---
title: "Installation"
description: "Install IronClaw with prebuilt binaries, Docker Compose, or from source."
---

IronClaw ships two host binaries — `ironclaw-controlplane` (the always-on daemon) and `ironctl` (the admin
CLI) — plus a separate sandbox image. Pick the path that fits how you want to run it.

<Tabs>
<Tab title="Prebuilt binaries">

One command installs the latest release. The script detects your OS/arch, downloads the matching archive
from [GitHub Releases](https://github.com/IronSecCo/ironclaw/releases), and verifies its SHA-256 checksum
before installing.

**macOS / Linux**

```sh
curl -fsSL https://raw.githubusercontent.com/IronSecCo/ironclaw/main/scripts/install.sh | sh
```

**Windows (PowerShell)**

```powershell
irm https://raw.githubusercontent.com/IronSecCo/ironclaw/main/scripts/install.ps1 | iex
```

A fresh release is published on every push to `main`, with prebuilt archives for macOS (Intel + Apple
Silicon), Linux (`amd64` + `arm64`), and Windows (`amd64`). Useful environment variables (pass them on the
`sh` side of the pipe):

```sh
# Pin a version instead of latest
curl -fsSL https://raw.githubusercontent.com/IronSecCo/ironclaw/main/scripts/install.sh | IRONCLAW_VERSION=v0.1.66 sh
# Choose the install directory
curl -fsSL https://raw.githubusercontent.com/IronSecCo/ironclaw/main/scripts/install.sh | IRONCLAW_BINDIR="$HOME/bin" sh
```

Then confirm what you installed:

```sh
ironctl --version
```

</Tab>
<Tab title="Docker Compose">

Self-host the control-plane in one command. From a clone:

```sh
cp .env.example .env          # fill in ANTHROPIC_API_KEY (optional to boot)
docker compose up -d          # builds locally on first run, or pulls the GHCR image
docker compose logs -f controlplane   # CLAIM the admin token printed once on first run
```

The control-plane image is published to GitHub Container Registry on every release:

```sh
docker pull ghcr.io/ironsecco/ironclaw-controlplane:latest
```

See [Self-Hosting → Docker](/site/self-hosting/docker) for the full walkthrough.

</Tab>
<Tab title="From source">

Requires Go 1.23+ and a C toolchain (`CGO_ENABLED=1` — the encrypted-SQLite binding builds via cgo).

```sh
git clone https://github.com/IronSecCo/ironclaw.git
cd ironclaw

make build            # == go build ./...

# Or install the two host binaries onto your PATH
go build -o /usr/local/bin/ironclaw-controlplane ./cmd/controlplane
go build -o /usr/local/bin/ironctl               ./cmd/ironctl
```

For a full system install — binaries, `/etc/ironclaw` + `/var/lib/ironclaw`, and a service (systemd on
Linux, launchd on macOS) — run `sudo deploy/install.sh`. See [Self-Hosting → From source](/site/self-hosting/from-source).

</Tab>
</Tabs>

## Prerequisites

| Dependency | When you need it |
|---|---|
| **Go 1.23+ and a C toolchain** | Building from source (`CGO_ENABLED=1`). |
| **containerd + gVisor (`runsc`)** | Production sandboxing. Not needed for `--dev` or the gateway-only flow. |
| **Tailscale** | Recommended for safe remote access to the control-plane API. |
| **An Anthropic API key** | For agents to call a model. Held host-side; never enters a sandbox. |

The external runtime dependencies (gVisor, Tailscale, the encrypted-SQLite binding) are intentionally
**not vendored**. See [Self-Hosting → Production](/site/self-hosting/production) for host setup.

## Next

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/site/quickstart">
    Submit and approve your first change in dev mode.
  </Card>
  <Card title="Configuration" icon="sliders" href="/site/configuration">
    Every environment variable and control-plane flag.
  </Card>
</CardGroup>
