go install (any platform with a Go toolchain), or the npm launcher (any platform with Node.js). Windows users can also download a pre-built zip directly from the GitHub releases page.
Install
The curl installer performs mandatory checksum verification before writing anything to disk. The script is downloaded separately from the binary so you can inspect it before running it. It will exit non-zero and refuse to install if the checksum does not match the published release manifest.
Windows (beta)
Windows amd64 support is currently in beta. Download the pre-built archive from the latest GitHub release, extract it, and addironrun.exe to a directory on your PATH.
- Download
ironrun_Windows_x86_64.zipfrom the latest release. - Extract the archive.
- Move
ironrun.exeto a directory that is already on yourPATH(for exampleC:\Users\you\bin), or add the extraction directory to yourPATHin System Settings → Environment Variables.
Verify the installation
After installing by any method, confirm the binary is reachable and print its version:go install from a local clone without ldflags set) prints ironrun vdev instead of a version number — that is expected.
Prerequisites
The npm package (
@generalized-labs/ironrun) is a thin native launcher — it downloads and verifies the correct platform binary on first run rather than bundling a Node.js wrapper. The Go security boundary is preserved; Node.js is only used to bootstrap the binary. Node.js 20 or later is required for the immutable artifact verification the launcher performs.Updating
Re-run the same install command you used originally. The curl installer andgo install always fetch the latest tagged release. For npx, pass @latest explicitly to bypass any cached version:
Next steps
Once ironrun is installed, head to the Quickstart to runironrun setup in your project directory and make your first sealed command execution.