Updating the agent
How to bring the agent up to date – and why it does not do so by itself.
Why the agent does not update itself #
NODE64 fetches nothing unattended. The agent runs on your servers, often as root – whoever controls its update channel controls every system it is installed on. An automatic update would be exactly that channel.
So: the dashboard tells you a new version is available. You trigger the update.
The short way #
node64-agent updateThat is all. The command downloads the build for your architecture, verifies it, replaces the program and restarts the service.
To look without changing anything:
node64-agent update --checkIf you would rather restart the service yourself:
node64-agent update --no-restart
systemctl restart node64-agentRun it as
root. The agent lives in/usr/local/binand the service belongs to systemd – both belong to root. Without those rights the command stops before touching anything.
What gets verified #
An update is installed only when both hold:
- The signature. The checksum list of a release is signed with a key that was compiled into the agent when it was built. It does not download that key – if it did, anyone who took over the distribution could simply supply their own.
- The checksum. Only once the signature is valid is the program downloaded and checked against the signed checksum.
If either fails, the command stops and leaves the installed program untouched. An agent that is one version behind is harmless; one that runs someone else's code is not.
The swap itself goes through a file next to it and a rename – so a half-written program never sits on disk.
Other installation routes #
| Installed via | Update with |
|---|---|
| Install script (default) | node64-agent update |
| Container | Pull the new image and restart the container |
| Copied by hand | node64-agent update – or fetch the program again from get.node64.de |
How you know something is pending #
The dashboard shows the installed version on every device. If a newer one has been published, a note with the version number appears next to it. What changed is in the agent changelog (agent-changelog).
An update is not an emergency. Releases bring new checks and corrections; none of them makes your systems less safe if you wait a week. What you should not postpone are the findings the agent reports.