Single Command Install
One command, production-ready in 5 minutes
Run this one command on your Linux server as root. During installation you will only be asked for an admin email + password. Everything else is automatic: Docker is installed if missing, images are anonymously pulled from the registry, MongoDB Replica Set is brought up, the admin user is created. No Azure account or other credentials required.
Single command — same on all major Linux distributions
# Sunucunuza SSH ile bağlanın, sonra:
curl -fsSL https://sentineldb360.com/install.sh | sudo bash
Supported Linux distributions
install.sh uses Docker's official get.docker.com convenience script — the same single command works identically on all distributions below:
| Distribution |
Version |
Single command |
Note |
| Ubuntu | 22.04 / 24.04 LTS | ✓ | Most-tested |
| Debian | 12 (Bookworm) / 13 | ✓ | Identical to Ubuntu |
| RHEL | 8 / 9 | ✓ | Docker via dnf |
| Rocky Linux | 8 / 9 | ✓ | RHEL-compatible |
| AlmaLinux | 8 / 9 | ✓ | RHEL-compatible |
| Oracle Linux | 8 / 9 | ✓ | RHEL-compatible |
| CentOS Stream | 9 / 10 | ✓ | RHEL upstream |
| Fedora | 38+ | ✓ | Docker official support |
| Amazon Linux | 2023 | ✓ | Common on EC2 |
| SUSE / openSUSE | Leap 15.5+ | ⚠ | First run zypper install docker docker-compose |
| Alpine | 3.18+ | ⚠ | First run apk add docker docker-cli-compose |
| Arch / Manjaro | rolling | ⚠ | First run pacman -S docker docker-compose |
⚠ marked distributions: Install Docker via your package manager first, then run the same single command. install.sh detects existing Docker and skips installation. Architecture: AMD64 (x86_64) — for ARM64, an air-gapped tarball is required (contact DMC).
Non-interactive (CI / IaC / Ansible)
# Admin bilgilerini env üzerinden geçin — soru sorulmaz
curl -fsSL https://sentineldb360.com/install.sh | \
sudo [email protected] \
SENTINEL_ADMIN_PASS=
'GüçlüParola123!' \
bash
All environment variables (optional override)
| Variable |
Description |
Default |
SENTINEL_MODE | Install mode: poc or production | poc |
SENTINEL_ADMIN_EMAIL | First admin email (asked interactively in interactive mode) | — |
SENTINEL_ADMIN_PASS | First admin password (min 12 chars; production: upper+lower+digit+symbol) | — |
SENTINEL_LICENSE_KEY | Ed25519-signed JWT license (required in production) | — |
SENTINEL_PUBLIC_IP | Public IP override (Azure/AWS metadata auto-detected) | auto-detect |
SENTINEL_VERSION | Image version | v1.7.25 |
SENTINEL_BASE_URL | Asset host override (your own mirror for air-gap) | SWA URL |
SENTINEL_ACR_USERNAME | Private ACR pull username (with token) | — (anonymous) |
SENTINEL_ACR_PASSWORD | Private ACR pull password/token | — (anonymous) |
SENTINEL_FIREWALL_AUTOOPEN | ufw/firewalld auto-open ports (80, 3000, 8001) | poc=yes, prod=no |
SENTINEL_SKIP_DOCKER_INSTALL | Skip Docker installation (assumed already installed) | no |
SENTINEL_KEEP_PLAINTEXT_PASS | Do not remove ADMIN_PASSWORD from .env after seed (warning) | no |
INSTALL_DIR | Install root directory | /opt/sentineldb360 |
PoC vs Production modes
Switch between two main modes via SENTINEL_MODE. PoC for testing/evaluation, production for production deployment.
| Behavior |
PoC (default) |
Production |
SENTINEL_LICENSE_KEY | Optional (LICENSE_LOCAL_FALLBACK=true) | Required (Ed25519 JWT) |
| 14-day free full feature | ✓ | — (license required) |
| Docker install confirmation | Automatic (silent) | Interactive confirm |
| Firewall auto-open | ufw/firewalld opens | Sysadmin manual (command suggested) |
| Password policy | Min 12 characters | 12 + upper + lower + digit + symbol |
| Min CPU | 2 vCPU | 4 vCPU |
| Min RAM | 4 GB | 8 GB |
| OS allowlist | Unknown distros pass with warning | Strict (Ubuntu/Debian/RHEL/Rocky/Alma/Oracle/CentOS/Fedora/Amazon Linux) |
| Plaintext password removed after seed | ✓ | ✓ (enforced) |
Production example (for enterprise customers)
# DMC'den lisans satırı aldıktan sonra:
curl -fsSL https://sentineldb360.com/install.sh | \
sudo SENTINEL_MODE=production \
SENTINEL_LICENSE_KEY=
'eyJhbGciOiJFZERTQSI...' \
[email protected] \
SENTINEL_ADMIN_PASS=
'GüçlüProdParola123!@' \
bash
Air-gapped + Private ACR (banks, government, critical infrastructure)
# Asset'leri kendi intranet mirror'unuzda servis edin (sentineldb360.com erişimi yok)
# ACR yerine kendi private registry mirror'unuzu pull edin
sudo \
SENTINEL_MODE=production \
SENTINEL_BASE_URL=https://intranet.kurum.com/sentinel \
SENTINEL_ACR_USERNAME=mirror-pull \
SENTINEL_ACR_PASSWORD="$(cat /etc/sentinel/acr-token)" \
SENTINEL_LICENSE_KEY="$(cat /etc/sentinel/license.jwt)" \
SENTINEL_FIREWALL_AUTOOPEN=no \
bash install.sh
install.sh 9 stages (~5-10 min total)
- System check — OS allowlist, x86_64 required, CPU/RAM (mode-based min), disk, swap/OOM warning, SELinux Enforcing detection, port conflict (80/3000/8001-8004 via
ss), network reachability test.
- Docker — Existing version + compose v2.20+ check. If absent, installed from
get.docker.com with sha256 verification (interactive confirm in production mode); install log to /tmp/.
- Asset download — 11 files HTTPS-downloaded to
/opt/sentineldb360/, retry+critical file integrity check.
- Container Registry access — If private credentials provided,
docker login; otherwise anonymous pull verification (test image pulled then removed).
- Admin user — Interactive email + password prompt (TTY hack works with
curl | bash) or env vars. Production mode enforces password policy.
- License — Production:
SENTINEL_LICENSE_KEY JWT format check (xxxx.yyyy.zzzz). PoC: LICENSE_LOCAL_FALLBACK=true automatic.
- Configuration —
.env.production generated (chmod 600, root:root): 256-bit JWT/SECRET/ENC, MongoDB password, public IP auto-detected. Firewall mode-based.
- Containers — ACR pull (~2.5 GB), MongoDB keyfile + data dirs,
docker compose up -d.
- Health check — Backend
/api/health waits up to 120s, frontend + site, MongoDB RS 3/3 (container_name independent: compose ps -q), idempotent admin user verification (create_admin.py), plaintext ADMIN_PASSWORD removed from .env.
Enterprise hardening features
install.sh v2 is hardened for banking/government/critical infrastructure. The following checks are automatic:
- OS allowlist: In production mode, only Ubuntu/Debian/RHEL/Rocky/Alma/Oracle/CentOS/Fedora/Amazon Linux. Others pass with warning in PoC mode.
- Architecture required: x86_64/AMD64. ARM64 needs air-gapped tarball (DMC).
- Port conflict: If 80, 3000, 8001-8004 are used by other services, install does not start;
lsof command suggested to find responsible process.
- Disk + RAM + Swap: <16 GB RAM + 0 swap = OOM warning + swap setup command.
- SELinux Enforcing: Detected,
chcon -Rt svirt_sandbox_file_t suggested for Docker volumes.
- Compose v2.20+: Required for healthcheck depends_on, warning on older versions.
- Firewall: ufw/firewalld detection. Auto-opens in PoC; suggests command to sysadmin in production.
- ACR private token:
SENTINEL_ACR_USERNAME/PASSWORD for docker login; otherwise anonymous pull verified.
- Bcrypt + plaintext cleanup: Backend startup seeds admin, install.sh then removes
ADMIN_PASSWORD from .env via sed. Disable with SENTINEL_KEEP_PLAINTEXT_PASS=yes (with warning).
- Container_name independent healthcheck:
docker compose ps -q <service> for container ID. Does not break if compose service name is renamed.
- Trap rollback: On error, containers are stopped, data directories preserved (no loss risk), manual cleanup command suggested.
- Readable log: Entire flow written to
/var/log/sentinel-install-<timestamp>.log (or /tmp/ if not writable). Each line: timestamp + color + symbol.
After installation
# Tarayıcı: ekrana yazılan URL'e gidin
http://<sunucu-public-ip>:3000/login
# Admin: kurulumda girdiğiniz e-posta + parola
# Loglar
sudo docker compose -f /opt/sentineldb360/docker-compose.prod.yml logs -f
# Servis durumu
sudo docker compose -f /opt/sentineldb360/docker-compose.prod.yml ps
# Sürüm yükselt (örn v1.7.26 çıktığında)
sudo sed -i 's|:v1.7.25|:v1.7.26|g' /opt/sentineldb360/docker-compose.prod.yml
sudo docker compose -f /opt/sentineldb360/docker-compose.prod.yml pull
sudo docker compose -f /opt/sentineldb360/docker-compose.prod.yml up -d
License model — 14 days free, no license required
✓ A 14-day free full-feature PoC starts running the moment installation completes — you do not need to acquire a license from DMC, register, or provide a credit card. install.sh automatically sets LICENSE_LOCAL_FALLBACK=true; all 116 compliance tabs, AI Insights, blocking analysis, security center — everything is available.
What is a JWT license?
After 14 days, you receive a JWT license from DMC for permanent use. JWT (RFC 7519) — JSON Web Token — is a small text file containing customer name, plan tier (Starter / Professional / Enterprise), instance limit, validity date. Ed25519-signed (modern asymmetric cryptography) — signed by DMC's private key, verified on your server with the public key.
- 📄 A single text line — pasted into
.env.production (LICENSE_KEY=eyJ...) - 🔌 Offline verification — no internet connection, no ping to DMC servers, no telemetry (works fully in air-gap)
- 🔐 Enterprise security audit — public key fingerprint shown in Admin → License → Diagnostic, your IT team can verify
- 📅 Time-bound — expires to mock mode automatically (no data loss, only monitoring stops), renewal is a single-line change
- 🧩 Industry standard — JetBrains IntelliJ, Sublime Text, JetBrains Toolbox use the same license model
To request a license (after PoC ends or earlier): [email protected] — specify instance count and plan preference, license string is issued same-day via email. Prices: /pricing.