# Updates and removal

URL: https://shellz.dev/docs/guides/updates-and-removal

> How shellz updates itself safely, and how to remove it from a server.

## Automatic updates

On servers, shellz checks for a new release about every 6 hours (with some random delay, so a fleet doesn't update all at once), and five minutes after the recorder starts.

Each update:

1. **Is verified.** The release manifest must be signed by the shellz release key pinned in the agent, and the download must match the signed SHA-256 hash and size.
2. **Only moves forward.** shellz refuses any version older than, or equal to, the newest one it has run, and any version that already failed on this server.
3. **Is tested before it's used.** The new binary runs a self-test before it replaces the old one, which is kept as a backup.
4. **Doesn't interrupt sessions.** The recorder switches to the new version once no recorded session is running, so an update never ends a session.
5. **Rolls back on failure.** If the new version doesn't start and report healthy within 2 minutes, or fails to start 3 times, the previous version is restored and an `update-rolled-back` alert is raised.

To check or update by hand:

```bash
sudo /usr/local/bin/shellz update --check   # show whether an update is available
sudo /usr/local/bin/shellz update           # install it now
```

### Containers

Containers run the version that's in their image. To update, rebuild the image, which picks up the latest release with `get.shellz.dev/container`, or update the version and checksum in your `ADD` line.

## Removing shellz

shellz can't be removed from a server without your org's approval. This stops someone with root access from quietly removing it.

1. **Approve the removal.** An owner or admin removes the server from your org, after confirming it's them. The server receives a signed policy that allows removal, on its next heartbeat. In Perfect Secrecy mode, the policy is signed in their browser.
2. **Uninstall on the server:**

   ```bash
   sudo /usr/local/bin/shellz uninstall
   ```

3. shellz finishes any running sessions and uploads what's left in its spool (waiting at most 10 minutes), then:
   - restores every account's original login shell;
   - removes the SSH drop-in, the recorder unit, the SELinux module, the session shell, the binary and `/etc/shellz` and `/var/lib/shellz`;
   - on Docker hosts, gives the Docker socket back to Docker (see [Docker host](https://shellz.dev/docs/install/docker-host.md#removing-shellz-from-a-docker-host));
   - reports `uninstalled` to your org.

Recordings already uploaded stay in your org, under the retention lock.

> [!NOTE]
> Removing a server from the dashboard isn't available yet. Until it is, owners and admins can approve removal through the shellz API, or contact [hello@shellz.dev](mailto:hello@shellz.dev).

If you run `shellz uninstall` without an approved removal, it's refused, nothing is changed, and an `uninstall-refused` alert names the account that tried.

### Fleets

To stop recording a container workload, deploy it without the shellz entrypoint, then revoke or delete the fleet on its page.