# Linux host install (systemd)

`install.sh` **only places** the `clabs` binary. To keep discover running on a
Linux host, use a systemd unit — still the same `clabs` binary, not a new agent.

Published artifacts (after release CI):

| Object | URL |
|---|---|
| Installer | `https://install.corporatelabs.ai/install.sh` |
| System unit | `https://install.corporatelabs.ai/systemd/clabs.service` |
| User unit | `https://install.corporatelabs.ai/systemd/clabs-user.service` |
| This doc | `https://install.corporatelabs.ai/LINUX.md` |

## Prerequisites

1. Console → **Installations** → mint a **clabs CLI** access key  
2. Linux amd64 or arm64 with systemd  
3. Outbound HTTPS to `api.corporatelabs.ai` (or your on-prem collector)

## User service (no root)

```bash
curl -fsSL https://install.corporatelabs.ai/install.sh | sh
mkdir -p ~/.config/clabs ~/.config/systemd/user

cat > ~/.config/clabs/env <<'EOF'
CLABS_ACCESS_KEY=clt_…
# optional logical join key for Events filter:
# CLABS_ASSET_ID=my-service
EOF
chmod 600 ~/.config/clabs/env

curl -fsSL https://install.corporatelabs.ai/systemd/clabs-user.service \
  -o ~/.config/systemd/user/clabs.service

systemctl --user daemon-reload
systemctl --user enable --now clabs.service
systemctl --user status clabs.service
```

Optional: `loginctl enable-linger "$USER"` so the unit survives logout.

## System service (root)

```bash
curl -fsSL https://install.corporatelabs.ai/install.sh \
  | CLABS_INSTALL_DIR=/usr/local/bin sudo -E sh

sudo install -d -m 0755 /etc/clabs /var/lib/clabs
sudo tee /etc/clabs/env >/dev/null <<'EOF'
CLABS_ACCESS_KEY=clt_…
EOF
sudo chmod 600 /etc/clabs/env

curl -fsSL https://install.corporatelabs.ai/systemd/clabs.service \
  | sudo tee /etc/systemd/system/clabs.service >/dev/null

sudo systemctl daemon-reload
sudo systemctl enable --now clabs.service
sudo systemctl status clabs.service
```

## What these units run

- **`clabs run`** — continuous discover / socket sampling → Events  
- **Not** `clabs intercept` — MITM stays job-scoped (console Intercept recipe / CI)

## Check Events

Console → **Events**. Rows show `installationId` (stamped from the access key).
If you set `CLABS_ASSET_ID`, filter the Asset column.

## Uninstall

```bash
# user
systemctl --user disable --now clabs.service
rm -f ~/.config/systemd/user/clabs.service

# system
sudo systemctl disable --now clabs.service
sudo rm -f /etc/systemd/system/clabs.service
```

Remove the binary from `~/.local/bin/clabs` or `/usr/local/bin/clabs` as needed.