You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/src/contribute/images.md
+3-14Lines changed: 3 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -106,24 +106,13 @@ go install -v github.com/AUTHOR/REPO@latest
106
106
asdf reshim golang
107
107
```
108
108
109
-
The `go install` command will work with the default version of golang (managed via `asdf`), currently being 1.22.2, set in `package_base`, in the `install_go()` function, with `asdf set --home golang 1.22.2`.
109
+
The `go install` command will work with the default version of golang (managed via `asdf`), currently being `1.22.2`, set in `package_base`, in the `install_go()` function.
110
110
111
-
If another version is needed, when a tool requires go >= 1.22.2, the following template can be used:
111
+
If another version is needed, the following instruction should be used before the `go install -v ...`:
112
112
113
113
```bash
114
-
mkdir /opt/tools/TOOL_NAME
115
-
cd /opt/tools/TOOL_NAME
114
+
# Example with Golang 1.24.4
116
115
asdf set golang 1.24.4
117
-
mkdir -p .go/bin
118
-
GOBIN=/opt/tools/TOOL_NAME/.go/bin go install -v github.com/REPO_NAME/TOOL_NAME@latest
119
-
asdf reshim golang
120
-
add-aliases TOOL_NAME
121
-
```
122
-
123
-
And then the alias being like:
124
-
125
-
```bash
126
-
alias TOOL_NAME="/opt/tools/TOOL_NAME/.go/bin/TOOL_NAME"
Copy file name to clipboardExpand all lines: docs/src/dashboard/settings.md
+13Lines changed: 13 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -102,6 +102,19 @@ To log out from all other devices where you're signed in:
102
102
103
103
:::
104
104
105
+
## API keys
106
+
107
+
API keys allow you to authenticate with Exegol services in a non-interactive way. This is available to both Pro and Enterprise users.
108
+
109
+
You can create, revoke, and remove API keys from their section in Settings. API keys can be used with the Exegol wrapper for [unattended activation](/wrapper/cli/activate#unattended-activation), which may be useful for automation, CI/CD, or scripted setups.
110
+
111
+
-**One-time display**: The key value is shown only once at creation. Store it securely; it cannot be displayed again.
112
+
-**Lifespan**: You can set a lifespan of up to **2 years** when creating a key.
113
+
-**Scope**: An API key gives the wrapper access to **all licenses** attached to an account.
114
+
115
+
> [!WARNING]
116
+
> Treat API keys like passwords. Never share them or commit them to version control. Revoke any key that may have been exposed.
117
+
105
118
## Account Deletion
106
119
107
120
Account deletion requests are currently processed manually by our team to ensure proper handling of active subscriptions before account closure. This prevents you from being locked out while subscriptions are still active. This process will be automated as we scale up.
In order to **shares notes** during an engagement, `trilium`
62
62
(<https://github.com/TriliumNext/Trilium>) can be used.
63
63
64
+
## Transferring images to an offline machine
65
+
66
+
A machine activated with the [offline procedure](/wrapper/cli/activate#offline-option) cannot pull Exegol images from the Internet.
67
+
68
+
The image needs to be downloaded on an Internet-facing machine first, then transferred onto the offline one.
69
+
70
+
The following example uses the `full` image. It all starts on the Internet-facing machine.
71
+
72
+
1. Activate Exegol with [default](/wrapper/cli/activate#default-activation) or [unattended](/wrapper/cli/activate#unattended-activation) activation.
73
+
74
+
2. Install the image(s) with `exegol install full`
75
+
76
+
3. Export the image to a tarball: `docker save registry.exegol.com/exegol:full --output "/path/to/image.tar"`
77
+
78
+
4. Transfer the file to the offline machine by any secure means.
79
+
80
+
5. Then, on the offline machine, load the image with: `docker load --input "/path/to/image.tar"`
81
+
82
+
6. Verify the import worked and Exegol can see the image: `exegol info`. You should see the loaded image listed. You can then use `exegol start` and other wrapper commands as usual.
83
+
64
84
## Dynamic history commands
65
85
66
86
Many commands in the pre-filled history rely on environment variables
Copy file name to clipboardExpand all lines: docs/src/wrapper/cli/activate.md
+51-22Lines changed: 51 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,44 +4,73 @@ The `activate` action is used to activate Exegol with a valid Pro/Enterprise lic
4
4
Exegol in a professional environment. Without activation, Exegol will run in Community edition mode with limited
5
5
features.
6
6
7
-
When activating Exegol, you will need:
8
7
9
-
1. A valid Exegol account (email)
10
-
2. An active license assigned to your account
11
-
3. Internet access to connect to the license server
8
+
## Default activation
12
9
13
-
> [!NOTE] Offline Activation
14
-
>
15
-
> If you need to activate Exegol in an offline environment, please contact us directly. We may be able to provide
16
-
> offline activation solutions on a case-by-case basis for specific clients.
10
+
This is the default interactive activation method (online, interactively).
11
+
12
+
1. Run `exegol activate`
13
+
2. The wrapper will prompt you to enter your Exegol email address
14
+
3. You will need to generate a login token from the Exegol dashboard [OTP](https://dashboard.exegol.com/otp) page
15
+
4. Enter the token when prompted
16
+
5. Select which license to activate
17
+
18
+
## Unattended activation
19
+
20
+
You can activate Exegol without any interactive prompts (e.g. for automation, CI/CD, or remote setup).
17
21
18
-
## Activation process
22
+
1. Create and save an API key from the Exegol dashboard "[Settings](https://dashboard.exegol.com/settings)" page. See the [API keys docs](/dashboard/settings#api-keys) for more info. **The key is shown only once at creation**.
23
+
2. Retrieve the License ID you want to activate, from the Exegol dashboard "[My licenses](https://dashboard.exegol.com/licenses)" page. The ID can be copied from the three-dots menu in the Action column.
19
24
20
-
1. The wrapper will prompt you to enter your Exegol email address
21
-
2. You will need to generate a login token from the Exegol dashboard [/otp](https://dashboard.exegol.com/otp) page
22
-
3. Enter the token when prompted
23
-
4. If you have multiple licenses, you will be presented with a list to choose from
24
-
5. If the selected license is already in use on another machine, you will be asked if you want to revoke it from that
25
-
machine
26
-
6. Once activated, the license will be bound to your current machine
25
+
Use the following command, replacing the placeholders with your API key and license ID:
Alternatively, if you set the `EXEGOL_API_KEY` and `EXEGOL_LICENSE_ID` environment variables, you can run without arguments:
32
+
33
+
```bash
34
+
exegol activate --accept-eula
35
+
```
36
+
37
+
## Offline option <Badgetype="enterprise"/>
38
+
39
+
The **offline mode** is a paid option of the **Exegol Enterprise** tier. Licenses with that option are not affected by the usual 7-days offline limit. They can be activated like other standard Licenses with both [Default activation](#default-activation) or [Unattended activation](#unattended-activation) methods described above.
40
+
41
+
This option can also prove useful for machines that will never be connected to the Internet, as they can be activated using the dedicated offline activation procedure described below.
42
+
43
+
1. Run `exegol activate --offline` on the offline machine, and retrieve the "Activation ID"
44
+
2. On an Internet-connected machine, open the Exegol dashboard "[My licenses](https://dashboard.exegol.com/licenses)" page, identify the "Offline" license to activate, then click "Offline Enrollment" in the three-dots menu from the Actions column
45
+
3. Fill in the form with the Activation ID, set an OS and name for the machine
46
+
3. Download the resulting `license.key` file and place it on the offline machine at `~/.exegol/license.key`
47
+
48
+
Once the license key is in place, the offline machine will be considered activated without needing any Internet access.
49
+
50
+
> [!INFO]
51
+
> This activation procedure is meant for machines that will never be connected to the Internet. They won't be able to download Exegol images.
29
52
>
30
-
> You can only have one active license per machine at a time. If you want to activate a different license, you must
31
-
> first revoke the current one using the `--revoke` option.
53
+
> To install Exegol images on a fully offline machine, use the procedure described in [Transferring images to an offline machine](/tips-and-tricks#transferring-images-to-an-offline-machine): activate and pull the image on an Internet-connected station, export it with `docker save`, transfer the archive, then load it on the offline machine with `docker load` and run `exegol info` to verify.
Copy file name to clipboardExpand all lines: docs/src/wrapper/cli/start.md
+23-11Lines changed: 23 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,19 +41,21 @@ Many options exist to customize the creation of exegol container.
41
41
|`-V VOLUMES`, `--volume VOLUMES`| Share a new volume between host and exegol (format: --volume /path/on/host/:/path/in/container/\[:ro\|rw\]). |
42
42
|`-p PORTS`, `--port PORTS`| Share a network port between host and exegol (format: `--port [<host_ipv4>:]<host_port>[-<end_host_port>][:<container_port>[-<end_container_port>]][:<protocol>]`. This configuration will disable the shared network with the host. |
43
43
|`--hostname HOSTNAME`| Set a custom hostname to the exegol container (default: exegol-\<name\>) |
44
+
|`--hosts-file HOSTS_FILE`| Import custom host entries from a file (format: IP HOSTNAME) |
44
45
|`--disable-X11`| Disable X11 sharing to run GUI-based applications. (default: Enabled) |
45
46
|`--disable-my-resources`| Disable the mount of the shared resources (/opt/my-resources) from the host (/home/dramelac/.exegol/my-resources) (default: Enabled) |
46
47
|`--disable-exegol-resources`| Disable the mount of the exegol resources (/opt/resources) from the host (/home/dramelac/Documents/tools/Exegol/exegol-resources) (default: Enabled) |
47
48
|`--network NETWORK`| <Badgetype="new"/> Configure the container's network mode (default: host). See [Network Modes](#network-modes) for details. |
48
49
|`--disable-shared-timezones`| Disable the sharing of the host's time and timezone configuration with exegol (default: Enabled) |
50
+
|`--comment`| The specified comment will be added to the container info |
49
51
50
52
### Privileges
51
53
52
54
By default, the Exegol container will receive the minimum permissions required by the enabled features.
53
55
54
56
> [!NOTE] Automatic permissions
55
57
> Permissions will be added automatically if required. For example, when the `--vpn` parameter is used,
56
-
devices and capabilities are automatically added to enable the VPN to operate with the least privileges possible.
58
+
> devices and capabilities are automatically added to enable the VPN to operate with the least privileges possible.
@@ -62,26 +64,33 @@ devices and capabilities are automatically added to enable the VPN to operate wi
62
64
|`--privileged`|**(dangerous)** Give extended privileges at the container **creation** (e.g. needed to mount things, to use Wi-Fi or Bluetooth) |
63
65
64
66
> [!CAUTION] Avoid using privileged mode unless absolutely necessary
65
-
> This flag grants the container nearly unrestricted access to the host, effectively breaking most security boundaries
66
-
> Docker puts in place (all Linux kernel capabilities are enabled; seccomp, AppArmor and SELinux protections are disabled;
67
+
> This flag grants the container nearly unrestricted access to the host, effectively breaking most security boundaries
68
+
> Docker puts in place (all Linux kernel capabilities are enabled; seccomp, AppArmor and SELinux protections are
69
+
> disabled;
67
70
> the container can access all host devices; and major mounts become read-write).
68
71
69
72
#### New container
70
73
71
74
When a new container is created, it is possible to:
72
75
73
-
- Add the specific [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) needed with `--cap`, among the following list: `NET_ADMIN`, `NET_BROADCAST`, `SYS_MODULE`, `SYS_PTRACE`, `SYS_RAWIO`,
74
-
`SYS_ADMIN`, `LINUX_IMMUTABLE`, `MAC_ADMIN`, `SYSLOG`. `ALL` is a special value that sets them all (all capabilities supported by Docker, [read more](https://docs.docker.com/engine/containers/run/#runtime-privilege-and-linux-capabilities)).
76
+
- Add the specific [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) needed with `--cap`, among
77
+
the following list: `NET_ADMIN`, `NET_BROADCAST`, `SYS_MODULE`, `SYS_PTRACE`, `SYS_RAWIO`,
78
+
`SYS_ADMIN`, `LINUX_IMMUTABLE`, `MAC_ADMIN`, `SYSLOG`. `ALL` is a special value that sets them all (all capabilities
- Identify which devices are required and add specific devices with `-d`/`--device`.
76
-
- If you need "root access" (i.e., all capabilities, and access to all devices, hardware and kernel of the host) the `--privileged` option can be used.
82
+
- If you need "root access" (i.e., all capabilities, and access to all devices, hardware and kernel of the host) the
83
+
`--privileged` option can be used.
77
84
78
85
> [!WARNING]
79
-
> The privileges configured when creating the container will be given to all processes in that container for the entirety of its lifetime.
86
+
> The privileges configured when creating the container will be given to all processes in that container for the
87
+
> entirety of its lifetime.
80
88
81
89
#### Existing container <Badgetype="new"/>
82
90
83
91
When the container already exists, you cannot change the default privileges mode, capabilities or share new devices.
84
-
However, it is possible to spawn a **single** shell session with **all capabilities** with `--cap ALL`. The capabilities won't be added to the container itself and will only be valid for the specific shell the flag was enabled for.
92
+
However, it is possible to spawn a **single** shell session with **all capabilities** with `--cap ALL`. The capabilities
93
+
won't be added to the container itself and will only be valid for the specific shell the flag was enabled for.
85
94
86
95
### Network modes
87
96
@@ -165,15 +174,18 @@ users a full-featured desktop experience directly from their browser.
165
174
166
175
### VPN
167
176
168
-
An additional feature of Exegol is the managed VPN tunnel. Compatible with OpenVPN and WireGuard since Exegol image version `3.1.8`.
177
+
An additional feature of Exegol is the managed VPN tunnel. Compatible with OpenVPN and WireGuard since Exegol image
178
+
version `3.1.8`.
169
179
170
-
- To configure an OpenVPN tunnel, your configuration file must have the `.ovpn` extension or the directory must contain an `.ovpn` file.
180
+
- To configure an OpenVPN tunnel, your configuration file must have the `.ovpn` extension or the directory must contain
181
+
an `.ovpn` file.
171
182
- To configure a WireGuard VPN, your configuration file must have the `.conf` extension.
172
183
173
184
The container will take care of starting the tunnel at each startup.
174
185
175
186
> [!IMPORTANT] WrireGuard support
176
-
> WireGuard VPN support is currently in beta and exclusive to <Badgetype="pro" /> and <Badgetype="enterprise" /> users at this time.
187
+
> WireGuard VPN support is currently in beta and exclusive to <Badgetype="pro" /> and <Badgetype="enterprise" /> users
188
+
> at this time.
177
189
178
190
> [!INFO]
179
191
> When using the `--vpn` feature, network mode defaults to `docker`, or `nat` if the user has a
0 commit comments