Install Edera – Edera

Install Edera

5 min read · Intermediate

Using EderaON? Follow the EderaON install guide instead. The setup process is different.

This guide walks you through installing Edera on a Linux instance using either the Xen (default) or KVM (Early Access) hypervisor backend.

Choose a backend

Xen KVM
Recommended for Production workloads; maximum security and performance Teams already running KVM; lower barrier to entry
Host kernel Edera-built and maintained kernel Your existing distribution kernel
Reboot required Yes No
Bootloader modified Yes No
Nested virtualization (cloud VMs) Not required Required if not on bare metal
Hardware requirement Broad; supports PV and PVH VT-x or AMD-V

If you’re unsure, use Xen: it’s the default and the production-ready path.

Validate your system

Before installing, run edera-check to confirm your system meets all requirements:

docker run --pull always --pid host --privileged \
  ghcr.io/edera-dev/edera-check:stable preinstall

All Required checks should pass. If anything fails, address the issue before proceeding. See the edera-check reference for details on each check.

Prerequisites

Step 1: Log in to the registry

Run the following commands on the target node. Copy your key.json to the node first if needed.

docker login us-central1-docker.pkg.dev -u _json_key --password-stdin < key.json

Step 2: Run the installer

docker run --privileged \
  --env 'TARGET_DIR=/host' \
  --volume '/:/host' \
  --volume "$HOME/.docker/config.json:/root/.docker/config.json" \
  --pid host \
  --net host \
  us-central1-docker.pkg.dev/edera-protect/staging/protect-installer:${TAG}

Set TAG to the release version you want to install. See Edera release notes for current versions.

The installer reboots the node when complete. Wait 1-2 minutes for it to come back online.

Step 3: Verify installation

sudo protect --version
sudo systemctl status protect-daemon
sudo protect zone list

Expected output from protect zone list:

No zones have been launched.

KVM prerequisites

Nested virtualization

ℹ️

Nested virtualization carries a performance penalty. Bare metal is the preferred deployment target for KVM.

If you’re running inside a VM, the outer hypervisor must expose KVM to the guest. For AWS EC2, see Amazon EC2 nested virtualization. Most general-purpose EC2 instance types do not support nested KVM.

Step 1: Run the installer

Run the following command on the target host:

docker run --privileged \
  --env 'TARGET_DIR=/host' \
  --env 'HYPERVISOR=kvm' \
  --volume '/:/host' \
  --volume "$HOME/.docker/config.json:/root/.docker/config.json" \
  --pid host \
  --net host \
  us-central1-docker.pkg.dev/edera-protect/staging/protect-installer:${TAG}

Set TAG to the release version you want to install. See Edera release notes for current versions.

Step 2: Verify installation

protect help
sudo systemctl status protect-daemon
sudo protect zone list

Kubernetes

These steps apply to both backends.

Confirm nodes are back online

watch kubectl get nodes

Apply the Edera RuntimeClass

kubectl apply -f https://public.edera.dev/kubernetes/runtime-class.yaml
kubectl get runtimeclass

Expected output:

NAME    HANDLER   AGE
edera   edera     1d

Label nodes for Edera workloads

The Edera RuntimeClass includes a nodeSelector that requires nodes to be labeled with runtime=edera:

kubectl label nodes <node-name> runtime=edera

Test with a Pod

kubectl apply -f kubernetes/test-workload.yaml
kubectl wait --for=condition=ready pod/edera-test-pod -n edera-test --timeout=300s
kubectl get pods -n edera-test

Troubleshooting

Node unreachable after Xen install

Expected. The installer reboots the node. Wait 1-2 minutes then reconnect and run sudo protect --version to confirm it’s running.

/dev/kvm not found (KVM)

If /dev/kvm is missing at install time, the installer fails during preflight. If it disappears after install, the daemon fails to start:

ERROR protect-daemon: failed to initialize core runtime: missing /dev/kvm

To recover:

  1. Check what’s missing:
ls -l /dev/kvm
lsmod | grep -E '^kvm_(intel|amd)'
egrep -c '(vmx|svm)' /proc/cpuinfo
  1. If the KVM module isn’t loaded:
sudo modprobe kvm_intel    # or kvm_amd
sudo systemctl restart protect-daemon
  1. If the CPU doesn’t expose vmx or svm, enable hardware virtualization in BIOS/UEFI.
  2. If you’re inside a VM, the outer hypervisor isn’t exposing nested KVM. See nested virtualization above.

Verify Edera services

sudo systemctl status protect-daemon
sudo protect zone list
sudo protect --version

Kubernetes troubleshooting

What’s next

Last updated on 2026-07-24