Agent install and updates

The Loopback agent is the on-host component that drives WireGuard, firewall application, metrics hooks, shell sessions, and update orchestration. This page covers platform-level concerns beyond workspace token minting (see Agents and remote access).

Install and download

System routes serve:

Install script generation for bootstrapping.
Binary download endpoints for agent packages.

Hosts must be able to reach these URLs from their network context; air-gapped installs require operator mirroring.

Version catalog

The platform maintains a catalog of agent releases (semver). Each row typically carries:

Channel - e.g. stable vs preview/unstable (labels vary by operator).
Published flag - controls whether update checks offer the build.
Upgrade eligibility - which currently running versions may move to this release (including wildcard “any” policies where used).
Integrity material for packages (e.g. SHA-512 for Debian assets).
Optional module tags (for example load-balancer firewall integration where enabled).

Update check API

Dedicated update-check endpoints let a running agent ask “is there a newer published version on my channel?” Logic:

Considers only published rows in the requested channel.
Compares semver ordering.
Honors upgrade eligibility for the current version.

204 responses mean no update; 200 returns metadata for the next version.

Module versions

Add-on module catalogs (for example LBFW) follow the same channel and upgrade eligibility semantics.

Update deliveries (operator)