Installation
Public beta
Every channel below is live — Homebrew, Scoop, Docker, .deb/.rpm, and direct
downloads are published on each release
(Releases).
macOS / Linux — Homebrew
The cask strips the macOS Gatekeeper quarantine flag automatically, so the binary runs without the "unidentified developer" prompt.
Windows — Scoop
Linux — deb / rpm
Download the package for your architecture from the latest release:
sudo dpkg -i apiary_*_linux_amd64.deb # Debian / Ubuntu
sudo rpm -i apiary_*_linux_amd64.rpm # Fedora / RHEL
arm64 packages are published too — swap amd64 for arm64.
Docker
Multi-arch image (linux/amd64, linux/arm64). Apiary persists state in a
SQLite database — mount a volume at /data to keep it across runs.
Direct download
Grab the archive for your OS/arch from the
latest release
(.tar.gz for macOS/Linux, .zip for Windows), verify it against
checksums.txt, extract, and put apiary on your PATH.
Unsigned binaries
Releases are not yet code-signed or notarized.
- macOS — a directly downloaded binary is quarantined by Gatekeeper.
Clear it with
xattr -dr com.apple.quarantine ./apiary. (The Homebrew cask does this for you.) - Windows — SmartScreen may warn "unknown publisher". Choose More info → Run anyway.
Code signing and notarization are on the roadmap.
From source
See the Development guide for building with the Go toolchain.
Verify the install
Upgrading
Apiary is a single binary; upgrading replaces it in place and your project
state (.apiary/ directories) is untouched.
brew upgrade --cask orlandoburli/tap/apiary # Homebrew
scoop update apiary # Scoop
docker pull ghcr.io/orlandoburli/apiary:latest # Docker
For .deb/.rpm and direct downloads, install the new release the same way
as the original.
Pin a version
Apiary is in public beta — config and adapter APIs may still change
before v1.0. For anything you depend on, pin a release (e.g. the
ghcr.io/orlandoburli/apiary:0.23.0 Docker tag) and read the
release notes before
upgrading.
Security hardening (shared hosts)
Apiary writes its config file (apiary.yaml), the SQLite database, log files,
per-task transcripts, and the agent memory store with 0600/0700
permissions, so only the owning OS user can read them. Those files hold
tokens, prompt history, and issue content that must stay private.
On a shared Linux/macOS host, the additional recommended step is to run the daemon under a dedicated non-login service account rather than your personal user:
# Create a dedicated user (Linux)
sudo useradd --system --no-create-home --shell /usr/sbin/nologin apiary
# Transfer ownership of the data directory
sudo chown -R apiary:apiary /var/lib/apiary
# Run as the service account (systemd example)
# User=apiary in your [Service] unit
Because Apiary itself enforces 0600/0700 on everything it creates, the service account ensures that no other human login on the same machine can reach the data directory even if the directory was created before Apiary tightened its permissions.
Next step
Continue with the Quickstart — from a fresh install to your first autonomously handled issue in about ten minutes.