Installation
Prerequisites
- SSH access to your target servers
- Docker or Podman on the machine that builds images (your local machine by default, or the configured remote builder)
- sudo privileges on target servers
Install Jiji
curl -fsSL https://get.jiji.run/install.sh | shInstalls the latest release to ~/.local/bin/jiji for Linux or macOS,
x86_64 or arm64 (auto-detected). Pin a specific version:
curl -fsSL https://get.jiji.run/install.sh | VERSION=v1.2.3 shOn Windows, use WSL2 and the Linux instructions above.
Build from source
For development, or to run an unreleased commit:
git clone https://github.com/acidtib/jiji.git
cd jiji
mise install # cargo build --release --bin jiji -> ~/.local/bin/jijiIf you don’t use mise , build directly and put the
binary on your PATH yourself:
cargo build --release --bin jiji
# binary is at target/release/jijiUpgrading
jiji updateDownloads the latest release, verifies its checksum, and replaces the installed binary in place. Exits without changing anything if you’re already current.
Pin or roll back to a specific release:
jiji update --release v1.2.3Check what’s available without installing it:
jiji update --checkjiji update only replaces the local jiji binary. It never touches remote
servers, jiji-agent, or jiji-proxy — after updating, run jiji server upgrade -e <environment> for
each environment configuration to bring your servers up to date.
Server Requirements
Target Servers need:
- Linux (developed and tested on Ubuntu 24.04; other distributions may work)
- An SSH server
- Docker or Podman (with root access, jiji installs a missing engine and upgrades Podman when the installed version is older than 5.8.4)
- These ports reachable:
On Debian and Ubuntu, jiji installs a pinned
mgoltzsche/podman-static
5.8.4 bundle for Podman. This is an unofficial, single-maintainer
distribution. Jiji verifies the pinned archive checksum before installing it.
| Port | Protocol | Purpose |
|---|---|---|
| 22 | TCP | SSH |
| 80/443 | TCP | HTTP/HTTPS, if a service uses an HTTP proxy: target |
Configured listen_port values | TCP | Raw TCP ingress, if a service uses a TCP proxy: target |
| 51820-55819 | UDP | WireGuard - one port per project, derived deterministically, not always 51820 |
There’s no separate database or gossip port to open; run jiji network plan to see the exact WireGuard port your project will use.
Verify Installation
jiji versionInitialize a Project
cd your-project
jiji initCreates .jiji/deploy.yml.
Initialize Servers
Before your first deployment:
jiji server setupThis installs the container engine (if needed), the complete private
network for this project (WireGuard, a routed container bridge, and the
distributed agent for .jiji DNS, catalog, membership, and leases), and
provisions the shared jiji-proxy container for HTTP, HTTPS, and configured
raw TCP routing.