Skip to main content

Install and Run

You can run the Infralib agent as a Docker image (recommended) or as a binary.

Docker image​

The image is published to two registries:

Binary​

go install github.com/entigolabs/entigo-infralib-agent@latest

This installs the binary as entigo-infralib-agent in $(go env GOPATH)/bin. Make sure that directory is in your PATH. The examples in these docs call it ei-agent, the name used when building from source; replace it with entigo-infralib-agent.

To build from source instead:

go build -o bin/ei-agent main.go

Building a local Docker image​

docker build -t entigolabs/entigo-infralib-agent .

Running the Docker image​

By default, the docker image executes the Run command. Config.yaml needs to be mounted into the container. This is required only for the first run or when overriding an existing config.

docker run --pull always -it --rm -v "$(pwd)/config.yaml":"/etc/ei-agent/config.yaml" -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY -e AWS_REGION=$AWS_REGION -e AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN -e CONFIG=/etc/ei-agent/config.yaml entigolabs/entigo-infralib-agent

To execute the bootstrap, override the default command.

docker run --pull always -it --rm -v "$(pwd)/config.yaml":"/etc/ei-agent/config.yaml" -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY -e AWS_REGION=$AWS_REGION -e AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN -e CONFIG=/etc/ei-agent/config.yaml entigolabs/entigo-infralib-agent ei-agent bootstrap

Using with AWS Profile​

Example shell script that checks if the AWS SSO login is valid and runs the agent with the specified profile. Make sure to replace the value of AWS_PROFILE with your chosen AWS profile name. Initialize the AWS profile with aws configure sso --profile profile-name if it doesn't exist. Alternatively to SSO, you can manually edit the ~/.aws/credentials file to add the profile with access key and secret key with token if using temporary credentials. In that case, you can remove the SSO login check from the script.

#!/bin/bash

AWS_REGION="eu-north-1"
AWS_PROFILE="profile-name"

echo "Checking SSO login..."
aws sts get-caller-identity --profile "${AWS_PROFILE}" || {
    echo "SSO login required. Running: aws sso login --profile ${AWS_PROFILE}"
    aws sso login --profile "${AWS_PROFILE}"
}

docker run --pull always -it --rm \
    -v "$(pwd)/config":"/etc/ei-agent/config" \
    -v "$(pwd)/config.yaml":"/etc/ei-agent/config.yaml" \
    -v "$HOME/.aws:/root/.aws:ro" \
    -e AWS_REGION="${AWS_REGION}" \
    -e AWS_PROFILE="${AWS_PROFILE}" \
    -e CONFIG=/etc/ei-agent/config.yaml \
    entigolabs/entigo-infralib-agent ei-agent run

Using with Oracle Cloud​

The agent resolves Oracle credentials the same way as the oci CLI. For local use, create an API key config with oci setup config, which writes ~/.oci/config and a private key PEM. Mount ~/.oci at the same path inside the container and point --oci-config-file/OCI_CONFIG_FILE at it — the agent then uses the config as-is, with no edits.

#!/bin/bash

OCI_REGION="eu-frankfurt-1"
OCI_COMPARTMENT_ID="ocid1.compartment.oc1..aaaa..."

docker run --pull always -it --rm \
    -v "$(pwd)/config":"/etc/ei-agent/config" \
    -v "$(pwd)/config.yaml":"/etc/ei-agent/config.yaml" \
    -v "$HOME/.oci:$HOME/.oci:ro" \
    -e OCI_CONFIG_FILE="$HOME/.oci/config" \
    -e OCI_REGION="${OCI_REGION}" \
    -e OCI_COMPARTMENT_ID="${OCI_COMPARTMENT_ID}" \
    -e CONFIG=/etc/ei-agent/config.yaml \
    entigolabs/entigo-infralib-agent ei-agent run

OCI_COMPARTMENT_ID selects the Oracle provider and OCI_REGION sets the region (equivalent to the --oci-compartment-id and --oci-region flags). Credentials come from the DEFAULT profile of the mounted ~/.oci/config; use --oci-profile/OCI_PROFILE to pick another profile, which still falls back to DEFAULT for any values it omits.

Mounting ~/.oci at the host's own path (rather than a fixed /root/.oci) is what avoids editing the config: oci setup config records an absolute host path for key_file (e.g. /Users/you/.oci/oci_api_key.pem), so the key only resolves inside the container when ~/.oci is mounted at that same path. If you prefer a fixed -v "$HOME/.oci:/root/.oci:ro" mount, edit key_file in ~/.oci/config to the in-container path /root/.oci/oci_api_key.pem instead.