use local mode when fleet discovery is intentionally unwanted:

```sh theme={null}
LOOKOUT_MODE=local sudo ./install.sh
```

## Verify

```sh theme={null}
sudo lookout doctor
```

The doctor checks Node compatibility, storage and key posture, file permissions, snapshot integrity, journal chains, disk headroom, and abandoned temporary files.

## Uninstall

Remove application code and services while retaining configuration, identities, keys, and event data:

```sh theme={null}
./uninstall.sh
```

Permanently remove Lookout-managed configuration and data only when explicitly intended:

```sh theme={null}
./uninstall.sh --purge
```

<Note>
  Purge operates against the installer's fixed allowlist and removes service users only when the protected installer manifest proves that Lookout created them.
</Note>