Choose an install method
Which install fits your infrastructure, from plain Linux servers to Kubernetes pods.
shellz runs in one of two modes. Pick the one that matches where you can install software.
On a host
Use this when you control the machine: a VM, a bare-metal server, an LXC container or a Proxmox guest. shellz installs as a systemd service and records every login on the machine. If Docker runs on that machine, docker exec into any of its containers is recorded too, with nothing added to your images.
- Linux server: any systemd Linux server.
- Docker host: a Linux server that runs Docker. Same install, plus container sessions.
Inside the container
Use this when you can't install anything on the host: Kubernetes, ECS and Fargate, Cloud Run, or dev containers. shellz is added to your image and runs as PID 1 in front of your app. Every container that starts with a fleet token joins a fleet and records every shell opened in it.
- Container image: add shellz to any image. Start here for all container platforms.
- Kubernetes:
kubectl execinto pods. - ECS, Fargate and Cloud Run: ECS Exec and other managed container platforms.
- Dev containers: VS Code and Codespaces-style development containers.
Which one?
| Your setup | Use |
|---|---|
| Linux VMs or servers you SSH into | Linux server |
| Servers running Docker or Docker Compose | Docker host |
| Kubernetes (EKS, GKE, AKS or self-managed) | Kubernetes |
| ECS on Fargate, or Cloud Run | ECS, Fargate and Cloud Run |
| ECS on EC2 instances you manage | Either: Docker host on the instances, or in the image |
| Dev containers | Dev containers |
| Podman, rootless Docker, containerd without Docker | Container image |
Don't install both on the same container. A host install already records docker exec into every container on that host, so the in-container install is only needed where you can't reach the host.
What both modes have in common
- The same encryption, signing and storage. A container session and an SSH session look the same in the dashboard.
- The same recording policy options: fail closed, buffer or fail open.
- Outbound HTTPS only, to
api.shellz.dev,ingest.shellz.devandreleases.shellz.dev. Nothing listens for inbound connections. - Linux on amd64 (x86_64) or arm64 (aarch64).