Quick start

Tyr can be running in about 60 seconds. Pick the option that matches your platform.

Option 1 — Docker Compose (recommended)

This pulls pre-built images from GHCR. No git clone required.

curl -sSL https://raw.githubusercontent.com/terranchi/tyr/main/docker-compose.yml \
  | docker compose -f - up

What just happened:

• PostgreSQL 17 started on port 5432.
• tyr-server started and pre-seeded a bootstrap enrollment token (tyr-quickstart-token).
• tyr-agent started with host-privileged networking, mounted /sys/kernel/debug and /sys/fs/bpf, attached eBPF programs to your host kernel, and registered with the server.

Open http://localhost:7701, complete the one-time setup wizard (creates the first admin user), and you should see the docker-host agent online and events streaming in.

Linux host only for real monitoring

On macOS or Windows, Docker Desktop runs in a Linux VM that cannot reach your host kernel. The server + web UI will work, but tyr-agent will fail to load eBPF programs. Either delete the tyr-agent service from docker-compose.yml to run server-only, or install Tyr natively on a Linux host and point it at this server.

Option 2 — Native Linux install

If you want the agent running against your real host kernel (no Docker indirection):

curl -sSL https://raw.githubusercontent.com/terranchi/tyr/main/scripts/install.sh | bash

The script offers an interactive menu:

• Install the agent (requires Linux + kernel 5.15+)
• Install the CLI only
• Install both

It downloads the correct tarball for your architecture from the Releases page, drops binaries into /usr/local/bin, and (for the agent) installs a tyr-agent.service systemd unit.

Non-interactive:

curl -sSL https://raw.githubusercontent.com/terranchi/tyr/main/scripts/install.sh \
  | bash -s -- --component both \
               --server https://your-server:7700 \
               --token  <enrollment-token> \
               --name   my-laptop

See the Linux systemd guide for ongoing operation.

Option 3 — Build from source

1. Install prerequisites:

   # macOS
   brew install rustup protobuf pnpm
   
   # Ubuntu/Debian
   sudo apt install rustup protobuf-compiler
   curl -fsSL https://get.pnpm.io/install.sh | sh -

2. Clone and build:

   git clone https://github.com/terranchi/tyr.git
   cd tyr
   cargo build --release        # builds tyr, tyr-server, tyrd
   cd web && pnpm install && pnpm build && cd ..

3. Run the dev stack (builds images from source):

   docker compose -f deploy/docker-compose.dev.yml up

Next steps

• Your first policy — move from alert-only to blocking dangerous operations.
• Connecting an agent — enroll a second host.
• Architecture — how the pieces fit together.