Prerequisites

What a host needs before installing Volt.

Operating system

• Linux kernel 5.10+ — 5.13+ recommended so the full Landlock LSM sandbox is available. Older kernels run containers but skip the newest hardening.
• systemd 245+ — Volt runs each workload as a systemd-nspawn machine under a transient/managed unit. systemd is the init and container supervisor.
• cgroup v2 — the unified hierarchy (default on current distributions) is used for per-workload CPU/memory limits.
• user namespaces enabled — kernel.unprivileged_userns_clone=1 (Debian/Ubuntu enable this by default) so workloads run unprivileged.

Tested distributions: Debian 12/13, Ubuntu 22.04/24.04, Fedora 39+, and derivatives.

Architecture

• x86_64 (amd64) — the native runtime target. Release binaries are published as volt-linux-x86_64.
• Foreign architectures (aarch64, riscv64, s390x, …) run via the Emulated runtime — QEMU user-mode + binfmt_misc. No hardware virtualization required. See Virtual Machines.

Privileges

• Root is required for the one-time install (it creates the volt system user, directories, the systemd unit, and firewall rules).
• After install, day-to-day volt commands are brokered by the managed service — workloads themselves run unprivileged with capabilities dropped.

Packages (installed automatically)

The curl -sSL https://get.armoredgate.com/volt | sh installer adds these if missing:

systemd-container   # systemd-nspawn — the container runtime
nftables           # bridge NAT + port mapping firewall
curl tar ca-certificates  # fetch + verify signed artifacts

For Virtual Machines (optional)

• /dev/kvm — hardware virtualization must be present and exposed. On a bare-metal host enable VT-x/AMD-V in firmware; inside a cloud VM you need nested virtualization enabled by the provider.
• Check with ls -l /dev/kvm and volt vm capabilities. Without KVM the VM runtime is simply unavailable — containers and Emulated workloads still run.

Network & connectivity

• Volt creates a Linux bridge (voltbr0) for workload networking — see Networking.
• Outbound HTTPS (443) to cdn.armoredgate.com (release + image blobs) and get.armoredgate.com (installer). No inbound ports are opened unless you publish one with -p.
• Set a real hostname before install — the installer warns on the default localhost, and node identity/signing use it.

Suggested resources

Next steps

• Getting Started — install and run your first workload.
• Networking — bridges, port mapping, and the firewall.
• Security Model — Landlock, seccomp, and capability dropping.