Docker¶

The EnforceGate vX standalone bundle is the primary Docker deliverable: a signed tarball containing the engine, the captive portal, the TLS terminator, the operator CLI (eghost), and a self-contained guided installer that drives end-to-end setup.

Prerequisites¶

• Docker Engine 20.10+ with Docker Compose v2.
• Your user added to the docker group (id | grep docker to verify).
• A real terminal session — the installer runs as a full-screen terminal UI and needs a real TTY. SSH works (use ssh -t for non-interactive sessions); piping or nohup does not.
• ~750 MB of disk for the unpacked installer, loaded images, and the first-boot cert DB.
• 2 vCPU, 1 GiB RAM minimum (overridable in the installer's network step).

The installer works on any modern Linux distribution that ships Docker 20.10+ (Alpine, Debian, Ubuntu, RHEL family all tested).

Download¶

Download these six files from the Software Downloads Portal into the same directory:

• enforcegate-standalone-<edition>-<version>-<TIER>.tar.zst — the signed installer tarball. <edition> is pro, business or enterprise and must match your licence; <TIER> is the release class (e.g. GD-prod). Example: enforcegate-standalone-pro-2026.52.0-GD-prod.tar.zst. See release artifact names.
• enforcegate-standalone-<edition>-<version>-<TIER>.tar.zst.sig — the cosign signature bundle
• exosys-release.pub — the public key that produced the signature
• SHA256SUMS, SHA512SUMS — checksum manifests for integrity
• VERIFY.md — the verification runbook

Verify¶

Two integrity checks. First the plain checksum manifests:

Set these to match the files you downloaded — the commands below reuse them:

export EDITION=pro          # pro | business | enterprise — must match your licence
export VERSION=2026.52.0
export TIER=GD-prod         # full tier, e.g. GD-prod | EA-prod | IR-test

sha256sum -c SHA256SUMS
sha512sum -c SHA512SUMS

Every line should print OK. Then the cosign signature against the Exosys release public key:

cosign verify-blob --insecure-ignore-tlog \
    --key exosys-release.pub \
    --bundle enforcegate-standalone-${EDITION}-${VERSION}-${TIER}.tar.zst.sig \
    enforcegate-standalone-${EDITION}-${VERSION}-${TIER}.tar.zst

Verified OK is the expected output. Anything else means the tarball was tampered with in transit — do not proceed.

Need cosign itself? See installing cosign — version 2.5.x is sufficient for verification, and no smart-card build tags are required (those are only for the signing side).

Cross-check the public key fingerprint against the value published at https://docs.exosys.ch/keys/exosys-release.pub.sha256:

sha256sum exosys-release.pub

Unpack¶

tar -xf enforcegate-standalone-${EDITION}-${VERSION}-${TIER}.tar.zst
cd enforcegate-installer

Install¶

Run the installer. It is a full-screen terminal UI — read each panel and the bottom-bar key bindings before pressing Enter.

sudo ./install.sh

The wizard walks you through eleven steps:

1. Welcome — brief intro to the flow.
2. Pre-flight checks — confirms Docker is reachable, Compose v2 is available, and the bundle's files are present.
3. License agreement — pages the EULA, the Software License, and the Warranty. Confirm acceptance by typing the literal string I ACCEPT. Acceptance is logged with a tamper-evident hash chain.
4. Existing install — detects whether a previous deployment is present on the host and, if so, switches the wizard to the upgrade path so all named volumes and operator state are preserved.
5. License credentials — the serial, username, and password issued with your subscription. Forwarded to the engine, which authenticates with the Exosys Control Server on first boot to mint your license. See Editions.
6. Admin account — the operator credential (username + password) used for the engine Control API superadmin. Default username enforcegate; replaces the build-time default (enforcegate-changeme password).
7. Network + SSL inspection — the public hostname clients reach the captive portal at, plus CPU/RAM limit overrides and the SSL inspection mode (off (default), peek, or bump). bump triggers an additional legal acknowledgement step per EULA § 3.
8. Customize — opt-in components beyond the default enforcement stack. The main opt-in today is the toolbox sidecar for scheduled category-list refresh and operator scripting.
9. Review — final summary of your inputs before the deploy phase runs.

10. Deploy — loads the signed image tarballs into Docker, brings the compose stack up (engine, captive portal, TLS terminator, and — if enabled — the toolbox sidecar), installs runtime files under /var/lib/enforcegate-host/, drops the eghost operator CLI at /usr/local/bin/eghost, enables the enforcegate.service systemd unit for autostart, and waits for the engine's healthcheck to flip green (up to 120 s). The wizard streams every action as it happens (screenshot at the top of this section) — v opens the phase logs and e opens the engine logs for real-time inspection during the boot. Ctrl+C aborts cleanly with no partial state written.

11. Ready — final panel with the captive portal URL, the proxy host:port, the license state (Licensed / Grace / Floor), and the operator commands you'll most often need.

The installer drops the eghost operator CLI at /usr/local/bin/eghost so day-2 operations work out of the box.

Day-2 operations¶

After installation, every common operator action runs through eghost:

eghost                          # one-screen deployment dashboard
eghost status                   # detailed engine + sidecar health
eghost version                  # CLI + per-image versions
eghost logs                     # follow compose logs
eghost restart                  # restart the stack
eghost policy list              # list policy files
eghost policy edit <name>       # edit a policy in $EDITOR (auto-reloads)
eghost cli                      # drop into the engine CLI (egctl) REPL
eghost support bundle           # write a redacted diagnostic tarball

See the eghost reference for the full verb list.

Re-running the installer¶

The installer is safe to re-run on a host where EnforceGate vX is already running. Use this path to:

• Rotate license credentials after a renewal.
• Change the SSL inspection mode.
• Move the deployment to a new public hostname.

EULA acceptance short-circuits when the audit log already records an acceptance of the current agreement.

Uninstall¶

cd enforcegate-installer/bundle
docker compose down -v   # -v wipes the named volumes (license, config, certs)
cd ../..
rm -rf enforcegate-installer

Omit -v to preserve the EULA-acceptance audit log and the persisted license — re-running the installer afterwards picks up where you left off.

Upgrading¶

When a new release ships, the upgrade procedure is the same as the appliance — download the new bundle, verify it, and re-run sudo ./install.sh. See upgrade for the full flow.