Community · power users
Linux binary
Static SQLite, no Zig required. Current beta: v0.3.0-beta.10 (x86_64, glibc).
curl -fsSL -O https://git.sovereign-society.org/libertaria/Jarvis/releases/download/v0.3.0-beta.10/jarvis-0.3.0-beta.10-x86_64-linux.tar.gz
curl -fsSL -O https://git.sovereign-society.org/libertaria/Jarvis/releases/download/v0.3.0-beta.10/jarvis-0.3.0-beta.10-x86_64-linux.sha256
sha256sum -c jarvis-0.3.0-beta.10-x86_64-linux.sha256
tar -xzf jarvis-0.3.0-beta.10-x86_64-linux.tar.gz
cd jarvis-0.3.0-beta.10-x86_64-linux
./install.sh
export PATH="$HOME/.local/bin:$PATH"
jarvis setup
jarvis doctor --section setup
jarvis tui
Release page →
Community · Arch / CachyOS
AUR (jarvis-bin)
Binary package from the same release asset. PKGBUILD lives in the repo under packaging/aur/jarvis-bin until published to the AUR.
# After AUR publish:
yay -S jarvis-bin
# Or local:
cd packaging/aur/jarvis-bin && makepkg -si
jarvis doctor
Optional: install podman for agent isolation (recommended).
Enterprise · Wolfi hardened
Podman EE (Wolfi) Recommended
Chainguard wolfi-base (digest-pinned), non-root, hardened.
Runs harnessd with Glass on port 7777 (fleet, runs, approvals — bearer-token auth). The Wolfi path replaces
the long-deferred "Phase B (static musl)" deferral.
cd jarvis # git clone of libertaria/Jarvis
./packaging/containers/build-ee-wolfi.sh v0.3.0-beta.10
export JARVIS_BEARER_TOKEN=$(openssl rand -hex 24)
podman run -d --name jarvis-ee -p 7777:7777 \
-e JARVIS_BEARER_TOKEN -e JARVIS_UTCP_PORT=7777 \
-v jarvis-ee-data:/var/lib/jarvis \
localhost/jarvis-ee:v0.3.0-beta.10
curl -s http://127.0.0.1:7777/health
Then open Glass Settings with base http://127.0.0.1:7777 and the same token.
Community · Debian container
Podman CE
Debian Trixie base, free forever (LSL-1.0). For daemon-only hosts
that don't need Glass or the commercial EE posture.
./packaging/containers/build.sh v0.3.0-beta.10
podman run -d --name jarvis-ce \
-v jarvis-ce-data:/var/lib/jarvis \
localhost/jarvis-ce:v0.3.0-beta.10
podman logs -f jarvis-ce
Image labels declare edition=ce, license-model=free-forever.
Enterprise · Debian fallback
Podman EE (Debian)
Same EE artifact, Debian Trixie base. Use when your registry
can't pull from cgr.dev/chainguard.
podman build -f packaging/containers/Containerfile.ee \
--build-arg USE_LOCAL=1 \
--build-arg JARVIS_VERSION=v0.3.0-beta.10 \
-t localhost/jarvis-ee-debian:v0.3.0-beta.10 .
export JARVIS_BEARER_TOKEN=$(openssl rand -hex 24)
podman compose -f packaging/containers/compose.ee.yml up -d
curl -s http://127.0.0.1:7777/health
Wolfi is the recommended path for production. Use this when Wolfi
images aren't available in your registry. Details: packaging/containers/README.md.
Sovereign pattern
Sober ↔ Jarvis
Jarvis's container layout mirrors Sober's sibling-repo pattern: each edition gets its own Containerfile, build.sh, and docker-entrypoint.sh. Sober's sober-enterprise-image uses Chainguard Wolfi the same way Jarvis EE now does.
| Sober | Jarvis |
|---|
sober-community-image/ | packaging/containers/Containerfile.ce |
sober-enterprise-image/ (Wolfi) | packaging/containers/Containerfile.ee.wolfi |
sober-web entrypoint dispatch | jarvis-entrypoint env-driven dispatcher |
cockpit (private EE) | harnessd + Glass API (token-gated) |
Sober publishes its images and Jarvis matches the pattern. Both editions
are pushed to the sovereign forge's local container registry on every v* tag.
Sovereign forge · registry
Pull from the forge registry
Once published, every tagged JARVIS image is reachable from any container
on the sovereign forge's host network via 127.0.0.1:5000. Containers outside the forge can pull
through the SSH tunnel or a forwarding reverse-proxy.
# On a forge-resident container (host network or bridge with :5000 accessible)
podman pull 127.0.0.1:5000/jarvis-ce:v0.3.0-beta.10
podman pull 127.0.0.1:5000/jarvis-ee:v0.3.0-beta.10
# From outside, via SSH tunnel
ssh -L 5000:127.0.0.1:5000 -p 30022 [email protected] -N &
podman pull --tls-verify=false 127.0.0.1:5000/jarvis-ee:latest
Registry catalog (anonymous) returns 401, authed operators see the full
list. Credentials live in ~/.config/jarvis/forge-auth.env on operator workstations; CI gets them via Forgejo Actions secrets.