Chapter 3: Prerequisites

← Back to Index | Previous: Architecture | Next: Provisioning package →

3.1 Supported operating systems

Installers auto-detect a supported Linux distribution:

Architecture: x86_64 or ARM64, matching the images in your provisioning package.

3.2 Host accounts and privileges

The DAI and DAP installers install host packages they need at runtime (including Python 3.13, curl, and acl / setfacl for Ansible unprivileged become). Manual Prerequisites cover only what must exist before the installer starts—today that is the age CLI for keypair generation and encrypted handoffs. For DAP backends, the Control enroll wizard's OS tabs (Ubuntu/Debian, RHEL/Rocky/Alma, Amazon Linux 2023) carry only the ready-to-paste age CLI install for the tab matching your host OS — everything else is handled by deslicer-dap-install.sh and its vendored Ansible bundle after you download it.

On RHEL / Rocky / Alma, Python 3.13 is not in BaseOS/AppStream (RHEL 10 ships Python 3.12). Installers enable CodeReady Builder/CRB (AWS RHUI: codeready-builder-for-rhel-<major>-rhui-rpms) and EPEL via the Fedora epel-release-latest-<major>.noarch.rpm URL when AppStream has no epel-release package (common on unregistered RHEL and on EL 10). That unlocks python3.13. Do not run a bare dnf install python3.13 without CRB+EPEL — it fails with No match for argument: python3.13. Install age from the official Filippo binary (not dnf install age).

Docker on RHEL / Rocky / Alma (including RHEL on AWS): both DAI and DAP install Docker CE through the same vendored Ansible role container_engine (inside each product ansible bundle). Installers only bootstrap Python 3.13+, curl, age, and acl; they do not call get.docker.com. Control does not paste Docker commands — Docker repair is re-running the installer (Chapter 10 §10.3). If the installer stops with REBOOT REQUIRED, reboot and re-run the same enroll/install command.

The role pins Docker’s yum $releasever to the OS major (so RHEL 10.2 uses /rhel/10/, not a 404 on /rhel/10.2/), installs CE packages before requiring xt_addrtype capability, and fails closed if docker.service is missing. Kernel *-modules-extra packages are not installed up front: the path is capability-first and touches kernel packages only when addrtype is missing.

After Docker CE packages install, the path must:

1. Install iptables-nft
2. Install docker-ce / Compose plugin (major-pinned repo)
3. Assert docker.service exists
4. Run depmod -a, load optional modules (br_netfilter, overlay, …), and confirm xt_addrtype is available (sysfs loaded, built-in, or modprobe) — Docker CE still uses iptables -m addrtype
5. Only if capability is missing: soft-install/reinstall kernel-modules-extra (RHCK) or kernel-uek-modules-extra (UEK / Oracle) for the running kernel — dnf exclude failures are non-fatal
6. systemctl reset-failed docker then systemctl enable --now docker

If modprobe xt_addrtype fails or journalctl shows Extension addrtype revision 0 not supported, soft-reinstall the matching modules package and retry (no reboot needed when uname -r already matches the newest kernel):

# RHCK (typical RHEL/Rocky/Alma):
sudo dnf install -y "kernel-modules-extra-$(uname -r)" || sudo dnf install -y kernel-modules-extra
# UEK (Oracle / *uek* kernels):
# sudo dnf install -y "kernel-uek-modules-extra-$(uname -r)" || sudo dnf install -y kernel-uek-modules-extra
sudo depmod -a
sudo modprobe xt_addrtype
sudo systemctl reset-failed docker
sudo systemctl enable --now docker
sudo docker info

If a newer kernel RPM is installed than the running kernel and Docker still fails to start, reboot first, then re-run the same enroll/install command (Chapter 10 §10.3).

On Amazon Linux 2023, keep the distro curl-minimal package. Do not force-install the full curl RPM — it conflicts with curl-minimal and breaks Python preflight. Distro docker (not Docker CE) is acceptable on AL2023 when Ansible or optional repair installs it — do not use the RHEL Docker CE path on Amazon Linux.

3.3 Install the age CLI

Both installers need the age tools: they encrypt install-state on first success and decrypt provision.enc.yml / enroll bundles when age-encrypted. Install before generating a host keypair or running deslicer-dai-install.sh. These are the same per-OS commands the Control DAP enroll wizard's OS tabs paste for DAP backend hosts.

Ubuntu / Debian:

sudo apt-get update
sudo apt-get install -y age
age --version
age-keygen --version

RHEL / Rocky / Alma / Amazon Linux:

ARCH="$(uname -m)"
case "$ARCH" in
  x86_64) AGE_ARCH=amd64 ;;
  aarch64|arm64) AGE_ARCH=arm64 ;;
  *) echo "unsupported arch: $ARCH" >&2; exit 1 ;;
esac
curl -fsSL "https://dl.filippo.io/age/latest?for=linux/${AGE_ARCH}" -o /tmp/age.tar.gz
sudo tar -C /usr/local/bin -xzf /tmp/age.tar.gz --strip-components=1 age/age age/age-keygen
sudo chmod 755 /usr/local/bin/age /usr/local/bin/age-keygen
rm -f /tmp/age.tar.gz
age --version
age-keygen --version

Confirm both commands resolve:

command -v age
command -v age-keygen

3.4 DNS and certificates

3.5 Outbound network

Hosts need outbound HTTPS (443) to Deslicer registries and, for ACME, to the certificate authority. See Chapter 9: Network and firewall.

Minimum product destinations:

3.6 Cryptographic material

3.7 Capacity (baseline)

Exact sizing depends on your engagement. As a starting point for a pilot split install:

The Deslicer AI installer enforces an 8 GiB AI-host memory floor before pulling images (fails when /proc/meminfo reports less than ~7 GiB, so cloud “8 GB” instances pass). Prefer 16+ GiB for pilots; undersized hosts typically OOM during Compose start.

Confirm sizing with Deslicer for production fleets.

← Back to Index | Previous: Architecture | Next: Provisioning package →