Install OX Runtime Sensor on Linux Host

Install the OX Runtime Sensor as a systemd service on a bare or on-premises Linux machine. Use this method when the host is not part of a Kubernetes cluster and is not running on AWS EC2.

Prerequisites

• Linux with kernel v5.10 and later and BTF enabled (/sys/kernel/btf/vmlinux must exist).

• Docker or containerd installed and running.

• sudo access on the host.

• Outbound HTTPS access to api.cloud.ox.security

• An OX API key.

Step 1: Install the sensor

1. Run

curl -s https://charts.cloud.ox.security/install.sh | sudo OX_API_KEY=<API_KEY> bash

1. To group this host under a meaningful name in the OX UI, add OX_CLUSTER_NAME:

curl -s https://charts.cloud.ox.security/install.sh | \
  sudo OX_API_KEY=<API_KEY> \
       OX_CLUSTER_NAME=<HOST_GROUP_NAME> \
       bash

The script auto-detects your container runtime, stores the API key securely in /root/ox-runtime-sensor/env (mode 0600), and starts the ox-runtime-sensor systemd service.

Step 2: Verify

curl -s https://charts.cloud.ox.security/install.sh | sudo bash -s -- --status
sudo journalctl -u ox-runtime-sensor -f

Step 3: Connect to OX Runtime Sensor

Configuration reference

Variable	Required	Default	Description
OX_API_KEY	yes	—	API key from the OX Security dashboard
OX_CLUSTER_NAME	no	system hostname	Name shown in the OX UI to identify this host or group of hosts
OX_API_ENDPOINT	no	https://api.cloud.ox.security/api/agent-service	OX backend endpoint (do not change unless instructed)

Uninstall

curl -s https://charts.cloud.ox.security/install.sh | sudo bash -s -- --uninstall